Tailing Hackers, Columbia University Uses Logging to Improve Security

Columbia University has faced repeated cyber incidents — most recently a June 2025 hacktivist attack that stole student and employee data and disrupted services, with prior hacktivist and state-sponsored intrusions targeting research systems. The report highlights how comprehensive logging (netflows), a shared Sumo Logic SIEM, honeypots, automation, and third-party incident response helped the university detect lateral movement, trace attacker access, contain intrusions, and reduce noisy events for faster investigations.