Columbia University

Columbia University based in New York, New York, a educational institution entity reported a data breach to the Texas Attorney General. The breach was discovered on 2025-07-08 and reported on 2026-05-20. 161,544 Texas residents were affected. 3,067,242 individuals affected in total. Types of information involved: Name of individual;Address;Social Security Number Information;Driver’s License number;Government-issued ID number (e.g. passport, state ID card);Financial Information (e.g. account number, credit or debit card number);Health Insurance Information;Other;Date of Birth. Consumers were notified via U.S. Mail.

Columbia University notified the NH Attorney General that an unauthorized third party gained access to its network on or about May 16, 2025, and exfiltrated files. The incident was discovered on June 24, 2025, following a technical outage. Affected data includes names, dates of birth, Social Security numbers, contact details, demographic information, academic history, financial aid information, and health information. 11,111 New Hampshire residents were affected. The university engaged external cybersecurity experts, reported to law enforcement, implemented security safeguards, and offered two years of credit monitoring and identity restoration services through Kroll.

Columbia University notified the Rhode Island Attorney General of a cybersecurity incident where an unauthorized third party accessed the network via a publicly-exposed system starting May 16, 2025. The breach affected approximately 2,524 Rhode Island residents, exposing names, SSNs, dates of birth, and financial/academic data. Columbia notified law enforcement, blocked access, reset passwords, and offered 24 months of credit monitoring.

Columbia University notified the NH Attorney General of a cyber incident where an unauthorized third party accessed the network around May 16, 2025, and exfiltrated personal data including names, DOBs, and SSNs. The breach was detected on June 24, 2025. 2,340 New Hampshire residents were notified on August 7, 2025, and offered 24 months of credit monitoring.

Columbia University notified the Iowa Attorney General of a cybersecurity incident where an unauthorized third party accessed the network via a publicly-exposed system on or about May 16, 2025. The breach affected approximately 1,572 Iowa residents, exposing names, SSNs, dates of birth, and financial/academic data. Columbia notified law enforcement, blocked access, reset passwords, and offered 24 months of credit monitoring.

Columbia University reported an external system breach (hacking) occurring between May 16 and June 24, 2025. The incident affected approximately 868,969 individuals nationwide, including 2,026 Maine residents. Compromised data included names, dates of birth, Social Security numbers, and academic/financial/health information. Columbia engaged external cybersecurity experts, reported to law enforcement, and is providing 24 months of credit monitoring and identity protection services through Kroll.

Columbia University reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2025-08-07. 28,138 Massachusetts residents were affected.

Columbia University filed a supplemental notice with the Washington AG regarding a cyber incident affecting 54,075 state residents. Unauthorized access occurred May 16, 2025, and was detected June 24, 2025. Data included names, DOBs, SSNs, and academic/financial records. Columbia engaged forensic experts, notified law enforcement, and provided 24 months of credit monitoring.

Columbia University reported a data breach to the Indiana Attorney General. The breach occurred on 2025-05-16 and was reported on 2025-08-07. 4,078 Indiana residents were affected. 868,969 individuals affected in total.

Columbia University notified Nebraska AG of a cyber incident discovered on May 16, 2025, where an unauthorized third party accessed the network and exfiltrated files containing names, DOBs, SSNs, and financial/health data. Columbia offered two years of credit monitoring via Kroll. The incident is contained.

Columbia University experienced a cyber incident where an unauthorized third party gained access to its network on or about May 16, 2025, and exfiltrated files. The university discovered the incident on June 24, 2025, following a technical outage. Affected data includes names, dates of birth, Social Security numbers, contact details, demographic information, academic history, financial aid information, and health information. The university engaged external cybersecurity experts, reported to law enforcement, implemented security safeguards, and is offering two years of credit monitoring and identity restoration services through Kroll.

Columbia University notified affected individuals of a cyber incident where an unauthorized third party accessed the network around May 16, 2025, and exfiltrated files. The breach impacted names, DOBs, SSNs, academic, financial aid, and health information. Columbia activated its response plan, engaged external experts, and reported to law enforcement. Two years of credit monitoring via Kroll is offered. No patient records were affected.

Columbia University disclosed a cyber incident where an unauthorized third party accessed its network on or about May 16, 2025, and exfiltrated files. The breach affected names, dates of birth, Social Security numbers, and academic/financial data. The university reported the incident to law enforcement and offered two years of credit monitoring. Approximately 2,510 Rhode Island residents were identified as impacted.

Columbia University experienced unauthorized access to its network starting May 16, 2025, discovered on June 24, 2025. An external actor exfiltrated files containing names, SSNs, DOBs, academic history, and some health/financial aid data. Patient records were not affected. The university engaged forensic experts, notified law enforcement, and is offering credit monitoring.

Columbia University notified South Carolina residents of a cyber incident where an unauthorized third party accessed the network on or about May 16, 2025, and exfiltrated files. Data included names, DOBs, SSNs, and academic/financial/health info. No patient records were affected. Columbia reported to law enforcement, engaged external experts, and offers 2 years of credit monitoring via Kroll.

Columbia University reported a data breach to the Oregon Attorney General. The breach was reported on 2025-08-07. The breach occurred during 5/16/2025 - 6/24/2025. The breach was discovered on 7/8/2025. 868,969 individuals were affected. Notice was sent on 8/7/2025.

COLUMBIA UNIVERSITY filed a data-breach notice with the Illinois Attorney General in August 2025 (case 25-08-353). The register records the breach as discovered on July 8, 2025. Personal information types reported: drivers license, financial account number, medical information, ssn. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

Columbia University reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2017-09-08. 4 Massachusetts residents were affected. The report records the breach type as electronic.

Columbia University reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2012-12-20. 3 Massachusetts residents were affected. The report records the breach type as electronic.

Columbia University reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2012-04-27. 56 Massachusetts residents were affected. The report records the breach type as electronic.

Columbia University notified the NH AG of an inadvertent data exposure on April 23, 2012. A test file containing PII (names, SSNs, bank account numbers) of ~3,500 individuals was placed on a web server in Jan 2010. It was indexed by Google on March 10, 2012, and discovered by the University on April 16, 2012. 4 NH residents were affected. The file was removed, and 2 years of credit monitoring was offered.

Columbia University reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2011-04-26. 2 Massachusetts residents were affected. The report records the breach type as electronic.

Columbia University reported the theft of three password-protected laptops from an administrative office on January 18, 2010. The devices contained names and Social Security numbers of students, alumni, and employees. One New Hampshire resident was affected. The university notified affected individuals on January 29, 2010, and offered two years of complimentary credit monitoring.

Columbia University reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2010-02-01. 11 Massachusetts residents were affected. The report records the breach type as electronic.