Attorneys at Almeida Law Group are investigating whether a class action lawsuit can be filed on behalf of individuals affected by a possible COLUMBIABANK.COM(UMPQUABANK.COM) data breach. According to dark web monitoring sources, a hacker group calling itself clop claimed responsibility for a cyberattack on COLUMBIABANK.COM(UMPQUABANK.COM) in a post first observed in September 2026, alleging it had gained access to internal company systems. As of this writing, COLUMBIABANK.COM(UMPQUABANK.COM) has not issued a public confirmation of the incident, and the exact scope of any exposed data remains unknown. If you believe you were affected, contact Almeida Law Group.
About COLUMBIABANK.COM(UMPQUABANK.COM)
Columbia Banking System, Inc. (Nasdaq: COLB) is a financial holding company headquartered in Tacoma, Washington, with its banking subsidiary headquartered in Lake Oswego, Oregon. It completed its merger with Umpqua Holdings Corporation on March 1st, 2023, creating one of the largest banks in the western United States with over $50 billion in assets and more than 350 branch locations across Arizona, California, Colorado, Idaho, Nevada, Oregon, Utah, and Washington. The bank provides retail banking, commercial banking, lending, wealth management, and other financial services to individuals and businesses. The banking subsidiary’s legal name changed from Umpqua Bank to Columbia Bank effective July 1st, 2025, with the trade name changeover completed September 1st, 2025.
What Happened?
Columbia Banking System was listed on the Clop ransomware group’s dark web leak site in an allegation reported by Ransomware.live, first observed on September 23rd, 2026. This is an attacker-side claim only. No victim confirmation, regulatory filing, or independent corroborating reporting has been found to verify that a new incident occurred. The exact scope of any allegedly exposed data has not been specified.
This claim warrants particular caution for two reasons. First, Clop previously listed Umpqua Bank on its leak site in connection with the 2023 MOVEit Transfer campaign, meaning the new listing could be a re-post of older data rather than evidence of a new compromise. Second, Clop’s own dark web infrastructure was reportedly hacked by rival group ShinyHunters around September 19th, 2026 — just days before this listing appeared — raising questions about whether the listing was actually placed by Clop or by ShinyHunters, and about the general reliability of new entries appearing on the site around that date.
Columbia Bank does have two confirmed prior breaches. In 2023, then-operating as Umpqua Bank, the institution was impacted by the global MOVEit Transfer vulnerability exploited by Clop. The bank notified 429,252 individuals, with names and Social Security numbers involved. Seven class action lawsuits were filed and consolidated into MDL No. 3083 (In Re: MOVEit Customer Data Security Breach Litigation) in the U.S. District Court for the District of Massachusetts. More recently, Columbia Bank disclosed that an unauthorized third party accessed certain bank applications between October 2nd, 2025, and December 22nd, 2025. The breach review was completed March 6th, 2026, and consumer notifications began April 17th, 2026, affecting 7,067 individuals. A class action was filed in connection with that incident, alleging negligence, invasion of privacy, and violations of Washington consumer-protection statutes, with the plaintiff noting that the bank’s 119-day notification delay was alleged to be nearly four times Washington’s 30-day statutory ceiling. No litigation specific to the September 23rd, 2026 Clop leak-site claim has been identified.
Key Facts at a Glance
- Company or Organization: Columbia Banking System, Inc. / Columbia Bank (formerly Umpqua Bank), operating under columbiabank.com and umpquabank.com
- Industry: Financial Services — Regional Banking
- Location: Holding company headquartered in Tacoma, Washington; banking subsidiary headquartered in Lake Oswego, Oregon; over 350 branches across eight western U.S. states
- Incident type: Ransomware leak-site allegation (attacker-side claim, unconfirmed by organization)
- Date of claim first observed: September 23rd, 2026
- Prior breach: 2023 MOVEit breach (429,252 individuals; Clop-attributed; class action consolidated into MDL No. 3083); October–December 2025 intrusion (7,067 individuals; class action filed)
- Litigation status: Active litigation for both prior breaches; no litigation identified specific to the September 2026 claim
- Source: Ransomware.live — Clop claim against COLUMBIABANK.COM(UMPQUABANK.COM); ShinyHunters Hacked Clop (Dark Reading); How Columbia Bank kept a breach quiet for 119 days (American Banker); Umpqua Bank MOVEit breach notification letter (California AG)
What Should You Do?
Even though the September 2026 Clop claim has not been confirmed by Columbia Bank, the bank’s two prior breaches mean that some customers may already have had personal information exposed. If you are or were a Columbia Bank or Umpqua Bank customer, you should consider placing a fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion — and closely monitoring your bank and credit card accounts for unauthorized activity. You can request free copies of your credit reports at AnnualCreditReport.com. If you receive any notification from Columbia Bank about a new incident, review it carefully for enrollment deadlines for any identity theft protection services being offered. If you believe you are already a victim of identity theft, visit IdentityTheft.gov for step-by-step recovery guidance.
Your Legal Rights
If your personal information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
