Columbia University Breach (2025): 346K Records Including SSN Exposed by Politically Motivated Hacktivist

About Columbia University

Columbia University in the City of New York is a private Ivy League research university founded in 1754 (originally as King's College) and headquartered at the Morningside Heights campus in Manhattan with additional campuses including the Manhattanville campus, the medical center campus at Washington Heights, and a Syracuse, New York data center. Columbia enrolls more than 36,000 students across its undergraduate program, graduate schools, and professional schools including the Columbia Business School, the College of Physicians and Surgeons, the Mailman School of Public Health, the Columbia Law School, the Columbia Journalism School, and the Columbia Engineering school. As a major research university with extensive academic, administrative, healthcare, and alumni operations, Columbia maintains identity, contact, academic, financial, employment, applicant, alumni, and research-related records across multiple enterprise systems including its Student Information System (SIS), Active Directory authentication infrastructure, and VMware-based virtualization platforms across Manhattan and Syracuse data centers.

Why They Hold Your Data

Universities collect identity, contact, academic, financial, employment, applicant, alumni, and research-related records across education, healthcare, and administrative systems.

Recent Developments

Columbia disclosed the breach on July 1, 2025 after initially characterizing the June 24, 2025 incident as a 'technical outage' or 'IT outage.' On July 2, 2025, a Columbia official publicly stated that the attack was perpetrated by a 'highly sophisticated' hacktivist with a 'political agenda' who broke in and stole 'targeted' student data. Columbia engaged a top cyber-forensics firm and reported no detected intrusions since June 24, 2025. The hacker subsequently provided tranches of the stolen data to Bloomberg News and The New York Times, both of which ran stories based on the stolen data including the Bloomberg report indicating that the dataset includes approximately 2.5 million admission applications dating to the late 1990s. State attorney general filings in California and Texas on August 7-8, 2025 disclosed approximately 345,746 affected individuals (with The Record citing 900,000 affected individuals based on a separate Columbia disclosure). The case sits within Columbia's broader political conflict with the Trump administration including a $400 million federal research funding freeze that the administration imposed citing concerns about Columbia's handling of pro-Palestine protests on campus and diversity programs.

Data Points Exposed

Breach Impact

The institutional impact on Columbia has been substantial and continues to evolve. Columbia incurred costs associated with extended IT system recovery (with the breach causing a multi-day outage of UNI logins, LionMail, and the CourseWorks learning platform), forensic investigation, multi-state regulatory filings, and individualized victim notification. The breach occurred during an exceptionally complicated political period for Columbia given the parallel federal funding freeze and ongoing public scrutiny of Columbia's admissions practices, with the hacker's politically-motivated decision to release data showing alleged continued race-conscious admissions adding additional pressure to Columbia's federal research grant negotiations. The Bloomberg and New York Times coverage based on the stolen data created significant additional reputational and regulatory exposure beyond the direct breach impact. The case has been broadly cited as among the most significant U.S. higher education cyberattacks of 2025 and as illustrating both the increased political-motivation profile of contemporary U.S. hacktivism and the strategic value of higher education admissions data for political messaging. Class-action and state regulatory exposure remains active.

Exploitation & Downstream Threats

• Identity theft and synthetic identity construction using government-issued IDs | • Identity verification bypass using name + date of birth combination | • SIM swap attacks where phone numbers are present | • Targeted phishing campaigns using exposed email addresses

What You Should Do

1. Freeze credit at all three bureaus and monitor for new-account and tax-refund fraud.
2. Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
3. Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.

How ObscureIQ Can Help

1. Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
2. Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
3. ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).