Columbia University Hack Exposes Higher Ed Cyber Gaps

A breach of Columbia University’s IT systems after repeated attacks by U.S. President Donald Trump is highlighting how universities are unprepared for today’s threat landscape.

See Also: On Demand | Global Incident Response Report 2025

A smiling image of President Trump reportedly flashed across Columbia’s campus monitors June 24 as a hacker shut down key computer systems and claimed to steal 1.6 gigabytes of data on 2.5 million student applications. A hacker later told Bloomberg one aim of the breach was to probe whether the university has defied a 2023 Supreme Court ban on affirmative action. Columbia has stayed mostly silent about the incident and hired CrowdStrike to investigate the breach’s full impact. One university official told Information Security Media Group the incident appears politically motivated.

“The university’s investigation has indicated the hackers are highly sophisticated and were very targeted in their theft of documents,” a university official said Thursday. “They broke in and stole student data with the apparent goal of furthering their political agenda.”

Columbia declined to comment on how it discovered the breach or what steps it is taking to secure systems. Even with endowments rivaling the GDP of small nations, elite schools like Columbia – not to mention less plush public colleges – face core problems of budget and culture, said Travis Rosiek, public sector chief technology officer at Rubrik and former red team director at the Defense Information Systems Agency.

Rosiek told Information Security Media Group that shrinking budgets, exacerbated by reduced federal support under the current administration and falling enrollment at some schools often leave campuses without enough resources for strong cyber defenses. Universities also naturally incline to being open and collaborative places in real life and online, giving attackers more ways in.

“The struggle with funding proactive cybersecurity and building cyber resilience within the higher ed community is real,” Rosiek said. “Under-funding cybersecurity and resilience programs – or doing nothing – may be cheaper in the near term, but from my experience, the cleanup and rebuild costs significantly more in the long-run.”

A growing body of research shows colleges and universities face record numbers of cyberattacks, with Malwarebytes calling 2023 “the worst ransomware year on record” for higher education as attacks jumped nearly 70%.

A recent Microsoft report found schools and universities are increasingly targeted by advanced nation-state threats, with cybercriminal groups creating fake companies to build ties and access sensitive data like health and financial records. The report said universities now face an average of 2,507 cyberattack attempts each week, a risk made worse by the surge in virtual learning that opened fresh security gaps for attackers to exploit (see: Schools Face Spike in Cyberattacks From Nation-State Hackers).

The hack on Columbia University comes after threats from the White House to strip funding from the campus over its handling of student protests tied to the Israel-Palestine conflict, and amid growing warnings from national security experts that Iran is preparing retaliatory cyberattacks against U.S. institutions and critical infrastructure following strikes on its nuclear sites. Attempts on exposed systems, under protected networks and opportunistic targets are highly likely as Iran looks to reassert deterrence, demonstrate resilience and shape the narrative after the recent military operations (see: Israel-Iran Ceasefire Holding Despite Fears of Cyberattacks).

A university official speaking on the condition of anonymity described the hacker as a “hacktivist” and “not your typical ransomware hacker,” adding that the campus is “in the earliest phases of the investigation.”

“We have not determined the scope of data theft, and this could take weeks to months to complete,” the official said, adding that Columbia will then have to evaluate its notification obligations and alert those affected by the breach.