Overview

• A June 24 IT outage prompted Columbia to report the incident to law enforcement, including the FBI, and to enlist external cybersecurity experts for a forensic investigation.
• University findings trace unauthorized access back to around May 16, when threat actors infiltrated its network and extracted files from a segment of its systems.
• Compromised data spans names, dates of birth, Social Security numbers, contact and demographic details, academic history, financial aid files, insurance data and health records, with hackers claiming up to 460 GB stolen.
• Columbia reports no evidence that patient records at its Irving Medical Center were accessed or that any stolen information has been misused so far.
• Investigators note features consistent with a ransomware-style operation, but no known threat group has claimed responsibility and full attribution remains under review.