Heritage Bank data breach: files copied from the bank's network, 168,505 Washingtonians

Oregon's Department of Justice records 182,793 people in total for Heritage Bank, with notice sent on April 23, 2026. That is 14,288 more than Washington's 168,505 residents, so most of the people affected live in Washington.

What happened at Heritage Bank?

The bank says it isolated and secured its network once it found the activity, and brought in outside specialists to investigate. It then reviewed the files that had left the network, a review it finished on April 7, 2026. It says it has added technical safeguards.

Date	What the letter and the regulators' records say
February 5, 2026	Breach date on the Washington and California records
March 1, 2026	Files copied from the internal network, per the letter
March 2, 2026	Heritage Bank identifies the unauthorized activity
April 7, 2026	Review of the copied files finished
April 23, 2026	Letter date; recorded by California, Washington and Massachusetts
April 24, 2026	Posted on the Texas attorney general's list

The state records start the breach on February 5, almost four weeks before the March 1 copying the letter describes. The letter does not say when the intruder first got in. The letters went out 52 days after the bank found the activity.

What information was involved?

The filed letter leaves the list of data blank, to be filled in for each reader. The state records give the categories:

Regulator	Information it records
Washington attorney general	Social Security number; driver's license or Washington ID card number; financial and banking information; other
Texas attorney general	Social Security number; government-issued ID number; financial information
Massachusetts consumer affairs office	Social Security numbers, financial accounts and driver's licenses marked as breached; medical records and payment cards not

How many people were affected?

Regulator	What it counts	Number
Washington attorney general	Washingtonians	168,505
Texas attorney general	Texans	920
Massachusetts consumer affairs office	Massachusetts residents	94

None of these records gives a total. Indiana's 2026 report, read on November 7, 2026, has no Heritage Bank row.

What is Heritage Bank offering?

Single-bureau credit monitoring, a credit report and a credit score from Cyberscout, a TransUnion company, with fraud assistance, at no charge. People must enroll within 90 days of the letter, and must do it themselves. The length of the service and the help-line number are blank fields in the filed copy. The letter gives the help line's hours as 5:00 a.m. to 5:00 p.m. Pacific Time, Monday to Friday, excluding holidays.

Item	Detail from the letter
Provider	Cyberscout (TransUnion)
Enrollment deadline	90 days from the letter date
Help line	Number printed on each letter; 5:00 a.m. to 5:00 p.m. Pacific Time, weekdays
Postal address	Heritage Bank, P.O. Box 1578, Olympia, WA 98507

The letter suggests watching account statements and credit history for the next 12 to 24 months. The guide to bank, brokerage and mortgage breach notices compares other banks' letters.

What the documents leave open

• How the intruder got in, and when access began.
• Whose files were copied: customers, employees or both.
• The length of the monitoring offer.