DisclosureLens
FEDERALItem 1.05 · mandatoryThird-Party / Supply ChainFinancial ServicesFinanceSupply Chain (3P Vendor)Customer Data InvolvedDelayed DiscoveryPIIIdentity (basic)Government IDMediumActive

BayFirst National Bank

bd_87c2682fd28511f5 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 14, 2025

Filed

Oct 30, 2025

To disclose

11 weeks

Affected

Not disclosed

Confidence

78%
Full breach record for BayFirst National Bank →

BayFirst National Bank, a subsidiary of BayFirst Financial Corp., disclosed in a Form 8-K Item 1.05 that on August 14, 2025 it was notified of a cybersecurity incident at a third-party marketing services provider. On October 28, 2025, the provider confirmed that personal information of some BayFirst customers — including names, dates of birth, and Social Security/tax identification numbers — was accessed without authorization. The incident was limited to the third-party provider's environment. Financial impact has not been quantified.

SEC clockMateriality determined Oct 28, 2025 → Filed Oct 30, 20252d ✓ SEC 4-day OK11 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 11 weeks / 77 days

Aug 14, 2025

Discovered

Oct 28, 2025

Scope determined

Oct 30, 2025

Filed

vs. sector median

+2 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filing

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statementThis record

Unlocks: materiality, stated response, full audit trail. Ceiling removed.