Plaintiff alleges prestigious university failed to protect sensitive applicant data

A shocking lawsuit has been filed against a prestigious university, alleging gross negligence in safeguarding sensitive personal information. Aakash Dalal, acting pro se, lodged the complaint on January 28, 2026, in the United States District Court for the Southern District of New York against The Trustees of Columbia University in the City of New York and unidentified employees referred to as John Does 1-20.

The case centers around a significant data breach that exposed the personal information of nearly 870,000 individuals, including Dalal. According to the complaint, Dalal applied for admission to Columbia University in late 2009 when he was just 17 years old. As part of his application process, he provided extensive personal information such as his name, address, date of birth, social security number, and high school transcripts. He believed this data would be securely stored and eventually discarded by the university. However, Columbia University allegedly retained this data unencrypted for over 16 years until it was compromised by cybercriminals in May 2025.

Dalal accuses Columbia University of failing to implement adequate security measures despite being aware of potential cyber threats. The complaint states that unauthorized hackers accessed and stole nearly 460 gigabytes of data from the university’s servers using a known vulnerability that could have been easily prevented. This breach included over 1.8 million social security numbers and other sensitive personal information. The plaintiff claims that Columbia University’s negligence has resulted in ongoing risks of identity theft and fraud.

In his lawsuit, Dalal seeks compensatory damages exceeding $250,000 along with punitive damages not less than $500,000. He also demands equitable relief requiring Columbia University to destroy all related data in its possession and implement stronger security measures to prevent future breaches. Additionally, he requests reasonable attorneys’ fees and costs associated with the case.

Representing himself without an attorney (pro se), Aakash Dalal is pursuing justice against what he describes as a gross failure by Columbia University to protect applicants’ private information adequately. The case is being presided over by judges at the United States District Court for the Southern District of New York under Case ID: 26 CV 1009.