FEDERALItem 1.05 · mandatoryMisuseFinancial ServicesFinanceData MishandlingCustomer Data InvolvedDelayed DiscoveryGovernment IDIdentity (basic)MediumActive

Community Bank

bd_b0e702a4e9849ffd · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 5, 2026

Filed

May 11, 2026

To disclose

6 days

Affected

Not disclosed

Confidence

66%

CB Financial Services, Inc. (via subsidiary Community Bank) disclosed a material cybersecurity incident on May 7, 2026. On May 5, 2026, the Bank became aware of an internal incident involving the unauthorized use of AI-based software to handle non-public customer information, specifically names, SSNs, and dates of birth. The incident did not disrupt operations but is material due to the sensitive data volume. The investigation is ongoing, and the Company is notifying regulators and affected individuals.

J jump to incidentP pin to compareR raw source

SEC clockMateriality determined May 7, 2026 → Filed May 11, 20264d ✓ SEC 4-day OK6 days discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 6 days

May 5, 2026

Begins

May 5, 2026

Discovered

May 7, 2026

Scope determined

May 11, 2026

Filed

vs. sector median

8 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: CB Financial Services, Inc.
norm: cb financial
SEC CIK: 0001605301

Name: Community Bank
norm: community bank
Industry: Financial Servicesllm

Discovered: May 5, 2026
Breach occurred: May 5, 2026
Undetected for: 0 daysoccurrence → discovery
Materiality determined: May 7, 2026
Notification sent: May 7, 2026
Affected individuals: Not disclosed
Data types: Government IDIdentity (basic)
Attack vector: Insider
MITRE ATT&CK: T1119 Automated Collection
Threat actor: Internal
Initial access: insider_action

During the incident: Took steps to secure the information at issue
Initiated an internal investigation with the assistance of external cybersecurity advisors
Conducting notifications as required by applicable federal and state laws and regulatory guidance
In communication with relevant banking and financial regulators
Strengthening existing controls
Implementing additional controls
Enhancing monitoring measures
Changes made: Strengthening existing controls
Implementing additional controls
Enhancing monitoring measures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 days(6 days from discovery to filing)
Compliance flags: SEC 4-day OK · 4d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
SEC
Materiality determined: May 7, 2026
→ Filed: May 11, 2026
4d cal. 4 business days SEC 4-day OK

Statute	Window	Elapsed	Threshold	Status
SEC	Materiality determined: May 7, 2026 → Filed: May 11, 2026	4d cal.	4 business days	SEC 4-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filing

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statementThis record

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.sec.gov/Archives/edgar/data/1605301/000160530126000021/cbfv-20260507.htm
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: May 11, 2026
Raw hash: 75fa77dee817a423c73817c0a8b35c5f121865d8d1ad68c5328b47426b405b2d

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html31.1 KB

Download View at source

Reporting entityCB Financial Services, Inc.

Victim entityCommunity Bank

Incidentdiscovered May 5, 2026

Stated responseTook steps to secure the information at issue

ComplianceSEC 4-day OK

Extraction provenanceno artifact recorded

Source provenancewww.sec.gov

Source filing