Columbia Bank Waited 119 Days to Notify 7,000 Customers After Breach, Violating Washington’s 30‑Day Rule

Columbia Bank waited 119 days to inform 7,067 customers of a data breach, nearly four times Washington’s 30‑day disclosure limit, triggering a class‑action lawsuit.

Washington’s Data Breach Disclosure Law requires notice within 30 days of discovery. Columbia Bank, an Oregon‑chartered subsidiary of Columbia Banking System Inc. (Nasdaq: COLB), detected the intrusion on Dec. 19, 2025 and severed attacker access three days later. The bank did not mail notices until April 17, 2026, a 119‑day gap.

The breach exposed personal data of 7,067 individuals. Plaintiff Kristi Meyers reported $700 in fraudulent Apple and Walmart gift‑card purchases and a gas‑pump charge on her Columbia Bank debit card. The bank’s internal review took 77 days to identify affected data, followed by a 42‑day delay before mailing notices.

Columbia Banking System holds roughly $66 billion in assets and operates over 350 branches across eight western states. Its market capitalization is about $4.8 billion. In early trading after the news, COLB shares slipped approximately 1.1 %, underperforming the KBW Nasdaq Bank Index which was flat.

The delay may violate Washington’s consumer‑protection statutes, exposing the bank to negligence claims, invasion of privacy allegations, and potential civil penalties. The class action seeks damages for affected customers and could prompt regulatory scrutiny from the Washington Attorney General’s office.

Investors will watch for the court’s preliminary ruling slated for late Q3 and any SEC Form 8‑K filing regarding the breach’s materiality.