HackingFinancial ServicesFinanceStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDFinancial accountMediumContained

Columbia Bank

bd_6763df597a598e95 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 22, 2025

Filed

Apr 17, 2026

To disclose

—

Affected

Not disclosed

Linked

4 filings

Confidence

65%

Full breach record for Columbia Bank →2 incidents on file

Columbia Bank notified Nebraska AG of a data breach where an unauthorized third party accessed bank applications between October 2, 2025, and December 22, 2025. The incident involved personal information including names, SSNs, driver's license numbers, and financial account numbers. Columbia Bank engaged law enforcement and a forensic firm, secured systems, and offered one year of Experian IdentityWorks credit monitoring to affected individuals. Notification was sent on March 6, 2026.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 81 days

Oct 2, 2025

Begins

Dec 22, 2025

Discovered

Apr 17, 2026

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Oregon State AGbd_2459fe2d347c53ee2026-04-17Verified
Washington State AGbd_c71b2e03d88edcf32026-04-17Candidate
California State AGbd_cbff3120c1de99f82026-04-17Verified

Name: Columbia Bank
norm: columbia bank

Name: Columbia Bank
norm: columbia bank
Industry: Financial Servicesllm

Discovered: Dec 22, 2025
Breach occurred: Oct 2, 2025 – Dec 22, 2025
Undetected for: 81 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 6, 2026
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Began an internal investigation
Worked to secure our systems
Notified law enforcement
Engaged a forensic security firm to assist with our investigation
Changes made: Enhancing our technical security measures
Arranged for you to enroll in a one-year membership of Experian IdentityWorksSM Credit 3B
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Oregon State AGApr 17 · first

Washington State AGApr 17 · first

California State AGApr 17 · first

Nebraska State AGApr 17 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://nebraska.gov/ago/data-breach/documents/66470dd7-1a83-452a-99a5-509d9d7f7375.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 17, 2026
Raw hash: cccda3030ad80bc4f6a6585e2a0287a1fd70706f35eafa6b9c9db987a161a8d8

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityColumbia Bank

Victim entityColumbia Bank

Incidentdiscovered Dec 22, 2025

Stated responseBegan an internal investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancenebraska.gov