# Community Bank files 8-K after an employee put customer SSNs into an unauthorized AI app

Source: https://www.bankingnewsai.com/ai-incidents/cb-financial-2026-shadow-ai-customer-data
Last updated: Oct 21, 2026

CB Financial Services, Inc. (Community Bank, Carmichaels, PA) · Governance finding · severity 3 of 5

CB Financial Services, parent of Pennsylvania lender Community Bank, disclosed in a Form 8-K filed on 11 May 2026 that on 5 May 2026 the bank "became aware of an internal incident involving the handling of certain non-public customer information using an unauthorized artificial intelligence-based software application". Customer names, Social Security numbers and dates of birth were disclosed, and the company deemed the event material on 7 May because of the volume and sensitivity of the data. Executives later told American Banker that an employee uploaded the file from a personal device while mocking up a presentation, and that the bank reached the AI vendor in time to keep the data out of model training. The bank has not said how many customers were affected or which AI tool was used.

## Key facts

|  |  |
| --- | --- |
| Date | May 5, 2026 (disclosed May 11, 2026) |
| Institution | CB Financial Services, Inc. (Community Bank, Carmichaels, PA) |
| Country | United States |
| AI system | Unapproved third-party AI application used by an employee through a personal account (not named by the bank) |
| AI? | Described as AI by the institution or regulator — The institution, a regulator or a court called the system AI. |
| Category | Data leak to an LLM (Governance finding) |
| Status | Confirmed by the institution |
| Severity | 3 of 5 — Material harm under the rubric: the company itself classed the exposure of customer names, Social Security numbers and dates of birth as a material cybersecurity incident under Item 1.05; no financial loss, misuse or regulatory action has been reported. |

## What happened?

In an Item 1.05 (Material Cybersecurity Incidents) Form 8-K signed by president and chief executive John H. Montgomery and filed on 11 May 2026, CB Financial Services said that on 5 May its subsidiary Community Bank became aware of an internal incident in which non-public customer information was handled using "an unauthorized artificial intelligence-based software application". The filing said the incident did not disrupt the bank's operations, customer access to accounts, payment systems or core IT infrastructure, but that "due to the volume and sensitive nature of the non-public information at issue" the company determined on 7 May that the event was material. Customer names, Social Security numbers and dates of birth were among the information disclosed. [1]

The filing did not describe how the data left the bank or name the application. The Register, which first reported the filing, and TechCrunch both noted that the bank did not say how many customers were affected or which AI tool was involved; TechCrunch said the language suggested someone may have uploaded customer data to an online AI chatbot. [3][4]

In June 2026 Montgomery and chief operating officer Jennifer George gave American Banker more detail. According to the bank, an employee fed the data into an unapproved tool, using a personal account on a personal device, while mocking up a presentation, and "thought the sensitive data had been removed from the file". The bank said it already offered an approved AI tool with bank-issued accounts. George said the file and the surrounding prompts "were deleted immediately upon confirmation of upload", and Montgomery said there was no evidence the data was misused and that he believes the bank reached the vendor in time to stop it being used for model training. [6]

Law firm Wilson Sonsini described the filing as the first Form 8-K under Item 1.05 triggered by an unauthorized use of an AI tool rather than an external cyberattack, and American Banker said its own search of the SEC's full-text database found the phrase "unauthorized artificial intelligence" in only this one 8-K. [5][6]

## Timeline

- May 5, 2026 — Community Bank becomes aware that non-public customer information was handled using an unauthorized AI-based application. [1]
- May 7, 2026 — CB Financial Services determines the incident is material. [1]
- May 11, 2026 — CB Financial files the Item 1.05 Form 8-K with the SEC. [1][3]
- May 12, 2026 — The company's Q1 2026 Form 10-Q records the incident as a subsequent event and repeats that no material financial impact is expected. [2]
- Jun 8, 2026 — Executives tell American Banker an employee uploaded the file to an unapproved tool from a personal device, and describe the clean-up with the AI vendor. [6]

## What was the impact?

- Customers: Undisclosed number of Community Bank customers; names, Social Security numbers and dates of birth exposed to a third-party AI application
- Other: No operational disruption and no expected material financial impact, per the 8-K. The bank told American Banker there was no evidence the data was misused. No customer count, loss figure or regulator response has been published. [1][6]

## How did CB Financial Services, Inc. (Community Bank, Carmichaels, PA) respond?

In the 8-K the company said it "promptly took steps to secure the information", engaged external cybersecurity advisors, is notifying customers as federal and state law requires, is in communication with banking regulators, and is "strengthening existing controls, implementing additional controls and enhancing monitoring measures". Executives told American Banker the bank has since blocked the web domains of unapproved AI tools, tightened employee access to customer data and expanded its data-security policies; George called it "one single act by one single employee". [1][6]

## What was the outcome?

As of October 2026 no regulator action, fine or lawsuit tied to the incident has been reported, and the bank has not published the number of affected customers or the name of the AI application. The bank's investigation into scope and root cause was described as ongoing in the 8-K; no follow-up SEC filing on the incident was found after the 12 May 2026 Form 10-Q. [1][2]

## FAQ

### What did Community Bank's employee do with customer data?

According to CB Financial's executives, speaking to American Banker in June 2026, an employee uploaded a file of customer data to an unapproved AI tool from a personal device and personal account while mocking up a presentation, believing the sensitive fields had been removed. The 8-K itself says only that non-public customer information was handled using an unauthorized AI-based application.

### What customer data was exposed in the CB Financial AI incident?

The 8-K filed on 11 May 2026 says the information disclosed included customer names, Social Security numbers and dates of birth. The company has not said how many customers were affected, and neither the filing nor later interviews named the AI application that received the data.

### Was any money lost or customer data misused?

No loss or misuse has been reported. The 8-K says the incident did not disrupt operations, accounts or payment systems and was not expected to have a material financial impact, and the chief executive told American Banker there was no evidence the data had been misused.

### Did a regulator act on the Community Bank shadow-AI incident?

No public regulatory action had been reported as of October 2026. The company said in the 8-K that it was in communication with relevant banking and financial regulators and was notifying customers as federal and state law requires; those notices are not public.

### What did the bank change after the incident?

The 8-K promised stronger and additional controls and enhanced monitoring. Executives told American Banker the bank has blocked the web domains of unapproved AI tools, tightened employees' access to customer data and expanded its data-security policies, and is working with the AI company on the clean-up.

## Sources

1. [CB Financial Services, Inc. Form 8-K, Item 1.05 Material Cybersecurity Incidents](https://www.sec.gov/Archives/edgar/data/1605301/000160530126000021/cbfv-20260507.htm) — CB Financial Services, Inc. (SEC EDGAR), May 11, 2026 (official): "On May 5, 2026, Community Bank (the "Bank"), the wholly-owned subsidiary of CB Financial Services, Inc. (the "Company"), became aware of an internal incident involving the handling of certain non‑public customer information using an unauthorized artificial intelligence-based software application."
2. [CB Financial Services, Inc. Form 10-Q for the quarter ended March 31, 2026](https://www.sec.gov/Archives/edgar/data/1605301/000160530126000023/cbfv-20260331.htm) — CB Financial Services, Inc. (SEC EDGAR), May 12, 2026 (official): "Due to the volume and confidential nature of the information at issue, the event was determined to be material; however, the Company does not expect a material impact on its consolidated financial condition or results of operations."
3. [US bank reports itself after slinging customer data at 'unauthorized AI app'](https://www.theregister.com/security/2026/05/12/us-bank-reports-itself-after-ai-customer-data-mishap/5238787) — The Register, May 12, 2026 (news): "Community Bank did not specify what this "unauthorized AI-based software application" was or how it was used."
4. [US bank discloses security lapse after sharing customer data with AI app](https://techcrunch.com/2026/05/12/us-bank-discloses-security-lapse-after-sharing-customer-data-with-ai-app/) — TechCrunch, May 12, 2026 (news): "While Community Bank did not disclose how many customers were affected by the incident, nor what AI application was involved, the company said it is "evaluating the customer data that was affected" and is sending notifications in accordance with relevant laws."
5. ["Shadow AI" Triggers First SEC Form 8-K for Unauthorized AI Use: What Financial Institutions and Public Companies Need to Know](https://www.wsgr.com/en/insights/shadow-ai-triggers-first-sec-form-8-k-for-unauthorized-ai-use-what-financial-institutions-and-public-companies-need-to-know.html) — Wilson Sonsini Goodrich & Rosati, May 29, 2026 (news): "CB Financial Services, Inc. filed the first SEC Form 8-K under Item 1.05 triggered by an unauthorized use of an artificial intelligence (AI) tool, not an external cyberattack."
6. [A bank breaks its silence on its shadow-AI breach](https://www.americanbanker.com/news/a-bank-breaks-its-silence-on-its-shadow-ai-breach) — American Banker, Jun 8, 2026 (news): ""We acted swiftly to remediate the actions by accessing appropriate channels to limit the infiltration of data into the model," George said. "The file and all surrounding prompts were deleted immediately upon confirmation of upload.""

All AI incidents at banks: https://www.bankingnewsai.com/ai-incidents

---

Canonical page: https://www.bankingnewsai.com/ai-incidents/cb-financial-2026-shadow-ai-customer-data
Part of [BankingNewsAI](https://www.bankingnewsai.com/) — the register of AI incidents at banks: https://www.bankingnewsai.com/ai-incidents. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.