Columbia University is grappling with the fallout of a major cyberattack that compromised sensitive financial and academic information of students and alumni, according to documents reviewed by Bloomberg News. The data breach, which has not been fully disclosed until now, affects both current and former students, some dating back to the 1990s.
The stolen data includes highly personal information such as bank account and routing numbers, student loan and scholarship records, standardised test scores, GPAs, class schedules, home addresses, and other contact details. Bloomberg reviewed a 53.6-gigabyte cache of the stolen files and verified its accuracy with nine individuals whose records appeared in the breach.
This breach comes at a time when Columbia is already under public scrutiny following a series of high-profile controversies, including a $200 million federal settlement over civil rights violations and campus tensions over protests related to the Israel-Gaza conflict.
What was stolen?
The exposed information spans decades and includes admissions decisions, enrollment records, financial aid disbursements, insurance and health-related data, and Social Security numbers. In its official statement, Columbia confirmed that personal information for some employees was also included in the breach.
The university began notifying affected individuals on Thursday and is offering two years of free credit monitoring, fraud consultation, and identity theft protection through an outside vendor.
How the breach unfolded
The university began investigating the breach in June after experiencing an IT system outage. A Columbia official said the attacker was believed to be a “hacktivist” — a politically motivated actor rather than a financially driven criminal. That distinction has raised further concerns about the intent behind the attack and its potential for long-term harm.
In a previous report last month, Bloomberg noted that 1.6 gigabytes of admissions-related data, including acceptance and rejection letters, had been leaked. The latest 53.6-gigabyte cache was shared by Jordan Lasker, a blogger known for promoting controversial views on race and intelligence. Lasker claimed he obtained the files from the same hacker who had released the earlier batch.
The hacker, communicating via X (formerly Twitter), confirmed they had given the data to Lasker but declined to reveal their identity due to fear of self-incrimination. The X account is associated with racist content and has not been independently confirmed as the original source of the breach.
Columbia’s response
In a statement published on its website, Columbia acknowledged that an “unauthorised party” had accessed extensive student and applicant data. The university said it is still investigating the scope of the breach and has advised all students, faculty, and staff to stay alert for scams and monitor their financial accounts closely.
Officials emphasized that only a subset of the data has been verified, and the full extent of the breach is still being assessed. Still, early signs suggest that the scale of the compromise is significant.
Broader implications
The breach has left many members of the university community shaken, especially because the information stretches across multiple generations of students. Cybersecurity experts warn that even if the data isn’t exploited immediately, it could be used in the future for identity theft, phishing, and harassment.
Rachel Tobac, CEO of SocialProof Security, said the situation is serious regardless of the attacker’s motive. “Anytime an individual is involved in a data breach, there is cause for concern. It’s important to freeze your credit and be on the lookout for tailored phishing lures across all contact methods,” she told Bloomberg.
This incident adds to Columbia’s growing list of challenges. Just last month, the university finalized a settlement with the Trump administration over allegations that it discriminated based on race and national origin. As part of the agreement, Columbia will pay $200 million in penalties over three years and implement reforms to enhance campus safety and international student oversight.
A crisis of trust
With trust in institutions already strained, particularly in higher education, the data breach raises serious questions about Columbia’s internal controls and cybersecurity infrastructure. The incident is also a reminder that universities, with their vast stores of personal and financial data, remain prime targets for cyberattacks.
The breach comes amid increasing scrutiny of university data policies and mounting concerns about how institutions protect sensitive information in an era of escalating political and technological volatility.
As of now, the attacker’s full motives and any potential collaborators remain unclear. What is certain, however, is that Colombia’s attempt to regain stability following months of reputational damage has just become significantly more complicated.
