Social EngineeringFinancial ServicesFinancePhishingTargetedData ExfiltratedIdentity (basic)EmploymentEducationMediumContained

SoFi Bank, N.A.

bd_30cb04ed5b7e3ed5 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 2, 2026

Filed

Jan 26, 2026

To disclose

24 days

Affected

38,049state residents only

Confidence

67%

SoFi Bank, N.A. reported a security incident to Washington AG in Jan 2026. Unauthorized access occurred Dec 31, 2025 – Jan 3, 2026 via social engineering (phishing). Discovered Jan 2, 2026. Approximately 38,049 Washington residents affected. Data acquired: name, address, email, phone, DOB, employment, and education info. No financial account data compromised. Incident contained; law enforcement notified.

J jump to incidentP pin to compareR raw source

Washington clock✓ WA AG ≤30d24 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 2 days

discovery → filing · 24 days

Dec 31, 2025

Begins

Jan 2, 2026

Discovered

Jan 26, 2026

Filed

vs. sector median

5 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed38,049 affectedView incident

Name: SOFI TECHNOLOGIES, INC.
norm: sofi technologies

Name: SoFi Bank, N.A.
norm: sofi bank
Industry: Financial Servicesllm

Discovered: Jan 2, 2026
Breach occurred: Dec 31, 2025 – Jan 3, 2026
Undetected for: 2 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 38,049state-resident count only
Data types: Identity (basic)EmploymentEducation
Data elements: NameDate of birth
WA-stated cause: Theft or Mistake
WA-stated duration: lifecycle 1-99dexposure 1-99d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing Link
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Office of the Attorney General
Initial access: phishing_link

During the incident: Activated its incident response process
Took swift steps to stop the activity
Engaged CrowdStrike to investigate
Notified law enforcement
Changes made: Strengthened security measures
Implemented additional monitoring
Implemented other safeguards to protect members and their money
Strengthened processes to prevent this type of abuse in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 days(24 days from discovery to filing)
Compliance flags: WA AG ≤30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA36344.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 26, 2026
Raw hash: 83ab47386155edac51c899ffb29613df2c7aa6a71dc57847f49a5413ddd7e6fe

Reporting entitySOFI TECHNOLOGIES, INC.

Victim entitySoFi Bank, N.A.

Incidentdiscovered Jan 2, 2026

Stated responseActivated its incident response process

ComplianceWA AG ≤30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com