Western Alliance Bank
Disclosed Mar 14, 20251 year ago21,899 affectedConfirmed
Cleo zero-day breach exposes 21,899 Western Alliance Bank customers
Western Alliance Bank said attackers exploited a zero-day in a vendor's file transfer software (Cleo) to take files between October 12 and 24, 2024, and notified 21,899 customers.
What is known
| People affected | 21,899 (as reported by the organization) |
|---|---|
| Disclosed | Mar 14, 2025 |
| Discovered | Jan 27, 2025 |
| Happened | Oct 12, 2024 |
| Attack | Supply chain |
| Data exposed | Names, Social Security numbers, Financial, Dates of birth, Government IDs |
| Sector | Finance · US |
| Status | Confirmed |
| Part of | Cleo (2024) |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Western Alliance Bankoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: Western Alliance Bankatg.wa.gov · Official notice | Official notice |
| Oregon DOJ breach notice: Western Alliance Bankjustice.oregon.gov · Official notice | Official notice |
| Western Alliance Bank notifies 21,899 customers of data breachbleepingcomputer.com · News | News |
| Western Alliance Bancorporation 10-Ksec.gov · SEC filing | SEC filing |
Notices filed
| Where | Filed | People |
|---|---|---|
| California AGresidents of CA | Mar 14, 2025 | |
| Researchtotal | Mar 18, 2025 | 21,899 |
| Washington AGresidents of WA | Jun 30, 2025 | 539 |
| Oregon DOJresidents of OR | Jun 30, 2025 | 78,338 |
Same campaign
| Organization | Affected | ||||
|---|---|---|---|---|---|
| Apr 11, 20251 year ago | Supply chain | Transport | Confirmed | 1.2M | |
| Apr 4, 20251 year ago | Supply chain | Manufacturing | Confirmed | 4,093 | |
| Mar 28, 20251 year ago | Extortion | Retail | Unverified | Unknown |
History of this record
- 2026-09-25 · campaign: empty to cleo-2024 · seed source
- 2026-09-25 · attack: ransomware to supply-chain · seed source
- 2026-09-25 · data_types: [] to ["names","ssn","financial","dob","government-id"] · seed source
- 2026-09-25 · records_basis: empty to organization · seed source
- 2026-09-25 · records: empty to 21899 · seed source
- 2026-09-25 · summary: empty to Western Alliance Bank said attackers exploited a zero-day in a vendor's file transfer software (Cleo) to take files between October 12 and 24, 2024, and notified 21,899 customers. · seed source
- 2026-09-25 · title: empty to Cleo zero-day breach exposes 21,899 Western Alliance Bank customers · seed source
- 2026-09-25 · attack: unknown to ransomware · backfill source
- 2026-09-25 · discovered: empty to 2025-01-27 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.