Western Alliance Bank has reported that the personal information of nearly 22,000 customers was compromised in a data breach last year. The breach occurred due to a vulnerability in a third-party vendor’s secure file transfer software. The bank filed breach notification documents confirming that their systems were affected by the flaw.
Western Alliance did not name the specific software involved but was previously identified by the Clop ransomware gang as one of the companies impacted by an exploit in the Cleo file-sharing tool in October 2024. According to the notifications, an unauthorized actor began exploiting the unknown vulnerability in the third-party software in October 2024, allowing them to access limited portions of Western Alliance’s systems and obtain copies of files.
Western Alliance responds to data breach
The bank became aware of the data breach on January 27, 2025, and an investigation revealed that the hackers had extracted data from October 12 to October 24, 2024. The stolen information includes names, Social Security numbers, and, in some cases, dates of birth, financial account numbers, driver’s license numbers, tax identification numbers, and passports. Western Alliance informed regulators in Maine that 21,899 people were affected and will provide one year of identity protection services to those impacted.
Several other companies named by Clop, including Hewlett Packard Enterprise and Thomson Reuters, are currently investigating whether they were also affected by the same vulnerability. Hewlett Packard Enterprise has not yet confirmed any compromise, while Thomson Reuters stated that they have removed the vulnerable application and contacted the limited number of affected customers. The Clop ransomware gang, known for targeting file-sharing tools in global data theft campaigns, initially disclosed 66 companies’ names affected by the breach in the fall of 2024 and has continued to reveal additional organizations throughout 2025.
Image Credits: Photo by Fili Santillán on Unsplash
April Isaacs is a news contributor for DevX.com She is long-term, self-proclaimed nerd. She loves all things tech and computers and still has her first Dreamcast system. It is lovingly named Joni, after Joni Mitchell.
