DisclosureLens
FEDERALItem 8.01 · voluntaryHackingFinancial ServicesFinanceSupply Chain (3P Vendor)Customer Data InvolvedGovernment IDIdentity (basic)Financial accountMediumActive

Somerset Regal Bank

bd_62f1c74b3269f35e · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Jul 10, 2026

To disclose

—

Affected

Not disclosed

Confidence

68%
Full breach record for Somerset Regal Bank →

SR Bancorp, Inc. (via its subsidiary Somerset Regal Bank) disclosed a data security incident involving its third-party internal audit provider, Mercadien, P.C. An unauthorized actor accessed files on Mercadien's servers containing customer data, including names, SSNs, account numbers, IDs, and dates of birth. The Bank's own systems were not impacted. Customer notifications are being provided.

Incident timeline — partial

? — ?

Breach window unknown

Jul 10, 2026

Filed

No interval is drawn: no breach start or discovery date is on record for this filing.

Part of Mercadien, P.C. supply-chain incident (2026) — a supply-chain cascade affecting multiple organizations.View cascade →
Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filing

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statementThis record

Unlocks: materiality, stated response, full audit trail. Ceiling removed.