Columbia University
Disclosed Aug 7, 20251 year ago3,067,242 affectedConfirmed
Hacker steals data of 868,969 Columbia students, applicants and staff
Columbia University told Maine's attorney general that a hacker who breached its network in May 2025, discovered after a June 24 outage, stole data on 868,969 people including names, birth dates, SSNs, contact details, academic history and financial aid and health information.
What is known
| People affected | 3,067,242 (as reported by the organization) |
|---|---|
| Disclosed | Aug 7, 2025 |
| Discovered | Jul 8, 2025 |
| Happened | May 16, 2025 |
| Attack | Hacking |
| Data exposed | Names, Health, Insurance, Credentials and tokens, Dates of birth, Social Security numbers, Addresses, Phone numbers, Education records, Financial, Other, Government IDs, Payment cards |
| Sector | Education · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Columbia Universityoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: Columbia Universityatg.wa.gov · Official notice | Official notice |
| Notice letter filed with the Delaware DOJ: Columbia Universityattorneygeneral.delaware.gov · Official notice | Official notice |
| Oregon DOJ breach notice: Columbia Universityjustice.oregon.gov · Official notice | Official notice |
| Columbia University data breach impacts nearly 870,000 individualsbleepingcomputer.com · News | News |
| Texas Attorney General data security breach report BR-0005050: Columbia Universityoag.my.site.com · Official notice | Official notice |
| Vermont Attorney General: 2025-08-07 Columbia University Data Breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
| Indiana Attorney General 2025 data breach report: Columbia Universityin.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| California AGresidents of CA | Aug 7, 2025 | |
| Washington AGresidents of WA | Aug 7, 2025 | 54,075 |
| Delaware DOJresidents of DE | Aug 7, 2025 | 1,818 |
| Oregon DOJresidents of OR | Aug 7, 2025 | 868,969 |
| Researchtotal | Aug 7, 2025 | 868,969 |
| Vermont AGresidents of VT | Aug 7, 2025 | |
| Indiana AGresidents of IN | Aug 7, 2025 | 4,078 |
| Texas AGresidents of TX | May 20 | 161,544 |
History of this record
- 2026-09-25 · source: empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-Year-to-Date-Report-2025.pdf · backfill source
- 2026-09-25 · source: empty to https://ago.vermont.gov/document/2025-08-07-columbia-university-data-breach-notice-consumers · backfill source
- 2026-09-25 · data_types: ["names","health","insurance","credentials","dob","ssn","addresses","phone","education","financial","other"] to ["names","health","insurance","credentials","dob","ssn","addresses","phone","education","financial","other","government-id","payment-card"] · backfill source
- 2026-09-25 · records: 868969 to 3067242 · backfill source
- 2026-09-25 · data_types: ["names","health","insurance","credentials"] to ["names","health","insurance","credentials","dob","ssn","addresses","phone","education","financial","other"] · seed source
- 2026-09-25 · summary: empty to Columbia University told Maine's attorney general that a hacker who breached its network in May 2025, discovered after a June 24 outage, stole data on 868,969 people including names, birth dates, SSNs, contact details, academic history and · seed source
- 2026-09-25 · title: empty to Hacker steals data of 868,969 Columbia students, applicants and staff · seed source
- 2026-09-25 · data_types: [] to ["names","health","insurance","credentials"] · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 868969 · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · discovered: empty to 2025-07-08 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.