In re Columbia University Data Breach Litigation, Case No. 1:25-cv-05541 (PKC) United States District Court for the Southern District of New York If you are a U.S. resident whose Private Information was compromised as a result of the Columbia University Cyberattack and who were sent notice of the Cyberattack that occurred in May 2025, you may be entitled to benefits from a class action settlement. A New York federal court has authorized this notice. This is not a solicitation from a lawyer.  A $16,125,000 settlement has been reached in a class action lawsuit against Trustees of Columbia University in the City of New York (“Defendant”) arising out of a data incident Defendant experienced in May 2025, by an unauthorized third party (the “Cyberattack”).  You are part of the Settlement Class if you are an individual residing in the United States whose Private Information was compromised as a result of the Cyberattack and who were sent notice of the Cyberattack that occurred in May 2025.  Under the terms of the Settlement, Settlement Class Members who submit timely Valid Claims may be able to recover the following benefits: o Reimbursement for Documented Monetary Losses: With supporting documentation showing you incurred losses as a result of the Cyberattack, you may be eligible for reimbursement up to $8,500.00. OR o Alternative Cash Payment: You may elect to receive an Alternative Cash Payment. The amount shall be determined by distributing the remaining Settlement Fund after deduction or payment of Court-approved attorneys’ fees and litigation expenses, Service Awards, Settlement Administration Costs, Credit Monitoring costs, and approved claims for Documented Monetary Losses. AND o Credit Monitoring and Identity Theft Protection Services: In addition to receiving reimbursement for Documented Monetary Losses or a cash payment, you may elect to receive two (2) years of free three-bureau credit monitoring services, dark web monitoring, identity theft insurance coverage for up to $1,000,000, and fully managed identity recovery services.  Business Practice Commitments: Although Defendant denies any wrongdoing or liability, Defendant has already and is continuously implementing additional security enhancements including defensive tools and increased monitoring. Defendant has committed to maintain its additional security measures for a period of 3 years following the effective date of this Settlement. Questions? Go to www.ColumbiaUniversityDataSettlement.com or call 1-833-617-4373 1 This notice may affect your rights. Please read it carefully. Your Legal Rights and Options Deadline SUBMIT A The only way to get Settlement Benefits is to submit Submitted online or CLAIM FORM a Valid Claim. If you submit a Claim Form, you will postmarked by give up the right to sue Defendant in a separate January 21, 2027 lawsuit about the legal claims this Settlement resolves. SUBMIT A Get no Settlement benefits. Keep your right to file Postmarked by REQUEST FOR your own lawsuit against Defendant about the legal December 22, 2026 EXCLUSION claims in this lawsuit. OBJECT TO THE Stay in the Settlement, but tell the Court why you do Postmarked by SETTLEMENT not agree with the Settlement. You will still be bound December 22, 2026 by the Settlement if the Court approves it. DO NOTHING Get no Settlement benefits. You will still be bound by the Settlement if the Court approves it and will give up your right to sue Defendant for the claims this Settlement resolves.  These rights and options—and the deadlines to exercise them—are explained in this notice.  The Court must still decide whether to approve the Settlement. There will be no Settlement benefits unless the Court approves the Settlement, and it becomes final. BASIC INFORMATION 1. Why is this Notice being provided? A Court authorized this notice because you have the right to know about the proposed Settlement of this class action lawsuit and all of your rights and options before the Court decides to grant Final Approval of the Settlement. This notice explains the lawsuit, the Settlement, your legal rights, what benefits are available, who is eligible for the benefits, and how to get them. The Honorable P. Kevin Castel of the United States District Court for the Southern District of New York is overseeing this class action. The lawsuit is known as In re Columbia University Data Breach Litigation, Case No. 1:25-cv-05541 (PKC) (the “Action”). The persons who filed this Action are called the “Plaintiffs” and/or “Class Representatives” and the entity sued, Trustees of Columbia University in the City of New York, is called the “Defendant.” 2. What is this Action about? Plaintiffs filed this lawsuit against Defendant. Plaintiffs allege that in May 2025, an unauthorized third party accessed certain Private Information maintained by Defendant, including individuals’ full names, dates of birth, addresses, contact details, genders, ethnicities, citizenship statuses, Social Security numbers, driver’s license numbers, financial account information (including, but not limited to, credit and debit card information, as well as bank account and routing numbers), medical information, health insurance information, academic histories, financial aid-related information, test scores, academic grades, admission decisions, expected graduation dates, financial aid statuses, financial aid awards, and tuition information. Questions? Go to www.ColumbiaUniversityDataSettlement.com or call 1-833-617-4373 2 Plaintiffs brought this lawsuit against Defendant alleging legal claims for negligence, breach of implied contract, unjust enrichment, breach of bailment, violation of the Connecticut Unfair Trade Practices Act, violation of the Texas Deceptive Trade Practices-Consumer Protection Act, violation of the Maryland Consumer Protection Act, violation of the New York General Business Law, violation of the New Jersey Consumer Fraud Act, violation of the Pennsylvania Unfair Trade Practices and Consumer Protection Law, invasion of privacy under California’s constitution, violation of the California Customer Records Act, violation of the California Unfair Competition Law, violation of the Tennessee Personal Consumer Information Release Act, and declaratory judgment. Defendant denies these allegations and denies any wrongdoing or liability. The Court has not made any judgment or other determination of any wrongdoing or that the law has been violated. Instead, Plaintiffs and Defendant have agreed to a settlement to avoid the risk, cost, and time of continuing the Action. 3. Why is the Action a class action? In a class action, one or more people (called plaintiff(s) or class representative(s)) sue on behalf of all people who have similar legal claims. Together, all of these people are called a “class” or “class members.” If the plaintiffs and defendant reach a settlement, the court resolves the issues for all class members via the settlement, except for those class members who timely opt out (exclude themselves) from the settlement. The proposed Class Representatives in this lawsuit are Plaintiffs Khamari Babb, Raymond Chao, Steven Daley, Randall Erwin, David Guirgis, Alex Hall, Shakeem Holmes, Rema Khacho, Lauren Kramer, Luke Linich, Nadav Margalit, John McQueen, Liam Murray, Gabriela Nadeau, Joseph Quintero, Carrick Reider, Andrew Rudick, and Mary Thomas. 4. Why is there a Settlement? Plaintiffs and Defendant do not agree about the legal claims made in the Action. The Action has not gone to trial, and the Court has not decided in favor of Plaintiffs or Defendant. Instead, Plaintiffs and Defendant have agreed to settle the Action. The Class Representatives believe the Settlement is best for all individuals in the Settlement Class because of the benefits available to the Settlement Class and the risks and uncertainty associated with continuing the Action. WHO IS INCLUDED IN THE SETTLEMENT 5. How do I know if I am part of the Settlement? You are part of the Settlement Class if you are an individual residing in the United States whose Private Information was potentially accessed by one or more unauthorized third parties during the Cyberattack including if you were sent notice of the Cyberattack. Columbia estimates that there are 2,973,631 Settlement Class Members. 6. Are there exceptions to being included in the Settlement? Yes. Excluded from the Settlement Class are (a) Defendant and Defendant’s parents, subsidiaries, affiliates, officers and directors, and any entity in which Defendant has a controlling interest; (b) all individuals who make a timely election to be excluded from this proceeding using the correct protocol for opting out; (c) Defendant’s Counsel, as well as their Questions? Go to www.ColumbiaUniversityDataSettlement.com or call 1-833-617-4373 3 immediate family members; and (d) all judges assigned to hear any aspect of this litigation, as well as their immediate family members. 7. What if I am still not sure whether I am part of the Settlement? If you are still not sure whether you are a Settlement Class Member, you may go to the Settlement Website at www.ColumbiaUniversityDataSettlement.com or call the Settlement Administrator’s toll-free telephone number at 1-833-617-4373. THE SETTLEMENT BENEFITS—WHAT YOU GET IF YOU QUALIFY 8. What does the Settlement provide? If you are a Settlement Class Member and you timely submit a Valid Claim, you may be eligible for the following Settlement benefits: (1) Reimbursement for Documented Monetary Losses: With supporting documentation showing you incurred losses as a result of the Cyberattack, you may be eligible for reimbursement up to $8,500.00. OR (2) Alternative Cash Payment: You may elect to receive an Alternative Cash Payment. The amount shall be determined by distributing the remaining Settlement Fund after deduction or payment of Court-approved attorneys’ fees and litigation expenses, Service Awards, Settlement Administration Costs, Credit Monitoring costs, and approved claims for Documented Monetary Losses. AND (3) Credit Monitoring and Identity Theft Protection Services: In addition to receiving reimbursement for Documented Monetary Losses or a cash payment, you may elect to receive – at no cost to you – two (2) years of free three-bureau credit monitoring services, dark web monitoring, identity theft insurance coverage for up to $1,000,000, and fully managed identity recovery services. (4) Business Practice Commitments: Although Defendant denies any wrongdoing or liability, Defendant has already and is continuously implementing additional security enhancements including defensive tools and increased monitoring. Defendant has committed to maintain its additional security measures for a period of 3 years following the effective date of this Settlement. 9. What am I giving up to receive Settlement benefits or stay in the Settlement Class? Unless you opt out of the Settlement, you are choosing to remain in the Settlement Class. If the Settlement is approved and becomes final, all Court orders will apply to you and legally bind you. You will not be able to sue, continue to sue, or be part of any other lawsuit against the Released Parties, including Defendant, about the legal issues in this lawsuit that are released by this Settlement. The specific rights you are giving up are called “Released Claims.” Questions? Go to www.ColumbiaUniversityDataSettlement.com or call 1-833-617-4373 4 10. What are the Released Claims? The Settlement Agreement in Section XIII describes the Released Claims and the Release, in necessary legal terminology, so please read this section carefully. The Settlement Agreement is available at www.ColumbiaUniversityDataSettlement.com or in the public Court records on file in this lawsuit. For questions regarding the Release or Released Claims and what the language in the Settlement Agreement means, you can also contact Class Counsel listed in Question 16 for free, or you can talk to your own lawyer at your own expense. HOW TO GET BENEFITS FROM THE SETTLEMENT 11. How do I make a Claim for Settlement benefits? To receive any of the benefits described in Question 8 (other than the Business Practice Commitments), you must submit a Valid Claim, postmarked or submitted online by January 21, 2027. Claim Forms may be submitted online at www.ColumbiaUniversityDataSettlement.com or printed from the Settlement Website and mailed to the Settlement Administrator at the address on the Claim Form. The quickest way to submit a Claim is online. Claim Forms are also available by calling 1-833-617-4373 or by writing to: Columbia University Data Settlement Administrator 1650 Arch Street, Suite 2210 Philadelphia, PA 19103 This is a closed class and the benefits described herein are available only to Settlement Class Members with a unique Notice ID Number. Claims submitted by non-Settlement Class Members will be rejected. Claim Forms must be submitted online by, or by mail postmarked by, January 21, 2027. 12. What happens if my contact information changes after I submit a Claim? If you change your mailing address or email address after you submit a Claim Form, it is your responsibility to inform the Settlement Administrator of your updated information. You may notify the Settlement Administrator of any changes by calling 1-833-617-4373 or by writing to: Columbia University Data Settlement Administrator 1650 Arch Street, Suite 2210 Philadelphia, PA 19103 13. How much will my payment be? The amount of your payment will depend on the approved amount of your claim and the total value of all approved claims. It is anticipated that the Settlement Fund will be sufficient to provide cash payments to all Settlement Class Members who submit eligible claims. However, the amount of your payment may be reduced on a pro rata basis depending on the number of claims submitted. Questions? Go to www.ColumbiaUniversityDataSettlement.com or call 1-833-617-4373 5 If you are claiming Documented Monetary Losses under the Settlement, you must provide supporting information, including (1) the Claim Form; (2) documentation supporting your Claim; and (3) a sworn, brief description of the nature of the loss, if the nature of the loss is not apparent from the documentation alone. Documentation supporting Documented Monetary Losses can include receipts or other documentation not “self-prepared” by you that documents the costs incurred. “Self-prepared” documents such as handwritten receipts are, by themselves, insufficient to receive reimbursement, but can be considered to add clarity to or support other submitted documentation. You will not be reimbursed for expenses if you have been reimbursed for the same expenses by another source, including compensation provided in connection with any credit monitoring and identity theft protection product. For Documented Monetary Losses, you must also show that: (1) the timing of the loss occurred on or after May 16, 2025; and (2) the Private Information used to commit identity theft or fraud consisted of the same type of Private Information that was potentially exposed in the Cyberattack. If your award for claimed Documented Monetary Losses would for any reason be less than the Alternative Cash Payment that would otherwise be awarded, you will be awarded the larger amount. 14. When will I receive my Settlement benefits? If you submit a timely and Valid Claim, payment will be made to you by the Settlement Administrator after the Settlement is approved by the Court and becomes final. It may take time for the Settlement to be approved and become final. Please be patient and check www.ColumbiaUniversityDataSettlement.com for updates. 15. How will I receive my payment? Several electronic payment options will be available, or you can elect to receive a check. If you submit a timely and Valid Claim for payment, and if your Claim and the Settlement are finally approved, you will be sent an electronic payment via the option that you select when you file your claim, or you will be sent a paper check if you select that option. Please ensure you have provided a current and complete email address. If you select a paper check, the Settlement Administrator will attempt to send you a check relying on your physical address submitted on your Claim Form. THE LAWYERS REPRESENTING YOU 16. Do I have a lawyer in this lawsuit? Yes, the Court has appointed William B. Federman of Federman & Sherwood, Ashley M. Crooks of Hausfeld LLP, Rachele R. Byrd of Wolf Haldenstein Adler Freeman & Herz LLP, and Charles E. Schaffer of Levin Sedran & Berman, LLC as Class Counsel lawyers to represent you and the Settlement Class for the purposes of this Settlement. You may hire your own lawyer at your own cost and expense if you want someone other than Class Counsel to represent you in this lawsuit. Questions? Go to www.ColumbiaUniversityDataSettlement.com or call 1-833-617-4373 6 Class Counsel may be contacted at the following addresses and phone numbers: William B. Federman, Esq. Ashley M. Crooks, Esq. FEDERMAN & SHERWOOD HAUSFELD LLP 10205 N. Pennsylvania 33 Whitehall Street, 14th Floor Oklahoma City, OK 73102 New York, NY 10004 (405) 235-1560 (636) 357-1100 Rachele R. Byrd, Esq. Charles E. Schaffer, Esq. WOLF HALDENSTEIN ADLER LEVIN SEDRAN & BERMAN, LLC FREEMAN & HERZ LLP 510 Walnut Street, Suite 500 750 B Street, Suite 1820 Philadelphia, PA 19106 San Diego, CA 92101 (215) 592-1500 (619) 239-4599 17. How will Class Counsel be paid? Class Counsel will file a motion asking the Court to award attorneys’ fees of up to 25% ($4,031,250.00) of the $16,125,000 Settlement Fund, plus reimbursement of out-of-pocket litigation expenses. The Court may award less than the amount requested. Class Counsel will also request approval of Service Awards of five hundred dollars ($500) for each of the Class Representatives. If awarded by the Court, the Settlement Administrator will pay attorneys’ fees, litigation expenses, and service awards out of the Settlement Fund. Class Counsel’s motion for Attorneys’ Fees, Litigation Expenses, and Service Awards will be made available on the Settlement Website at www.ColumbiaUniversityDataSettlement.com before the deadline for you to object to or opt out of the Settlement. OPTING OUT OF THE SETTLEMENT If you are a Settlement Class Member and want to keep any right you may have to sue or continue to sue the Released Parties on your own based on the legal claims raised in this lawsuit or released by the Released Claims, then you must take steps to request exclusion from (or opt out of) the Settlement. 18. How do I opt out of the Settlement? To opt out of the Settlement, you must timely mail written notice of a Request for Exclusion. The written notice must include: (1) The case name and number; (2) Your full name, current address, telephone number, and email address (if any); (3) A statement indicating your request to be excluded from the Settlement Class; and (4) Your physical signature as a Settlement Class Member; The Request for Exclusion must be mailed to the Settlement Administrator at the following address, and be postmarked by December 22, 2026: Questions? Go to www.ColumbiaUniversityDataSettlement.com or call 1-833-617-4373 7 Columbia University Data Settlement Administrator ATTN: Exclusions PO Box 58220 Philadelphia, PA 19102 You cannot opt out by telephone or by email. “Mass” or “class” requests for exclusion filed by third parties on behalf of a “mass” or “class” of Settlement Class Members or multiple Settlement Class Members where Request for Exclusion has not been signed by each and every individual Settlement Class Member will not be allowed. 19. If I opt out can I still get anything from the Settlement? No. If you opt out, you will not be entitled to receive any Settlement benefits, but you will not be bound by any judgment in this lawsuit. You can only get Settlement benefits if you stay in the Settlement and submit a Valid Claim. 20. If I do not opt out, can I sue Defendant for the same thing later? No. Unless you opt out, you give up any right to sue Defendant and other Released Parties for the legal claims this Settlement resolves and Releases relating to the Cyberattack. You must opt out of the lawsuit to start or continue with your own lawsuit or be part of any other lawsuit against Defendant or other Released Parties. If you have a pending lawsuit, speak to your lawyer in that case immediately. OBJECTING TO THE SETTLEMENT 21. How do I tell the Court that I do not like the Settlement? If you are a Settlement Class Member, you can tell the Court you do not agree with all or any part of the Settlement and/or Class Counsel’s motion for Attorneys’ Fees, Litigation Expenses, and Service Awards. To object, you must mail a timely, written objection stating that you object. Your objection must be postmarked by December 22, 2026. The objection must also include all of the following information: (1) Your full name, current address, current telephone number, and email address (if any); (2) The case name and case number, In re Columbia University Data Breach Litigation, Case No. 1:25-cv-05541-PKC (S.D.N.Y.); (3) Documentation sufficient to establish membership in the Settlement Class, such as a copy of the Postcard Notice you received; (4) A statement of the position(s) you wish to assert, including the factual and legal grounds for the position(s); and (5) Copies of any other documents that you wish to submit in support of your position. To be timely, written notice of an objection in the appropriate form must be mailed, postmarked by December 22, 2026, to the Settlement Administrator at: Questions? Go to www.ColumbiaUniversityDataSettlement.com or call 1-833-617-4373 8 Columbia University Data Settlement Administrator ATTN: Objections PO Box 58220 Philadelphia, PA 19102 You may also file any Objection with the Court. 22. What is the difference between objecting and asking to opt out? Objecting is simply telling the Court you do not like something about the Settlement or requested attorneys’ fees and expenses. You can object only if you stay in the Settlement Class (meaning you do not opt out of the Settlement). Opting out of the Settlement is telling the Court you do not want to be part of the Settlement Class or the Settlement. If you opt out, you cannot object to the Settlement. THE FINAL APPROVAL HEARING 23. When and where will the Court decide whether to approve the Settlement? The Court will hold a Final Approval Hearing on February 23, 2027, at 2:00 P.M. ET before the Honorable P. Kevin Castel at the Daniel Patrick Moynihan United States Courthouse, Courtroom 11D, 500 Pearl Street, New York, NY 10007. At this hearing, the Court will consider whether the Settlement is fair, reasonable, and adequate and decide whether to approve the Settlement, Class Counsel’s Application for Attorneys’ Fees, Litigation Expenses, and Service Awards. If there are objections, the Court will consider them. The Court will also listen to Settlement Class Members who have asked to speak at the hearing. Note: The date and time of the Final Approval Hearing are subject to change. Any change will be posted at www.ColumbiaUniversityDataSettlement.com. 24. Do I have to attend the Final Approval Hearing? No. Class Counsel will answer any questions the Court may have. However, you are welcome to attend at your own expense. If you mail an objection, you do not have to attend the Final Approval Hearing to speak about it. As long as you mail your written objection on time, the Court will consider it. 25. May I speak at the Final Approval Hearing? Yes, as long as you do not opt out, you can (but do not have to) participate and speak for yourself at the Final Approval Hearing. This is called making an appearance. You also can have your own lawyer speak for you, but you will have to pay for the lawyer yourself. IF YOU DO NOTHING 26. What happens if I do nothing at all? If you are a Settlement Class Member and you do nothing, you will not receive any Settlement benefits, and you will give up rights explained in the “Opting Out of the Settlement” section of Questions? Go to www.ColumbiaUniversityDataSettlement.com or call 1-833-617-4373 9 this notice, including your right to start a lawsuit, continue with a lawsuit, or be part of any other lawsuit against any of the Released Parties, including Defendant, about the legal issues in this lawsuit that are released by the Settlement Agreement relating to the Cyberattack. GETTING MORE INFORMATION 27. How do I get more information? This Notice summarizes the proposed Settlement. Complete details are provided in the Settlement Agreement. The Settlement Agreement and other related documents are available at www.ColumbiaUniversityDataSettlement.com, by calling 1-833-617-4373 or by writing to: Columbia University Data Settlement Administrator 1650 Arch Street, Suite 2210 Philadelphia, PA 19103 PLEASE DO NOT TELEPHONE THE COURT OR THE COURT’S CLERK OFFICE REGARDING THIS NOTICE. Questions? Go to www.ColumbiaUniversityDataSettlement.com or call 1-833-617-4373 10