Columbia University is under investigation following a data breach that compromised personal data of 869,000 individuals, raising concerns over cybersecurity and privacy violations.
 |
| Columbia University faces legal action over a data breach compromising personal information of over 869,000 people, with delayed notifications raising concerns over privacy laws. Image: CH |
San Francisco, USA — August 9, 2025:
Columbia University is facing an investigation following a massive data breach that exposed the personal information of 868,969 students, applicants, and employees. The breach, which occurred in mid-May 2025, has sparked legal concerns over Columbia’s delayed notification to affected individuals.
On June 24, 2025, the university detected suspicious activity within its IT systems, triggering a daylong outage. However, it wasn’t until July 2, 2025, that the university publicly acknowledged the breach, and it was not until August 7, 2025, that notifications were sent to those impacted. Legal experts have raised alarms, suggesting that the university may have violated state and federal notification laws by failing to promptly inform affected individuals.
The breach occurred on or around May 16, 2025, when an unauthorized actor gained access to the university’s network. The compromised data includes sensitive personal information such as contact details, demographic data, academic records, financial aid and insurance-related information, and health records. Columbia University’s failure to identify and notify affected individuals in a timely manner could expose it to potential lawsuits and regulatory penalties.
In response to the breach, Schubert Jonckheer & Kolbe LLP, a law firm based in San Francisco, has launched an investigation on behalf of those affected. The firm is urging individuals whose personal information was compromised to contact them for more information about their legal rights, including potential claims for identity theft, privacy violations, and compensation for damages.
Schubert Jonckheer & Kolbe LLP, known for handling class action lawsuits and derivative actions, is seeking to hold Columbia University accountable for its cybersecurity failures and the delayed response to the breach. The firm also emphasizes the importance of strengthening cybersecurity measures to prevent similar incidents in the future.
The breach has raised serious concerns about the university’s data protection practices and the broader implications for higher education institutions in safeguarding personal information. With the growing number of cybersecurity incidents in the education sector, experts are calling for improved protocols and faster response times to better protect students and employees from data theft and privacy violations.
As the investigation into Columbia University's breach continues, the university is facing increased scrutiny from regulators, affected individuals, and privacy advocates.