Columbia Bank Waited 119 Days to Notify Customers of Data Breach

Columbia Bank is a regional lender in the U.S. Northwest, and this marks the second time in three years that it has notified customers of stolen data. Banks hold sensitive information that can be used for identity theft, including Social Security numbers, driver’s license details and financial account data. The incident therefore raises questions about both cybersecurity controls and compliance with Washington state’s legal requirement to notify consumers within 30 days.

Hackers accessed Columbia Bank’s application systems from October 2 to December 22, 2025. The bank discovered the intrusion in December but did not mail notifications until April 17, 2026, a delay of 119 days. About 7,067 people were affected, including 1,607 in Washington state. Multiple lawsuits were filed between April 24 and May 12, including a class action filed on April 27.