The Columbia data breach class action settlement is a $600,000 agreement resolving claims that Columbia University Health Care, Inc. exposed the medical information of about 29,629 patients between September 11, 2023 and March 7, 2024. A New York court gave the deal final approval on December 5, 2025, and payments went out on February 27, 2026. A separate, much larger 2025 cyberattack on Columbia University itself is the subject of different lawsuits that are still pending, with no settlement.
Who the Settlement Covered
The class consisted of roughly 29,629 current and former patients of Columbia University Health Care, Inc., a subsidiary affiliated with the Columbia University Irving Medical Center.1HIPAA Journal. Columbia University Health Care Data Breach Settlement The exposure happened because a workforce member inadvertently placed a file on a third-party, internet-accessible platform.2Columbia Daily Spectator. CUIMC Pays $600K in Data Breach Lawsuit Settlement
The exposed information was limited: names, medical record numbers, dates of birth, provider names, and a single laboratory test result per patient.1HIPAA Journal. Columbia University Health Care Data Breach Settlement Columbia University Irving Medical Center said the file did not contain Social Security numbers, financial information, phone numbers, or email addresses. Columbia University Health Care denied any wrongdoing or liability.2Columbia Daily Spectator. CUIMC Pays $600K in Data Breach Lawsuit Settlement
What Class Members Received
Class members who filed a valid claim by the November 25, 2025 deadline were eligible for three benefits.
- A two-year subscription to CyEx Medical Shield Complete, covering credit monitoring, dark web monitoring, and surveillance of medical records, health savings accounts, and Medicare beneficiary status.3Columbia Healthcare Data Breach Settlement. Nemeth v. Columbia University Health Care Inc. Settlement FAQ
- Reimbursement of up to $10,000 per person for documented out-of-pocket losses traceable to the breach, such as bank fees, postage, credit report costs, and travel expenses incurred between December 21, 2023 and November 25, 2025.3Columbia Healthcare Data Breach Settlement. Nemeth v. Columbia University Health Care Inc. Settlement FAQ
- A pro rata cash payment from whatever remained in the fund after fees, costs, service awards, and documented-loss claims were paid.4Columbia Healthcare Data Breach Settlement. Nemeth v. Columbia University Health Care Inc. Settlement Agreement
Columbia University Health Care also agreed to implement new information security measures.5ClassAction.org. $600K Columbia University Health Care Settlement Ends Class Action Lawsuit Over Data Breach Out of the fund, the court approved $200,000 in attorneys’ fees and $13,989.43 in litigation costs, and each of the two class representatives received a $2,500 service award.3Columbia Healthcare Data Breach Settlement. Nemeth v. Columbia University Health Care Inc. Settlement FAQ
Where the Settlement Stands Now
Justice Arthur F. Engoron of the New York Supreme Court, New York County, held the final fairness hearing on December 5, 2025 and granted final approval that day.1HIPAA Journal. Columbia University Health Care Data Breach Settlement6Columbia Healthcare Data Breach Settlement. Nemeth v. Columbia University Health Care Inc. Settlement Home The settlement administrator, Epiq Global, distributed payments by check and digital payment on February 27, 2026. Digital payments that failed were expected to be reissued as paper checks by May 2026.3Columbia Healthcare Data Breach Settlement. Nemeth v. Columbia University Health Care Inc. Settlement FAQ
The claims deadline has passed. Patients who did not file by November 25, 2025 cannot submit a late claim under this settlement.
The Larger 2025 Columbia University Breach Is a Different Matter
Many people searching for a Columbia breach settlement are actually thinking of the much bigger 2025 incident, which is a separate event with separate litigation and no settlement.
Columbia University disclosed a network intrusion that caused a campus-wide IT outage on or around June 24, 2025; investigators later determined the intruder first accessed the network around May 16, 2025.7Columbia University IT. Columbia University Cyber Incident A filing with the Maine Attorney General’s Office put the number of affected individuals at 868,969, including students, applicants, and some employees.8SecurityWeek. Columbia University Data Breach Impacts 860,000
The data compromised in 2025 was far more sensitive than the health care file. It included Social Security numbers, contact details, demographic information, academic history, financial aid records, insurance information, and certain health information.9Columbia University IT. Updating Our Community on the Cyber Incident The university said patient records from the Columbia University Irving Medical Center were not obtained.8SecurityWeek. Columbia University Data Breach Impacts 860,000
Notification letters went out beginning in August 2025, with a second rolling round starting December 30, 2025 as more affected individuals were identified. Columbia offered affected people two years of complimentary credit monitoring and identity restoration services through Kroll. As of mid-2026, the university said there was no evidence the stolen data had been used for identity theft or fraud.10Columbia University. Updating Our Community on the 2025 Cyber Incident
The 2025 Federal Lawsuits Are Still Open
Ten class actions were filed over the 2025 breach in the U.S. District Court for the Southern District of New York, starting with Quintero v. Trustees of Columbia University on July 3, 2025. On December 11, 2025, Judge P. Kevin Castel consolidated all ten under a single docket, In re Columbia University Data Breach Litigation, Case No. 1:25-cv-05541.11CourtListener. In re Columbia University Data Breach Litigation
A consolidated complaint was due by January 26, 2026 and Columbia’s response by February 27, 2026. The case remained active as of June 2026, with the most recent docket entry dated May 13, 2026, and no settlement or ruling on the merits reported.11CourtListener. In re Columbia University Data Breach Litigation Anyone who received a 2025 notification letter from Columbia should watch that docket, not the health care settlement, for any future recovery.