Western Alliance Bank notifies 21,899 customers of data breach

**Executive summary:** Western Alliance Bank notified 21,899 customers that their personal data was exfiltrated after threat actors exploited a zero-day in a third-party secure file transfer product between October 12–24, 2024; the Clop ransomware group claimed the breach, and the intrusion involved Cleo-related zero-days (CVE-2024-50623, CVE-2024-55956) and a Java backdoor dubbed "Malichus" used to steal files. The bank found the theft after attackers leaked some stolen files, completed analysis on February 21, 2025, and is offering affected customers complimentary credit monitoring.