In 2025, Columbia University experienced a data breach that began on May 16, 2025, with hackers maintaining access for over two months. The university confirmed containment by June 24, 2025. Notifications to state attorneys general in Maine and California indicate regulatory awareness and action. Columbia University's Office of Public Affairs stated there has been no further unauthorized access since June 24.
Approximately 868,969 individuals, including students, applicants, employees, alumni, and their families, had their data compromised. The exposed data types include Social Security numbers, full names, contact details, dates of birth, demographic information, academic records, financial aid data, insurance details, immunization records, and disability accommodations. It remains unclear if all affected individuals had all data types exposed. Columbia University Irving Medical Center patient records were not breached.
Columbia University has also offered two years of free credit monitoring, fraud consultation, and identity theft restoration via Kroll to affected individuals. The university began mailing notifications to affected consumers via the U.S. Postal Service starting August 7, 2025.