Orrstown Bank, operating as Orrstown Financial Services, disclosed in May 2026 that a third-party vendor experienced a cybersecurity incident that may have exposed sensitive personal information of some customers. The bank was notified by its vendor on May 21, 2026, and confirmed that its own internal systems and networks were not affected. Orrstown Bank has stated it will notify affected customers and offer credit monitoring.
The specific types of data exposed, beyond 'sensitive personal information', have not been detailed in public reports. This includes whether highly specific data like Social Security numbers, medical records, or detailed financial account numbers were involved. The exact number of individuals affected by this vendor incident has also not been disclosed.
More details about the breach, including a full list of affected data types and the total number of individuals impacted, may emerge as the investigation progresses and notifications are sent out. Notices to consumers may be delayed.