HackingFinancial ServicesFinanceSupply Chain (3P Vendor)Customer Data InvolvedFinancial accountIdentity (basic)Government IDMediumContained

Orrstown Bank

bd_2c51137b20d238be · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 21, 2026

Filed

Jun 11, 2026

To disclose

21 days

Affected

68state residents only

Linked

5 filings

Confidence

67%

Full breach record for Orrstown Bank →2 incidents on file

Orrstown Bank notified Massachusetts residents of a data security incident involving its third-party advisor, Mercadien, P.C. The incident, discovered on or about May 21, 2026, potentially exposed personal information including names, dates of birth, SSNs, account numbers, and government IDs. No evidence of misuse was found. The Bank provided 24 months of free credit monitoring via Experian IdentityWorks.

J jump to incidentP pin to compareR raw source

Massachusetts clock✓ MA AG ≤30d21 days discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 21 days

May 21, 2026

Discovered

Jun 11, 2026

Filed

vs. sector median

5 wks faster

This filing is one of 5 filings about the same incident.View merged incident

Part of Mercadien, P.C. supply-chain incident (2026) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Indiana State AGbd_ad55cfde4c9662f52026-06-11Verified by operator
Maine State AGbd_c06d97bcd6201e962026-06-11Candidate
Vermont State AGbd_9c592a5b5bce08e72026-06-12 · +1dVerified by operator
New Hampshire State AGbd_982b58c02c6fe7d92026-06-15 · +4dVerified by operator

Name: Orrstown Bank
norm: orrstown bank
Domain: orrstown.com

Name: Orrstown Bank
norm: orrstown bank
Industry: Financial Servicesllm

Discovered: May 21, 2026
Materiality determined: —
Notification sent: —
Affected individuals: 68state-resident count only
Data types: Financial accountIdentity (basic)Government ID
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain Compromise
Threat actor: External
Third party: via Mercadien, P.C.
Initial access: supply_chain

During the incident: Provided notice to affected individuals
Provided access to free credit monitoring through Experian IdentityWorks for 24 months
Changes made: Continuing to evaluate measures to prevent a similar event from occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 days(21 days from discovery to filing)
Compliance flags: MA AG ≤30d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 5 states

View merged incident ↗

Indiana State AGJun 11 · first

Maine State AGJun 11 · first

Massachusetts State AGJun 11 · first · this page

Vermont State AG+1d

New Hampshire State AG+4d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.mass.gov/doc/2026-961-orrstown-bank/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 11, 2026
Raw hash: 641b1f2cbd23ae2e566659492ef918c0c656c4b9720c1daa0561f1797a370858

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityOrrstown Bank

Victim entityOrrstown Bank

Incidentdiscovered May 21, 2026

Stated responseProvided notice to affected individuals

ComplianceMA AG ≤30d

Extraction provenanceno artifact recorded

Source provenancewww.mass.gov