Columbia Knows Your Social Security Number. Who Else Does?
By Tanya Reddy Sattineni
By Sheridan Smith for The Morningside Post
When Columbia acknowledged in August 2025 that almost 870,000 people had been affected by a data breach, the University wasn’t describing strangers; it was describing us.
This staggering figure included current and former students, applicants, employees, and family members. The stolen data included names, dates of birth, and Social Security numbers, along with anything provided in applications or collected during a student’s time at Columbia. Financial aid, insurance, and health-related information had been compromised as well.
Columbia says an unauthorized party got into its network around May 16, 2025, a date investigators established only after the fact. The University began investigating after a service interruption on June 24, which means someone could have moved through its systems unnoticed for roughly five weeks.
A University official described the perpetrator as a politically motivated “hacktivist.” In its public statements, Columbia said it had implemented safeguards to enhance security but did not specify what they were.
The 2025 breach is the largest incident that Columbia has faced, but it isn’t the only one.
More recently, Columbia learned in May of this year that CourseWorks may have been affected by a breach experienced by its vendor Instructure, which serves thousands of institutions. Columbia said CourseWorks holds no dates of birth, Social Security numbers, or financial information, and that all users must use multi-factor authentication (MFA). MFA makes it harder for attackers to take over individual accounts, but it does not protect data held on a vendor’s servers.
In 2017, Columbia’s Admissions Office told 277 Mailman School applicants they had been accepted, then rescinded the offers within an hour, blaming human error. That wasn’t an attack, but it shows how a single list or database mistake can reach hundreds of people.
And this September, the University warned of fake “Remote Research Opportunity” flyers that were using faculty names to persuade recipients to text a non-Columbia number. If successful, this scam could result in identity theft, stolen login credentials, or check fraud.
Together, these show three different kinds of risk: Attackers breaking in, errors occurring from inside, and third-party vendors holding Columbia’s data.
I sent CUIT, Columbia’s central IT department and service provider, a set of questions about the 2025 breach and have not received a response by publication.
The questions that I asked, and that I believe we should all be asking, are as follows:
What categories of student and applicant data does Columbia hold?
Are Social Security numbers kept for applicants who never enrolled, and for how long?
Has the retention policy changed since 2025?
Why did detection take five weeks, and what has changed in monitoring?
Which post-breach safeguards, such as network segmentation, logging, or encryption of stored identifiers, can Columbia describe publicly?
Students whose data was taken or compromised are owed answers to each of these. CUIT did not respond to the service ticket I submitted in search of those answers.
Retention matters because breach exposure grows alongside the amount of data an institution keeps and how long it keeps it. Every record held past its usefulness is one more an attacker can steal. Applicants who were never admitted were among those affected, and Columbia is offering only two years of credit monitoring against data that never expires, since a Social Security number can’t be reissued.
Columbia’s breaches have demonstrated that we can’t always trust institutions to protect our data, and that we must sometimes take matters into our own hands. If you want to stay protected, the first step is to find out whether you’ve been affected. Check whether you received a breach notification letter from the University, and if you did, use the monitoring offer.
Beyond that, start by freezing your credit at Equifax, Experian, and TransUnion. It’s free, only takes a few minutes, and stops most new-account fraud. You can also lift it temporarily when you need credit. Another option is to get an IRS Identity Protection PIN to block fraudulent tax filings under your number.
Another way to stay protected is to treat unsolicited job offers as suspect. Official Columbia postings appear only on approved Columbia career portals, and no legitimate employer asks you to text a personal number first (if only it were that easy).
Beyond being wary of rather easy job offers, you should also secure your accounts with MFA, which is worth enabling on your Columbia account, email, and bank account. An authenticator app or security key is preferable to SMS, since text messages can be intercepted through SIM swapping.
It’s equally important to never reuse passwords across accounts, because a single breach can expose all of them.
Finally, report any suspicious messages through CUIT’s reporting channels so others are warned.
These mitigating measures don’t change the fact that Columbia hasn’t publicly explained how the intruder got in, why detection took so long, or what exactly it changed.
For a university that asks students for their most sensitive information before they’ve even enrolled, the standard should be clear: collect as little data as possible, keep it for as little time as possible, and tell people plainly when something goes wrong.