<div id="readability-page-1"><div><ul><li>Key insight: Washington's Data Breach Disclosure Law sets a 30-day ceiling on notification, measured from discovery; Columbia's delay was nearly four times that.</li><li>What's at stake: The class action accuses Columbia Bank of negligence, invasion of privacy and violations of two Washington consumer-protection statutes.</li><li>Supporting data: Plaintiff Kristi Meyers reports $700 in fraudulent Apple and Walmart gift-card purchases on her Columbia Bank debit card, plus a charge at a Springfield, Oregon, gas pump.</li></ul>Overview bullets generated by AI with editorial review.For the second time in three years, Columbia Bank is telling customers that hackers took their personal data. This time, the bank caught the attacker still inside its systems, then it waited 119 days to tell those customers.The intrusion ran from early October to late December, according to notices the bank mailed to affected customers beginning April 17. The attacker accessed &#34;certain Columbia Bank applications and information&#34; such as names, Social Security numbers, driver's license numbers and financial account numbers, according to the notices.A total of 7,067 individuals were affected, according to the Oregon Department of Justice's data-breach reporting portal.Columbia Bank discovered the intrusion on Dec. 19 and cut the attacker off three days later, on Dec. 22, according to the notice letter.Columbia Bank is the Oregon-chartered, FDIC-insured subsidiary of Columbia Banking System, Inc., a Washington corporation headquartered in Tacoma that trades as COLB on the Nasdaq. The bank has roughly $66 billion in assets and operates more than 350 branches across eight western states, according to its first-quarter earnings report.An Oregon resident named Kristi Meyers sued Columbia Bank and its parent in federal court in Seattle on Tuesday, alleging negligence, invasion of privacy and violations of two Washington consumer-protection statutes. The case is Meyers v. Columbia Banking System, Inc.Meyers' complaint says the 119-day notification delay broke Washington's Data Breach Disclosure Law, which requires notice &#34;in the most expedient time possible, without unreasonable delay, and no more than thirty calendar days after the breach was discovered.&#34;Columbia Banking System filed no Form 8-K with the Securities and Exchange Commission, or SEC, about the breach, according to the company's public filings index.The SEC requires public companies to disclose material cybersecurity incidents within four business days of determining the incident is material to investors, under a rule that took effect in December 2023.The materiality determination is the company's to make. Columbia Banking System decided this breach was not material to investors.Umpqua Bank, whose parent merged with Columbia Banking System in 2023 to form today's Columbia Bank, was one of hundreds of institutions caught up in the global MOVEit supply-chain breach earlier that year. Umpqua notified roughly 430,000 customers at the time.Meyers' lawsuit is the second data-breach class action filed against the bank or its predecessor in three years. Her lead counsel, M. Anderson Berry of Seattle's Emery Reddy, PC, was local counsel on the 2023 case too.A Columbia Bank spokesperson did not immediately respond to a request for comment.<h2>The intrusion: 81 days in, an unnamed forensic firm out</h2>Columbia's notice letter to affected customers says little about how the attacker got in. The bank refers only to &#34;certain Columbia Bank applications.&#34;That could mean customer-facing online banking, employee software, a treasury-management portal, a loan-origination platform or back-office infrastructure. The bank has not said which.Meyers' complaint goes a step further, alleging Columbia Bank stored the affected information &#34;unencrypted, in an Internet-accessible environment&#34; and that &#34;unauthorized actors used an extraction tool to retrieve&#34; it.The notice letter says that Columbia Bank &#34;engaged a forensic security firm&#34; and &#34;notified law enforcement,&#34; but the bank has not named either.The letter is explicit on one point: &#34;This notification was not delayed by law enforcement.&#34; The four-month gap between detection and customer notice did not come from an investigative hold.<h2>Caught in the act, then four months of silence</h2>The bank's notice letter does not give a discovery date. The Dec. 19 date appears instead in a data-breach reporting portal run by the Oregon Department of Justice. (The entry misspells the bank's name as &#34;Colombia Bank.&#34;)The notice letter does pin down the breach window, which ran from Oct. 2 to Dec. 22.Columbia Bank &#34;completed our review&#34; of the affected data on March 6, 2026, according to the notice letter. The review took 77 days, working out which individuals were exposed and what data each had lost.The bank then took another 42 days before mailing notices, beginning April 17.Industry standards give institutions roughly 60 to 120 days to figure out which customers a complex intrusion affected. Columbia Bank's 77-day review fell within that window.Six weeks then passed between the review's completion and the mailing of notices.Washington's Data Breach Disclosure Law sets a 30-day ceiling on notification, measured from discovery. Most state breach laws use similar &#34;expedient&#34; and &#34;reasonable&#34; standards.Meyers' complaint accuses Columbia Bank of breaking Washington's statute; the 119-day delay is nearly four times the 30-day ceiling.Columbia Bank itself did not publicize the breach. As of this week, neither the security center, the newsroom nor any other page on columbiabank.com mentioned it.<h2>Fraudulent charges</h2>In the wake of the Columbia Bank data breach, someone used Meyers' Columbia Bank debit card to buy roughly $700 of Apple and Walmart gift cards, according to her complaint.The same card ran up another fraudulent charge at a gas pump in Springfield, Oregon, a few exits up Interstate 5 from her home in Elmira, Oregon.Her complaint also says &#34;evidence&#34; suggests someone using a Linux computer in Springfield may be hacking her account.Meyers has reported the fraud to local police, the FBI and the Federal Trade Commission. She has closed her Columbia Bank account and opened one at a different bank. </div></div>

COLB

KBWB

Columbia Bank faced a class action lawsuit for a 119-day delay in notifying customers about a data breach, violating Washington's Data Breach Disclosure Law. The breach, which affected 7,067 individuals, involved unauthorized access to personal data, including Social Security numbers. The bank discovered the breach on December 19 but only informed customers starting April 17. The lawsuit claims negligence and invasion of privacy, as the bank did not disclose the incident to investors as required by SEC regulations.

How Columbia Bank kept a breach quiet for 119 days