# Columbia University: data breach notice filed with the Delaware Attorney General (2025-08-07)

**Score:** 25/100

| Field | Value |
|---|---|
| Organization | Columbia University |
| Attorney General notified | DE |
| Notice date | 2025-08-07 |
| Breach dates | 2025-05-16 |
| State residents affected | 1,818 |
| Total affected (all states) | 868,969 |
| Data exposed | Social Security number, Individual taxpayer ID number, Medical treatment by a healthcare professional, Health insurance policy number, subscriber ID number, or any other unique identifier used by health insurer to identify person, Account number, credit card account number, or debit card number, in combination with any required security code, access code, or password that would permit access to a financial account, Driver's license number, Medical history, Diagnosis of mental/physical condition by healthcare professional |
| Notice letter | https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2026/01/Columbia_Sample-of-the-Notice-to-Affected-Persons.pdf |
| Days from discovery to notice | 44 |

## Why this score


Source: Washington State Attorney General data breach notifications (data.wa.gov) and California Attorney General data security breach list (oag.ca.gov) (https://data.delaware.gov/d/dir6-wx8v). Last refreshed: 2026-11-04T06:06:58.316Z.
From the Washington, California and Delaware Attorney General breach notification lists, as posted. A notice is the organization's own report under state breach-notification law; it is not a finding of wrongdoing or of harm. California does not publish cause or counts in its list; Delaware lists data types and counts but not cause. Read the notice on the AG site before relying on it.