HackingStolen CredentialsCapture Stored DataData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTHEALTH_BASICHighContained
Columbia University
bd_0c96ffec9a2ab117 · schema v1 · pii pii-v1
Full breach record for Columbia University →Columbia University filed a supplemental notice with the New Hampshire Attorney General regarding a cybersecurity incident initially reported on August 7, 2025. Unauthorized access occurred on or about May 16, 2025, resulting in the exfiltration of names, dates of birth, Social Security numbers, and financial/health information. The incident affected 11,111 New Hampshire residents. Columbia University provided 24 months of credit monitoring through Kroll and established a call center.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed11,111 affectedView incident
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/columbia-university-20260507.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- May 7, 2026
- Raw hash
- 4db78fcb5c05dcf34ef1b25485c103dcc25372bbf6020c0a406d6044f64ad2f9
Reporting entity
- Name
- Columbia Universitynorm: columbia university
Victim entity
- Name
- Columbia Universitynorm: columbia university
Incident
- Discovered
- May 16, 2025
- Materiality determined
- —
- Notification sent
- Aug 7, 2025
- Affected individuals
- 11,111
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTHEALTH_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
- Threat actor
- External
- Regulator citations
- notified your office on August 7, 2025
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 51 weeks(356 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.