Columbia University data breach: applicant and student files taken, 868,969 people

What happened at Columbia University?

The letter says a technical outage disrupted some of the university's IT systems on June 24, 2025. The investigation that followed found the intruder had been in the network since about May 16. Columbia says it has no evidence that patient records at Columbia University Irving Medical Center were affected. It reported the incident to law enforcement.

In its December update, the university said it told its community on July 2, 2025 that an unauthorized party had accessed the network, stolen data and disrupted systems.

Date	What happened	Source
On or about May 16, 2025	Unauthorized access to the network begins	Columbia letter; Oregon list
June 24, 2025	Technical outage disrupts IT systems	Columbia letter; Oregon list
July 2, 2025	Columbia tells its community of the theft	Columbia update
July 8, 2025	Discovery date on Oregon's record	Oregon list
August 7, 2025	First letters, including 2,340 to New Hampshire residents	NH filing; Oregon list
December 30, 2025	Letters to additional people identified later begin	Columbia update

Whose data was in the Columbia breach?

People who applied to Columbia, and those who went on to study there. The letter says the files held each person's name, date of birth and Social Security number, plus what they gave in their application or what the university collected while they studied. That means contact details, demographic information, academic history, financial aid information, and any insurance and health information people shared. The school and education breach notices guide compares how other institutions describe incidents like this.

Why did I get a second Columbia letter, or one only in 2026?

Columbia says that as its investigation went on it identified more affected people, and that letters to them would start on December 30, 2025 and continue on a rolling basis. Oregon's 868,969 is the count it recorded with the August 2025 letters; the later round may add to it.

Is the 868,969 count from more than one record?

Yes, three. Indiana's 2025 breach report records 868,969 people in total and 4,078 Indiana residents, with notice on August 7, 2025 and a breach date of May 16, 2025. Indiana's total is the fifteenth-largest in its 2025 report, the place Columbia holds in the largest data breaches of 2025. Oregon's list records 868,969. BleepingComputer reported the same figure from the letters Columbia filed with Maine's attorney general on August 7, 2025. Those letters say the people affected include employees, applicants, current and former students, and family members. The same report quoted the letter as saying Columbia had no evidence that any Columbia University Irving Medical Center patient records were affected.

Texas's attorney general lists a report from Columbia University, posted on May 20, 2026, with 161,544 Texans affected. The Texas record lists names, addresses, Social Security numbers, driver's license numbers, other government ID numbers, financial account or card numbers, health insurance information, other information and dates of birth among the information involved. Of the 607 reports Texas posted in 2026 up to November 10, it is the 30th largest by Texans affected; the Texas ranking has the largest. The figure counts Texans only.

Did a hacker claim the Columbia breach?

Columbia has not named anyone. BleepingComputer, citing Bloomberg's reporting, wrote that the alleged hacker claimed to have stolen 460 gigabytes of data from the university's systems. That figure is the hacker's claim. Columbia's letters describe the data as application and enrollment records: contact details, demographic information, academic history, financial aid information, and any insurance or health information people shared.

What is Columbia offering?

Two years of Kroll credit monitoring and identity restoration at no cost, activated at enroll.krollmonitoring.com with the membership number in the letter. The call center is (866) 819-7006, Monday to Friday, 9:00 a.m. to 6:30 p.m. Eastern Time, excluding major U.S. holidays. The guide to credit monitoring offers explains what a free credit freeze adds.

How many Washingtonians were affected by the Columbia University breach?

Washington's attorney general lists a notice from Columbia University, reported on August 7, 2025, with a breach date of May 16, 2025 and 54,075 Washingtonians affected. The record lists names, Social Security numbers, driver's license or state ID numbers, financial and banking information, full dates of birth, student ID numbers, health insurance policy or ID numbers, medical information and other information as the information compromised. The figure counts Washington residents only.

What the record leaves open

• How the intruder got into the network on May 16, 2025.
• Whether the June 24 outage was caused by the intruder; the letter calls it a technical outage.
• How many people the December 2025 letters added to Oregon's count.