Columbia Bank Faces Class Action Over 119-Day Delay in Data Breach Notification Columbia Bank is under fire after waiting nearly four times the legal limit 119 days to notify customers of a data breach that exposed sensitive personal information. The incident, discovered on December 19, 2023, involved unauthorized access to customer data, including names, Social Security numbers, driver’s license numbers, and financial account details. The breach persisted from October 2 to December 22, 2023, before the bank cut off the attacker. Affected customers, totaling 7,067 individuals, were only informed via mailed notices beginning April 17, 2024. The delay violates Washington’s Data Breach Disclosure Law, which mandates notification within 30 days of discovery. Oregon resident Kristi Meyers filed a federal class action lawsuit in Seattle on May 14, alleging negligence, invasion of privacy, and violations of Washington’s consumer-protection statutes. Meyers also reported $700 in fraudulent charges on her Columbia Bank debit card, including unauthorized gift card purchases and a gas station transaction in Springfield, Oregon. Columbia Bank, a $66 billion-asset institution headquartered in Tacoma, Washington, operates over 350 branches across eight Western states. Despite the breach’s scale, the bank determined the incident was not material to investors, avoiding an SEC disclosure under the agency’s new four-day reporting rule for cybersecurity incidents. The bank’s notice letter revealed little about the attack’s origin, though Meyers’ lawsuit claims the data was stored unencrypted in an internet-accessible environment. Columbia Bank engaged an unnamed forensic firm and law enforcement but did not attribute the delay to an investigative hold. The bank completed its review of affected data on March 6, 2024, taking 77 days within industry standards to assess the exposure before mailing notices 42 days later. This is the second data breach-related class action against Columbia Bank or its predecessor in three years. The bank has not publicly addressed the breach on its website, and a spokesperson did not respond to requests for comment.