Pursuant to Section 13 or 15(d) of the Securities and Exchange Act of 1934
Date of Report: June 27, 2023
(Date of earliest event reported)
Columbia Banking System, Inc.
(Exact Name of Registrant as Specified in Its Charter)
Washington
000-20288
91-1422237
(State or Other Jurisdiction of Incorporation or Organization)
(Commission File Number)
(I.R.S. Employer Identification Number)
1301 A Street
Tacoma, Washington98402-4200
(address of Principal Executive Offices)(Zip Code)
(253) 305-1900
(Registrant's Telephone Number, Including Area Code)
Check the appropriate box below if the Form 8-K filing is intended to simultaneously satisfy the filing obligation of the registrant under any of the following provisions:
[ ☐] Written communications pursuant to Rule 425 under the Securities Act (17 CFR 230.425)
[ ☐ ] Soliciting material pursuant to Rule 14a-12 under the Exchange Act (17 CFR 240.14a-12)
[ ☐ ] Pre-commencement communications pursuant to Rule 14d-2(b) under the Exchange Act (17 CFR 240.14d-2(b))
[ ☐ ] Pre-commencement communications pursuant to Rule 13e-4(c) under the Exchange Act (17 CFR 240.13e-4(c))
Securities registered pursuant to Section 12(b) of the Act:
TITLE OF EACH CLASS
TRADING SYMBOL
NAME OF EXCHANGE
Common Stock
COLB
The Nasdaq Stock Market LLC
Indicate by check mark whether the registrant is an emerging growth company as defined in Rule 405 of the Securities Act of 1933 (§230.405 of this chapter) or Rule 12b-2 of the Securities Exchange Act of 1934 (§240.12b-2 of this chapter).
Emerging growth company [ ☐]
If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act [ ]
Item 8.01
Other Events.
On June 21, 2023, Umpqua Bank, a wholly owned subsidiary of Columbia Banking System, Inc. (the "Company"), was informed by one of its technology service providers (the "Vendor") that a widely reported security incident involving MOVEit, a filesharing software used globally by government agencies, enterprise corporations and financial institutions, resulted in the unauthorized acquisition by a third party of the names and social security numbers or tax identification numbers of certain of Umpqua Bank’s consumer and small business customers (the "Vendor Incident").
Other than the information described above, no Umpqua Bank account information was compromised as a result of the Vendor Incident, and no information from Umpqua Bank’s commercial customers was involved in the Vendor Incident.
On June 22, 2023, Umpqua Bank sent an email to potentially affected consumer and small business customers informing them of the Vendor Incident. Umpqua Bank is working with the Vendor to provide formal notification to all such consumer and small business customers with additional information and resources. In the interim, consumer and small business customers who have questions are encouraged to reach out to their local Umpqua Bank branch or to call (866) 485-7782.
Separately and as communicated earlier this month, Umpqua Bank experienced an on-premise MOVEit security incident. The on-premise instance was removed from the network immediately and decommissioned, and the unauthorized actor did not obtain any customer information or Umpqua Bank data. An independent forensics firm was engaged and confirmed the Company’s assessment of this on-premise MOVEit incident, which did not cause any interruption of business operations.
While the Company is continuing to measure the impact, the Company does not currently believe the Vendor Incident or on-premise incident will have a material adverse effect on its business, operations, or financial results.
Forward-Looking Statements
This Current Report on Form 8-K includes forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995, which can be identified by words such as “may,” “expected,” “anticipate,” “continue,” or other comparable words. In addition, all statements other than statements of historical facts that address activities that the Company expects or anticipates will or may occur in the future are forward-looking statements. These forward-looking statements are based on our current beliefs, understandings and expectations regarding the Vendor Incident and its impact on our business, operations and financial results. Factors that could cause actual results to differ materially from those expressed or implied include legal, reputational, and financial risks resulting from the Vendor Incident, including the Company’s potential discovery of additional information related to the Vendor Incident, any potential regulatory inquiries and/or litigation to which the Company may become subject in connection with the Vendor Incident, and other additional costs that may be incurred by the Company in connection with the Vendor Incident, and the risks set forth in the Company’s Annual Report on Form 10-K for the year ended December 31, 2022, filed with the Securities and Exchange Commission on February 24, 2023, and the Company’s other filings with the Securities and Exchange Commission. The Company undertakes no obligation to revise or update any forward-looking statements, or to make any other forward-looking statements, whether as a result of new information, future events or otherwise.
SIGNATURES
Pursuant to the requirements of the Securities Exchange Act of 1934, the registrant has duly caused this report to be signed on its behalf by the undersigned hereunto duly authorized.
