In October 2017, the Washington State Office of the Attorney General disclosed a data breach at Catholic United Financial, which took place between July 31 and August 28, 2017. The incident stemmed from a cyberattack involving malware, compromising the personally identifiable information (PII) of 704 Washington residents. The exposed data included names and Social Security numbers (SSNs), heightening risks of identity theft and financial fraud. The breach was attributed to an external cyber intrusion, though specifics on the attack vector (e.g., phishing, unpatched vulnerabilities) were not detailed. The exposure of SSNs—highly sensitive identifiers—posed significant long-term threats to affected individuals, including potential fraudulent credit applications, tax fraud, or unauthorized account access. The company likely faced regulatory scrutiny under state data protection laws, alongside reputational damage and potential legal liabilities. Remediation efforts, such as credit monitoring for victims, were not explicitly mentioned in the report.

The California Office of the Attorney General reported a data breach incident involving Catholic United Financial on October 6, 2017. The breach occurred on November 12, 2016, due to SQL injection attacks that compromised the personal information of approximately 127,310 members, including Social Security numbers. This breach exposed sensitive personal data, potentially leading to identity theft and financial fraud for the affected individuals.