Columbia University cyberattack and data theft

Analyst assessment

An unauthorized party stole information from Columbia University and caused an IT outage that began June 24, 2025. Our initial reporting documented the loss of access to campus services. Columbia confirmed the cyberattack July 1, after initially describing a technical outage. Its later breach notice places unauthorized network access on or about May 16, distinguishing the intrusion from the disruptive outage more than a month later.

Operational significance

The outage interrupted the UNI authentication service and access to LionMail email and CourseWorks learning materials at the Morningside campus in New York City. Campus reporting documented instructions to remain logged in and bring summer-class materials on USB drives. Some cloud access returned during the first day, while other services remained unavailable. This was a disruption of instruction and administration; the evidence does not establish cancellation of all classes.

Columbia’s IT office told the campus in a June 30 email that all systems were operational as of June 29, according to the Spectator’s recovery report. The university also confirmed restored operations in its July 1 statement. Operational disruption is resolved, with June 29 as the restoration milestone. Columbia said clinical operations at its Irving Medical Center were unaffected.

The August 5 update confirmed theft of information connected to admissions, enrollment and financial aid, along with some employee information. Affected categories included Social Security numbers, contact information, academic history and certain health information supplied to the university. Columbia said it had found no indication that Irving Medical Center patient records were affected; that narrower finding does not mean no health-related information was stolen.

Confidence and uncertainty

Confidence in the cyberattack and operational effects is high because official findings support both. The early attribution was less certain: Columbia discredited an unnamed group’s online claim, and officials could not definitively connect unauthorized images on campus screens to the outage. Reports about a separate 2024 claim do not establish responsibility for this event.

In its October 23, 2026 update, Columbia said its investigation identified a hacker whose stated motive was political. It reported no evidence of a financial motive or of dark-web sale or distribution of the data. This supports a qualified political-motive assessment, without identifying a named actor or establishing ransomware, encryption or an extortion demand.

Analytic gaps

The precise entry method, detailed forensic findings and independently reconciled total number of affected people remain unverified. May 16 is approximate, as stated in the breach notice. The last specific contemporaneous report of continuing IT effects reviewed here is June 25; it is distinct from the June 29 restoration milestone. Bloomberg’s accessible June 24 report cited a law-enforcement official describing an access-control attack before Columbia’s own causal confirmation.

Columbia said notifications were complete by June 3, 2026, including notifications to some people whose information it believed had come through historical student recruitment services. The October update reported preliminary approval of a class action settlement. Those later remediation and litigation developments do not establish renewed operational disruption or a final judicial finding.