Orrstown Bank

Orrstown Bank notified the New Hampshire Attorney General on June 11, 2026, of a data security incident involving its third-party vendor, Mercadien, P.C. CPAs. On May 21, 2026, Mercadien experienced unauthorized access to sensitive personal information belonging to 19 New Hampshire residents. Orrstown's own systems were not compromised. The incident involved names, dates of birth, addresses, SSNs, account numbers, and government IDs. No misuse has been identified. Orrstown offered 24 months of identity theft protection via Experian.

Orrstown Bank reported a data breach to the Vermont Attorney General. The breach was reported to the AGO on 2026-06-12. The reporting organization type is Financial Services. 11 Vermont residents were affected. Categories of data breached: Social Security Numbers, Government ID Numbers, Financial Account Codes, Credit and Debit Account Info.

Orrstown Bank notified Massachusetts residents of a data security incident involving its third-party advisor, Mercadien, P.C. The incident, discovered on or about May 21, 2026, potentially exposed personal information including names, dates of birth, SSNs, account numbers, and government IDs. No evidence of misuse was found. The Bank provided 24 months of free credit monitoring via Experian IdentityWorks.

Orrstown Bank reported a data breach to the Indiana Attorney General. The breach occurred on 2025-09-17 and was reported on 2026-06-11. 40 Indiana residents were affected. 83,938 individuals affected in total.

Orrstown Bank reported a third-party data breach involving its advisory services provider, Mercadien, P.C. The incident, occurring on September 17, 2025, and discovered on May 21, 2026, affected approximately 83,938 individuals, including 16 Maine residents. Compromised data included names, dates of birth, SSNs, account numbers, and government IDs. Orrstown Bank notified affected individuals on June 11, 2026, and provided 24 months of credit monitoring via Experian.

Orrstown Bank notified Montana AG of a phishing incident affecting two employees' email accounts starting Oct 2, 2017. Detected July 19, 2018. Incident compromised employee credentials and potentially customer PII. Bank reset passwords, engaged forensic experts, notified law enforcement, and provided 2 years of Kroll identity monitoring to affected individuals.

Orrstown Bank reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2018-08-28. 21 Massachusetts residents were affected. The report records the breach type as electronic.