Sound Community Bank

Sound Community Bank notified Montana residents of a third-party vendor breach affecting SSNs, DOBs, and financial account numbers. The vendor, used for advertising and mailing, was compromised on August 14, 2025. The bank was notified on October 27, 2025. No unauthorized activity was found in the bank's internal systems.

Sound Community Bank notified Nebraska AG of a data breach involving a third-party advertising and mailing vendor. The incident, discovered on August 14, 2025, and reported to the Bank on October 27, 2025, exposed customers' Social Security Numbers, dates of birth, and financial account numbers. The Bank states no unauthorized activity occurred within its own systems. No specific count of affected individuals was provided.

Sound Community Bank notified Washington AG of a third-party vendor breach. The vendor, used for advertising and mailing, experienced a ransomware incident on Aug 14, 2025. Sensitive data including SSNs, DOBs, and financial account numbers were accessed. Bank notified on Oct 27, 2025. 5,503 Washington residents affected.

Sound Community Bank reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2025-10-29. 4 Massachusetts residents were affected.

Sound Community Bank notified Montana residents of a potential data breach involving a third-party vendor's MOVEit file transfer system. The CL0P ransomware group exploited a vulnerability in MOVEit to access data uploaded on April 3, 2023. Affected data included names, SSNs, account numbers, and DOBs. The vendor patched the system on May 31, 2023. Bank offered 24 months of credit monitoring.

Sound Community Bank, a financial services organization, reported an external system breach (hacking) that occurred between April 3, 2023, and May 31, 2023. The breach was discovered on June 13, 2023, and affected 3 Maine residents. The compromised information included names and Social Security numbers. Affected individuals were notified on July 18, 2023, and offered 24 months of identity theft protection services through OnAlert Essential Bundle from ChexSystems. The notification was submitted by outside counsel to Fidelity National Information Services, Inc., indicating a third-party vendor was involved.

Sound Financial Bancorp disclosed that its subsidiary Sound Community Bank was affected by the MOVEit Transfer zero-day vulnerability (Progress Software) via a third-party vendor providing account hosting and transaction processing. The vendor used MOVEit to transfer data on approximately 16,000 of the Bank's mobile and online banking customers. Vendor forensics indicate the data was downloaded once during a valid transfer; investigation ongoing. Law enforcement and banking regulators notified.