Columbia Bank Data Breach Exposes Sensitive PII

Columbia Bank, a major regional bank headquartered in Tacoma, WA, disclosed a data breach that occurred during late 2025.

The breach was disclosed to the California Attorney General, with a filing dated April 17, 2026.

According to the company's notification to consumers, the bank recently learned that an unknown, unauthorized third party gained access to certain Columbia Bank applications. The unauthorized access took place over a period of nearly three months, beginning on Oct. 2, 2025, and continuing through Dec. 22, 2025.

It was determined that the unauthorized party accessed certain bank applications and the information contained within them during this period. A review of the data potentially accessed or acquired by the unauthorized third party was then conducted to determine whether it included any personal information.

On March 6, 2026, the bank completed this review and confirmed that the compromised data did contain personal information belonging to affected individuals. The types of personal information involved remain publicly undisclosed but may include names, addresses, financial information, or Social Security numbers.

Columbia Bank's response to the breach

Columbia Bank is offering affected individuals a complimentary one-year membership to Experian IdentityWorks Credit 3B.The service actively monitors credit files at all three major credit bureaus (Experian, Equifax and TransUnion) for indicators of fraud. It also provides access to an Experian credit report at signup, with daily credit reports available for online members.

In addition, the membership includes identity restoration support from specialists who can help address both credit and non-credit related fraud. Experian's ExtendCare program continues to provide the same level of identity restoration support even after the membership expires. The membership also includes up to $1 million in identity theft insurance, which covers certain costs and unauthorized electronic fund transfers.

Affected individuals can enroll online or by calling 877-288-8057. The enrollment deadline is July 31, 2026. Additional identity protection resources are available at Experian's restoration support page.

Columbia Bank has also set up a dedicated phone line for questions about the breach at 866-486-7782. The line is available from 7 a.m. to 6 p.m. Pacific time, Monday through Friday, and from 8 a.m. to 5 p.m. Pacific time on Saturday and Sunday.

Steps to take if your information was exposed

• Place a credit freeze at Equifax (1-888-298-0045), Experian (1-888-397-3742) and TransUnion (1-888-909-8872) to prevent new accounts from being opened without consent.
• Review credit reports regularly by requesting free copies at AnnualCreditReport.com, where a printable request form and identity protection tips are also available.
• Consider placing a fraud alert by contacting any one of the three major credit bureaus: Equifax (1-866-349-5191), Experian (1-888-397-3742) or TransUnion (1-800-888-4213).
• Monitor bank and financial accounts closely for unauthorized transactions and report any suspicious activity to the relevant financial institution immediately.
• Report suspected identity theft to the Federal Trade Commission (1-877-438-4338) or to a state attorney general's office, including those in Maryland, New York, North Carolina and Oregon; New Mexico residents can also review their credit reporting rights.
• Be cautious of phishing attempts that reference Columbia Bank or this data breach by name, as scammers may try to use the incident to trick people into sharing more personal information.