Commonwealth Business Bank Data Breach: What Happened, and Why There Is No Lawsuit to Join
Reference Guide
Commonwealth Business Bank (CBB) is a Los Angeles commercial bank — not Australia’s Commonwealth Bank. An outside party was inside its network from January 25 to February 8, 2025. Letters started going out in August 2025, and a supplemental round followed in December 2025. As of October 14, 2026 we found no filed Commonwealth Business Bank data breach lawsuit, no settlement and no claim form — only law firms advertising investigations.
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Independent information service: Settlement Insight is not the settlement administrator, is not affiliated with or endorsed by the company named above, and is not a law firm. Submitting this form does not file a claim — it shares your information with our participating legal intake partners, who may contact you about your options.
What the Bank Says Happened
According to the bank’s own notice letter filed with the California Attorney General, CBB became aware of suspicious activity on certain systems on or about February 6, 2025. An investigation with third-party cybersecurity specialists found unauthorized access to its environment between January 25 and February 8, 2025, and that files and folders were “potentially viewed and/or acquired without authorization.”
The bank says it then reviewed those files to work out whose information was in them, and that it worked with federal regulators and law enforcement. Each letter lists the reader’s name plus the specific fields found for that person, so the data varies from letter to letter.
Per secondary reports of state filings, the version sent to the Texas Attorney General lists names, addresses, Social Security numbers, driver’s license and government ID numbers, financial information and birthdates. The Massachusetts consumer-affairs report reportedly adds financial account and credit/debit card numbers.
Case details
No Commonwealth Business Bank data breach lawsuit has been located. A search of the CourtListener federal docket index for “Commonwealth Business Bank” on October 14, 2026 returned 26 dockets, none of them a data breach case. The only 2025 federal suit against the bank is Justice Federal Credit Union v. Commonwealth Business Bank, No. 2:25-cv-05215 (C.D. Cal.), filed June 9, 2025 — before any breach letter went out, and brought by a credit union, not by customers on behalf of a class.
State-court filings, for example in Los Angeles, are not covered by that index, so a state case cannot be ruled out. Several plaintiffs’ firms say they are “looking into whether a class action lawsuit can be filed” — an investigation, not a lawsuit.
Status: Breach Confirmed, No Lawsuit Found, No Settlement
The bank has not published a total number of affected people. State filings reported by ClaimDepot put the count at 2,597 Texas residents and 10 in Massachusetts. Treat the totals as unknown.
The only firm date in this matter has passed: the Experian credit-monitoring enrollment deadline was March 31, 2026.
How to Tell Whether You Were Affected
The test is your mail. CBB notified affected people by letter, starting in August 2025, with a supplemental round dated December 9, 2025. CBB mainly serves small and mid-sized businesses, so a letter can reach you even if you only dealt with the bank through a company.
Keep the letter and envelope. It states which of your fields were involved, and it would be your proof of membership if a lawsuit is ever filed and settled.
No letter but you bank with CBB? Call the bank’s breach line at 833-918-1110 (Monday to Friday, 9 a.m. to 9 p.m. Eastern) — the number printed in its own notice.
Is There Any Money?
The letter says identity-restoration help runs for the number of months printed in your letter, from the letter’s date, and needs no enrollment — check yours before assuming it has lapsed. For how comparable bank breaches have paid out once settled, see the data breach settlement calculator; that is context, not a forecast for this case.
Commonwealth Business Bank Breach Timeline
January 25, 2025 — Unauthorized Access Begins
Per the bank’s notice, an outside party gets into CBB’s network.
February 6, 2025 — Suspicious Activity Noticed
CBB becomes aware of suspicious activity and brings in cybersecurity specialists.
February 8, 2025 — Access Ends
The investigation puts the end of the unauthorized access on this date. Files and folders may have been viewed or taken.
August 13, 2025 — First Letters Mailed
Per secondary reports of state filings, letters go out and the breach is reported to California and Massachusetts, then to Texas on August 15, 2025.
December 9, 2025 — Supplemental Notices
CBB sends a supplemental round of letters, filed with the California Attorney General, with a March 31, 2026 credit-monitoring deadline.
October 2026 — No Lawsuit Found
As of October 14, 2026, no filed class action, settlement or claim process could be located.
Three Things to Watch For
A bank breach with no settlement leaves room for imitators:
“Claim your Commonwealth Business Bank settlement”
There is no settlement and no claims portal. A page asking for your Social Security number or account number to “file” is collecting data, not filing anything.
Calls “from the bank’s fraud team”
Exposed account and card numbers make a caller sound informed. Hang up and call the number on your statement or the 833-918-1110 line from the letter — never one the caller gives you.
Mixing it up with Australia’s Commonwealth Bank
News and lawsuits about the Commonwealth Bank of Australia have nothing to do with this Los Angeles bank. Ads that blend the two names are a warning sign.
Commonwealth Business Bank Breach — Questions People Actually Ask
Short answers to the questions people ask most about this case.
Is there a lawsuit against Commonwealth Business Bank over the data breach?
Not that we could find. As of October 14, 2026, the federal docket index lists no data breach case against the bank; state courts cannot be searched the same way. Law firms are advertising investigations, which are not lawsuits.
Is there a lawsuit against Commonwealth Bank?
If you mean the Commonwealth Bank of Australia, that is a different institution with its own history, including a data incident involving statements for some 12 million customers. This page covers only Commonwealth Business Bank in Los Angeles.
Is the bank data breach settlement legitimate?
For Commonwealth Business Bank there is no settlement at all, so any “settlement” notice about this breach is not genuine. Real settlements are run by a court-appointed administrator and are listed on our open settlements page.
How do I know if I was part of a data breach?
CBB mailed letters to affected people from August 2025, with a supplemental round dated December 9, 2025. If you bank with CBB but got no letter, call 833-918-1110, the number in the bank’s notice.
What data was exposed?
It varies by person — each letter lists your name plus the specific fields found. Per secondary reports of state filings, the categories include names, addresses, Social Security numbers, driver’s license and ID numbers, birthdates, financial account and card numbers.
How many people were affected?
The bank has not published a total. Reported state filings list 2,597 Texas residents and 10 in Massachusetts; the California count is not public.
What is the typical payout per person for a data breach settlement?
There is nothing to pay out here, because there is no settlement. For other breach settlements, the amount depends on the fund, the class size and how many people claim — the payout calculator shows how those interact.
What is worth doing right now?
Freeze your credit at all three bureaus — free and reversible. Watch bank and card statements, since account and card numbers were reportedly involved. The bank itself advises staying alert for 12 to 24 months. Keep your letter.
About This Information
- Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology. Reviewed by Leonard Goldberg, Editor · Last updated
- $236 billion in real payouts analyzed · See what we found
This page is for general information only and is not legal advice. Lawsuit status, eligibility, and compensation can change. Settlement Insight is not a law firm and does not represent any party. Consult a licensed attorney about your specific situation.
Related Consumer Brand Lawsuits
Other cases and free tools — not about this case.
Similar cases we track
- Data Breach Settlement CalculatorWhat comparable breach settlements have paid per person
- Open Class Action SettlementsSettlements taking claims right now, with deadlines
- Cadence Bank Data Breach SettlementAnother bank breach, for comparison
- Settlement Payout CalculatorEstimate a per-person payout from a fund and claim rate