Community Bank files 8-K after an employee put customer SSNs into an unauthorized AI app

What happened?

In an Item 1.05 (Material Cybersecurity Incidents) Form 8-K signed by president and chief executive John H. Montgomery and filed on 11 May 2026, CB Financial Services said that on 5 May its subsidiary Community Bank became aware of an internal incident in which non-public customer information was handled using "an unauthorized artificial intelligence-based software application". The filing said the incident did not disrupt the bank's operations, customer access to accounts, payment systems or core IT infrastructure, but that "due to the volume and sensitive nature of the non-public information at issue" the company determined on 7 May that the event was material. Customer names, Social Security numbers and dates of birth were among the information disclosed.[1]

The filing did not describe how the data left the bank or name the application. The Register, which first reported the filing, and TechCrunch both noted that the bank did not say how many customers were affected or which AI tool was involved; TechCrunch said the language suggested someone may have uploaded customer data to an online AI chatbot.[3][4]

In June 2026 Montgomery and chief operating officer Jennifer George gave American Banker more detail. According to the bank, an employee fed the data into an unapproved tool, using a personal account on a personal device, while mocking up a presentation, and "thought the sensitive data had been removed from the file". The bank said it already offered an approved AI tool with bank-issued accounts. George said the file and the surrounding prompts "were deleted immediately upon confirmation of upload", and Montgomery said there was no evidence the data was misused and that he believes the bank reached the vendor in time to stop it being used for model training.[6]

Law firm Wilson Sonsini described the filing as the first Form 8-K under Item 1.05 triggered by an unauthorized use of an AI tool rather than an external cyberattack, and American Banker said its own search of the SEC's full-text database found the phrase "unauthorized artificial intelligence" in only this one 8-K.[5][6]

When did it happen?

1. May 5, 2026

   Community Bank becomes aware that non-public customer information was handled using an unauthorized AI-based application.[1]

2. May 7, 2026

   CB Financial Services determines the incident is material.[1]

3. May 11, 2026

   CB Financial files the Item 1.05 Form 8-K with the SEC.[1][3]

4. May 12, 2026

   The company's Q1 2026 Form 10-Q records the incident as a subsequent event and repeats that no material financial impact is expected.[2]

5. Jun 8, 2026

   Executives tell American Banker an employee uploaded the file to an unapproved tool from a personal device, and describe the clean-up with the AI vendor.[6]

What was the impact?

• Customers: Undisclosed number of Community Bank customers; names, Social Security numbers and dates of birth exposed to a third-party AI application[1][6]
• Other: No operational disruption and no expected material financial impact, per the 8-K. The bank told American Banker there was no evidence the data was misused. No customer count, loss figure or regulator response has been published.[1][6]

Severity 3 of 5: Material harm under the rubric: the company itself classed the exposure of customer names, Social Security numbers and dates of birth as a material cybersecurity incident under Item 1.05; no financial loss, misuse or regulatory action has been reported.

How did CB Financial Services, Inc. (Community Bank, Carmichaels, PA) respond?

In the 8-K the company said it "promptly took steps to secure the information", engaged external cybersecurity advisors, is notifying customers as federal and state law requires, is in communication with banking regulators, and is "strengthening existing controls, implementing additional controls and enhancing monitoring measures". Executives told American Banker the bank has since blocked the web domains of unapproved AI tools, tightened employee access to customer data and expanded its data-security policies; George called it "one single act by one single employee".[1][6]

What was the outcome, and did regulators act?

As of October 2026 no regulator action, fine or lawsuit tied to the incident has been reported, and the bank has not published the number of affected customers or the name of the AI application. The bank's investigation into scope and root cause was described as ongoing in the 8-K; no follow-up SEC filing on the incident was found after the 12 May 2026 Form 10-Q.[1][2]

1. CB Financial Services, Inc. Form 8-K, Item 1.05 Material Cybersecurity Incidents official
   CB Financial Services, Inc. (SEC EDGAR) · May 11, 2026
   “On May 5, 2026, Community Bank (the "Bank"), the wholly-owned subsidiary of CB Financial Services, Inc. (the "Company"), became aware of an internal incident involving the handling of certain non‑public customer information using an unauthorized artificial intelligence-based software application.”
2. CB Financial Services, Inc. Form 10-Q for the quarter ended March 31, 2026 official
   CB Financial Services, Inc. (SEC EDGAR) · May 12, 2026
   “Due to the volume and confidential nature of the information at issue, the event was determined to be material; however, the Company does not expect a material impact on its consolidated financial condition or results of operations.”
3. US bank reports itself after slinging customer data at 'unauthorized AI app' news
   The Register · May 12, 2026
   “Community Bank did not specify what this "unauthorized AI-based software application" was or how it was used.”
4. US bank discloses security lapse after sharing customer data with AI app news
   TechCrunch · May 12, 2026
   “While Community Bank did not disclose how many customers were affected by the incident, nor what AI application was involved, the company said it is "evaluating the customer data that was affected" and is sending notifications in accordance with relevant laws.”
5. "Shadow AI" Triggers First SEC Form 8-K for Unauthorized AI Use: What Financial Institutions and Public Companies Need to Know news
   Wilson Sonsini Goodrich & Rosati · May 29, 2026
   “CB Financial Services, Inc. filed the first SEC Form 8-K under Item 1.05 triggered by an unauthorized use of an artificial intelligence (AI) tool, not an external cyberattack.”
6. A bank breaks its silence on its shadow-AI breach news
   American Banker · Jun 8, 2026
   “"We acted swiftly to remediate the actions by accessing appropriate channels to limit the infiltration of data into the model," George said. "The file and all surrounding prompts were deleted immediately upon confirmation of upload."”