SoFi Data Breach Exposes PII of 38,049 Washington Residents On December 29, 2025, SoFi Technologies, a San Francisco-based fintech company, suffered a data breach affecting 38,049 residents of Washington state. The incident stemmed from a social engineering attack that granted an unauthorized individual access to internal systems between December 29, 2025, and January 3, 2026. The breach was detected on January 2, 2026, prompting SoFi to launch its incident response protocols. The exposed data included personally identifiable information (PII) such as names, dates of birth, addresses, email addresses, phone numbers, and employment and education details. SoFi confirmed that sensitive financial data including account passwords, debit or credit card numbers, and account numbers remained unaffected. The breach was disclosed to the Washington Attorney General on January 26, 2026, with affected individuals notified via written mail. SoFi engaged cybersecurity firm CrowdStrike and other external advisors to investigate the incident and assess the scope of exposure. The company has since implemented additional monitoring and security measures, including enhanced verification steps for account access and customer support interactions. Affected individuals were advised to review account statements, monitor credit reports, and remain cautious of potential fraud or phishing attempts. SoFi established a dedicated support line (844-820-7634) for impacted members seeking assistance.