Columbia University says the hacker behind its 2025 cyberattack was driven by politics, not profit, and that investigators found no evidence the personal data stolen from nearly 869,000 people was ever sold or passed around on the dark web. The finding, posted by university officials, closes out a year of uncertainty for students, applicants and employees whose Social Security numbers, health records and financial-aid details were exposed in the breach.
“Our investigation determined this was carried out by a hacker whose stated motivation was political,” Columbia University Information Technology said in its update. The office added that “we found no evidence that this was financially motivated or that the data has been sold or distributed on the dark web.” The hacker also claimed responsibility for a March 2025 breach at New York University, in which admissions data posted on NYU's website purported to show admitted Asian and white students carried higher average GPAs and test scores than admitted Black and Hispanic students.
The hacker said the goal was to find evidence that Columbia continued considering race in admissions after the Supreme Court struck down affirmative action in 2023. That claim has not been independently verified beyond the hacker's own statement. The breach itself first surfaced in the summer of 2025, when Columbia said an unauthorized party “gained access to and stole data from our network,” according to Columbia University Information Technology, with the disruption severe enough that computer systems across campus went down for days.
What Data Was Taken
The university said the exposed information included admissions, enrollment and financial-aid records tied to students and applicants, along with personal information belonging to some employees. Per the same university account, the affected categories spanned Social Security numbers, contact details, demographic information, academic history, financial-aid and insurance records, and certain health information. The Spectator put the number of affected applicants and affiliates at around 870,000.
The timing of the hack drew outside attention in part because of Columbia's broader standoff with federal officials. The federal government pulled Columbia's federal funding amid allegations of campus antisemitism, and Columbia later reached a federal funding deal in July 2025. Those episodes are separate from the cyberattack itself, but they frame the political backdrop the hacker cited as motivation.
A $16.1 Million Settlement Moves Forward
Columbia has agreed to pay $16,125,000 to resolve a class-action lawsuit brought over the breach, according to the Columbia University Data Settlement website, with a federal court granting preliminary approval in September. Eligible class members can seek reimbursement of up to $8,500 for documented out-of-pocket losses tied to the breach, or choose a simpler alternative cash payment of about $100, a tradeoff confirmed by Bloomberg Law. The settlement also provides two years of credit monitoring for claimants, per the Spectator's reporting.
A federal court appointed Angeion Group LLC as claims administrator, and the firm has launched a settlement website and will send affected individuals instructions on how to file. Anyone who wants to exclude themselves from the settlement, or to object to or comment on it, must do so by Dec. 22, according to the settlement site. Those who do submit a claim form, however, give up that separate right to sue, per the settlement notice.
The claim-form deadline is Jan. 21, 2027, and a final approval hearing is scheduled for Feb. 23, 2027, both dates confirmed on the settlement website. Columbia has also committed to maintaining its additional security measures for three years following the settlement's effective date.
Columbia's Security Response
University officials said Columbia took proactive steps to strengthen data security and governance practices following the attack. Columbia engaged CrowdStrike Holdings Inc. to assist with the investigation and response.
Columbia said it regretted the concern the incident caused and considered its actions and the settlement's commitments reflective of how seriously it is treating the matter, per the Spectator's account.
