California International Bank, N.A., a community-focused financial institution based in Westminster, California, suffered a data breach after an unauthorized individual accessed a single employee’s email account between September 11–12, 2024. The breach was discovered on September 12, 2024, but the bank only confirmed on August 29, 2025, that sensitive personal information—including financial account details and Social Security numbers—was exposed. The incident affected at least four Massachusetts residents, with notifications sent to the California and Massachusetts Attorneys General on September 19, 2025.The breach stemmed from a phishing scam targeting an employee’s email, leading to potential identity theft risks. In response, the bank offered complimentary credit monitoring (Experian IdentityWorks) and recommended affected individuals place fraud alerts, security freezes, and monitor financial statements. Legal investigations suggest victims may be eligible for compensation due to the exposure of highly sensitive data, with law firms like Shamis & Gentile P.A. pursuing class-action claims. The breach underscores vulnerabilities in small financial institutions, where limited employee oversight can result in significant data exposure.