Orrstown Financial Reports Data Breach via Third-Party Vendor

• •Orrstown Financial reported a data breach involving a third-party vendor on May 21, 2026.
• •Unauthorized access to sensitive customer data occurred, but Orrstown's systems were not affected.
• •A class action lawsuit is being considered for those impacted by the breach.

On May 21, 2026, Orrstown Financial was notified of a cybersecurity breach involving a third-party vendor that led to unauthorized access to sensitive personal data of some customers. The company confirmed that its own systems were not compromised. Following the incident, Orrstown Financial is investigating the breach and has committed to notifying affected customers, offering credit monitoring services as a precaution. The breach has raised concerns about the vulnerabilities associated with third-party relationships in the financial sector. Attorneys are exploring the possibility of a class action lawsuit for those impacted by the data exposure. Specific details about the type of data compromised have not yet been disclosed. Orrstown operates as a financial holding company primarily engaged in community banking across Pennsylvania and Maryland.