Heritage Financial Corp /Wa/

Cybersecurity incident disclosed to the SEC (8-K Item 8.01)

On or about March 2, 2026, Heritage Financial Corporation (the "Company") detected a cybersecurity incident involving an internal file share server used by employees and the exfiltration of files from that file share server which may contain personal information. The Bank's customer accounts, customer systems and operations were not impacted. Promptly following detection, the Company initiated its security incident response plan and began deploying measures to stop the unauthorized activity, including taking the affected system offline. The incident did not cause any disruptions in the Company