Columbia University Data Breach Settlement

You may choose either reimbursement for qualifying documented monetary losses, up to $8,500, or an Alternative Cash Payment. You may also choose two years of credit-monitoring and identity-protection services in addition to either of those choices.
The cash-payment amount is not fixed. It comes from the money remaining in the settlement fund after the listed costs and approved documented-loss claims are paid or deducted.

For a documented-loss claim, submit the Claim Form and records supporting the expense. If the records do not make the nature of the loss clear, also provide a short sworn description.
Receipts or other records not prepared by you can support the claim. A handwritten receipt or other self-prepared record alone is not enough.
The loss must have happened on or after May 16, 2025. The information used for the identity theft or fraud must be the same type of information that may have been exposed in the Cyberattack. Expenses already reimbursed from another source cannot be reimbursed again.
If the approved documented-loss amount would be lower than the Alternative Cash Payment, the notice says you will receive the larger amount.

Submit a Valid Claim online or by mail. The online claim must be submitted, or the mailed claim postmarked, by January 21, 2027.
The notice says this is a closed class. Benefits are available only to Settlement Class Members with a unique Notice ID Number, and claims from non-members will be rejected.
The notice does not provide the full standards for deciding whether a claim is valid.

There is no stated fixed amount for an Alternative Cash Payment. It depends on the money left in the settlement fund after the listed costs and approved documented-loss claims.
The notice anticipates that the fund will cover eligible cash claims, but says payments may be reduced proportionally if the number of claims requires it.

The defendant has committed to maintain additional security measures, including defensive tools and increased monitoring, for three years after the settlement’s effective date.
This is not a benefit you claim individually. The notice says a Valid Claim is required for the Question 8 benefits other than these business-practice commitments.

If you submit a timely, valid claim, benefits are to be sent after the Court approves the settlement and it becomes final.
You can choose an available electronic payment method when filing the claim, or choose a paper check. Provide a current email address for an electronic payment or a current mailing address for a check.

To opt out, mail a written Request for Exclusion postmarked by December 22, 2026. It must include the case name and number, your contact information, a statement asking to be excluded, and your physical signature.
You cannot opt out by phone or email. If you opt out, you cannot receive settlement benefits, but you are not bound by the judgment in this case.

You may object only if you remain in the Settlement Class. Mail a written objection postmarked by December 22, 2026.
The objection must provide your contact information, the case name and number, documentation showing class membership, your position and its factual and legal grounds, and copies of supporting documents you want to submit.
The notice says you may also file an objection with the Court.

You will not receive settlement benefits.
If the settlement is approved and becomes final, you will still be bound by it and give up the rights described in the opt-out section, including the right to bring, continue, or join certain lawsuits about the Cyberattack claims resolved by the settlement.

The Final Approval Hearing is scheduled for February 23, 2027, at 2:00 P.M. ET, in Courtroom 11D at the Daniel Patrick Moynihan United States Courthouse, 500 Pearl Street, New York, New York.
You do not have to attend. The hearing date and time may change.

Other Important Dates

Exclusion deadline: 2026-12-22
Objection deadline: 2026-12-22
Final approval hearing: February 23, 2027, at 2:00 P.M. ET
Hearing location: Daniel Patrick Moynihan United States Courthouse, Courtroom 11D, 500 Pearl Street, New York, NY 10007

Total settlement fund: $16,125,000
Case name: In re Columbia University Data Breach Litigation
Case number: 1:25-cv-05541 (PKC)
Court: United States District Court for the Southern District of New York
Administrator: Columbia University Data Settlement Administrator
Official Settlement Website: https://www.ColumbiaUniversityDataSettlement.com

Official Settlement Website
Claim form, FAQ, deadlines, administrator information

Official Settlement Notice (PDF)
Court-approved notice describing eligibility and benefits