On July 2, 2025, we informed the Columbia University community that an unauthorized party had accessed our network, stolen data, and disrupted our systems. Our team acted swiftly to restore operations, initiated a comprehensive investigation with leading cybersecurity experts, and notified law enforcement.
In August 2025, the University began notifying, via U.S. Postal Service mail, affected individuals whose personal information was affected by the cyber incident while our investigation of other potentially affected data was ongoing. As our investigation has continued, we have identified additional individuals affected by this event. Notifications to these individuals will begin on December 30, 2025, and continue on a rolling basis.
While there is no evidence of identity theft or fraud, the University continues to offer all affected individuals two years of complimentary credit monitoring and identity restoration services through Kroll, and has implemented enhanced security measures to help prevent future incidents.
For additional information and answers to the most commonly asked questions, please visit our FAQ page. We also invite you to view our August community message here. Additionally, a dedicated call center remains available at (866) 819-7006, Monday through Friday, 9:00 a.m. to 6:30 p.m. Eastern Time, excluding major U.S. holidays, to answer questions.
Thank you for your continued understanding and support.
