Western Alliance Bank Discloses Data Breach Impacting Nearly 22,000 Customers

Phoenix-based Western Alliance Bank recently disclosed that a data breach exposed the personal information of 22,000 customers.

Western Alliance suffers data breach

Western Alliance, a subsidiary of Western Alliance Bancorporation, suffered a data breach that impacted thousands of customers.

In a February SEC filing, the company disclosed that threat actors breached and exfiltrated sensitive data from several of its systems.

Third-party software vulnerability exploited

The perpetrators reportedly exploited a zero-day vulnerability in a third-party secure file transfer software to carry out the attack.

The vendor of the compromised software disclosed its vulnerability on Oct. 27, 2024. Allegedly, the company noticed the breach only after threat actors leaked stolen data.

After learning of the incident, Western Alliance notified 21,899 customers whose data had been stolen and potentially leaked by the perpetrators.

Several types of personal data leaked

Although the company’s notice says there is no evidence of threat actors misusing stolen data for fraud, identity theft, or other malicious purposes, customers are still advised to remain vigilant.

“On February 21, 2025, we determined that the files contained some of your personal information, including your name and Social Security number,” reads the breach notification letter. “The files may have also contained your date of birth, financial account number, driver’s license number, tax identification number, and/or passport, if you provided it to Western Alliance.”

Company response and mitigation

In response to the incident, Western Alliance vowed to enhance technical security measures to prevent such incidents in the future.

Additionally, despite lacking evidence of customer data misuse, the company offered a one-year complimentary identity protection and credit monitoring subscription.

How to deal with the fallout of data breaches

Data breaches are inevitable; they occur indiscriminately and affect both companies and their customers.

As a customer, having no control over your data in a breach could feel disarming. However, that doesn’t mean you shouldn’t prepare.

Dedicated services like Bitdefender Digital Identity Protection provide a comprehensive overview of your online data, including traces from services you no longer use.

It continuously monitors the public web and the Dark Web, notifies you immediately if your data has been compromised in a breach, and lets you instantly patch holes in your digital footprint with quick, one-click action items.