Columbia University Cyberattack Compromises Data of About 870,000 People
University says personal, financial and health-related information tied to students, applicants and employees was accessed after a June network outage; notifications began Aug. 7
Columbia University confirmed a cyberattack that compromised personal, financial and health-related information tied to roughly 870,000 people, the school said, and has begun notifying those affected.
The university said the victims include current and former students, employees and applicants. Notifications to affected individuals began Aug. 7 and are being issued on a rolling basis. Columbia discovered the incident after a network outage in June that investigators attribute to an unauthorized party accessing university systems and stealing sensitive data. Investigators are still assessing the full scope of the theft.
Columbia, one of the oldest Ivy League institutions, said it moved quickly to contain the incident after detecting anomalous activity associated with the outage. The university did not provide a full inventory of the specific data elements taken, but described the information as personal, financial and health-related and tied to people across multiple roles and time periods.
The breach follows a pattern of high-profile incidents across sectors in recent months that have exposed large volumes of personal and consumer data. Some breaches have been linked to vulnerabilities in widely used enterprise services and cloud-based customer relationship management platforms, leading security experts to warn organizations to review third-party integrations and logging practices. Columbia did not immediately link the incident to any particular external vendor or service.
University officials said they have engaged cybersecurity experts and law enforcement to investigate the attack and are working to determine when the unauthorized access began and precisely which records were taken. The university also reported efforts to restore and stabilize impacted systems after the June outage and to strengthen protections against further unauthorized access.
Affected people are being contacted directly by Columbia with details about the nature of the information involved and next steps. The school encouraged those who receive notices to follow the instructions provided and to remain vigilant for signs of identity theft or fraud. Columbia did not say whether it would offer services such as credit monitoring or identity restoration to affected individuals.
Colleges and universities have been frequent targets of cyberattacks because of the volume and variety of personal, research and financial data they maintain and because many institutions rely on interconnected administrative and learning systems. The consequences of such breaches can extend to long-term risks for individuals whose sensitive information was exposed and to operational disruptions at affected institutions.
Columbia said it will provide additional information as its review proceeds and is cooperating with law enforcement. The notifications that began on Aug. 7 will continue until the university completes outreach to all individuals it identifies as affected.