Columbia University data breach: what happened and what to do

What happened

Columbia University says an intruder got into its systems on or about May 16, 2025. The first visible sign came on June 24, 2025, when a service interruption hit some of its computer systems. Reports differ on the exact discovery date, with one placing it on July 8, 2025. The university reported the incident to law enforcement and brought in cybersecurity experts.

Columbia started sending notice letters on August 7, 2025. A filing with the Maine Attorney General's office put the number of people affected at 868,969, which news outlets rounded to about 870,000. The people affected include students, employees, applicants and, in some cases, family members. The attacker was reported to have claimed around 460 gigabytes of data. No group has been reported as taking responsibility.

What was exposed

For students and applicants, the files involved admissions, enrollment and financial aid. For some employees, the data included contact details, Social Security numbers, demographic information, academic records, financial aid information, insurance information and health data. Columbia says no patient records from Columbia University Irving Medical Center were affected.

Exactly what was exposed depends on your relationship with the university, so the letter is the best guide to your own case.

What that lets criminals do

Admissions and financial aid files hold a lot of family detail: addresses, income information and names of parents. That makes strong material for phishing, including messages that pose as a college, a loan servicer or a financial aid office. Applicants are often young and have thin credit files, which makes them a target for new-account fraud, and a freeze is useful because nobody expects to see new credit appear on a file that is barely used.

Where Social Security numbers were included, the usual identity theft risks apply: new credit in your name, fake tax returns and phone contracts. Health and insurance data can also be used for targeted scams.

The company's response

Columbia offered two years of free credit monitoring, fraud counseling and identity theft protection services to people who got a letter. It says it reported the incident to law enforcement and is working with outside experts. If you applied or studied there and got a letter, enroll before the deadline it states.

How to protect yourself

Start with the credit freeze if a Social Security number was involved, and for a young adult or a minor, ask the bureaus how to freeze a file for someone under 18. Then change the password on your university account and anywhere you reused it, and turn on two-factor login. Treat any message that mentions Columbia, a loan or financial aid with care, and use the school's official site instead of a link.