SoFi Technologies Hit by Social Engineering Breach, Exposing Sensitive Data of Nearly 38,000 Washington Residents SoFi Technologies, a San Francisco-based financial technology company, disclosed a data breach stemming from a social engineering attack that compromised the personal information of approximately 38,049 Washington state residents. The unauthorized access occurred between December 29, 2025, and January 3, 2026, with SoFi detecting the incident on or around January 2, 2026. Upon discovery, SoFi activated its incident response protocols, engaged cybersecurity experts, and notified law enforcement. The company confirmed that no further unauthorized activity has been observed since January 3, 2026. While financial data such as account numbers, passwords, and payment card details remained unaffected, the exposed information included names, full dates of birth, addresses, email addresses, phone numbers, and employment and education details. SoFi has stated that affected individuals may be entitled to legal protections, including free credit monitoring, fraud alerts, and potential compensation under state and federal laws. The breach is currently under investigation by class action law firm Shamis & Gentile P.A., which is evaluating claims for those impacted.