Community Bank exposed customer data via unauthorized AI application
Community Bank disclosed that customer personal data including names, dates of birth, and Social Security numbers were exposed when a bank employee uploaded them to an unauthorized AI-based software application. The bank filed an 8-K with the SEC in May 2026 but did not disclose the number of affected customers or identify the specific AI tool used.
What happened
Community Bank, which operates in Pennsylvania, Ohio, and West Virginia, disclosed in an 8-K SEC filing dated May 7, 2026 that it detected exposure of customers' personal data due to the use of an unauthorized artificial intelligence-based software application.
Based on available reporting, a bank employee uploaded customer data to an online AI application, potentially exposing that information to the AI system and its provider.
Reported impact
The exposure included customers' names, dates of birth, and Social Security numbers.
The bank said it disclosed the incident due to the volume and sensitive nature of the non-public information at issue. The bank did not disclose how many customers were affected or identify the specific AI application involved.
Index analysis
The incident reflects a shadow IT security problem where employees bypass official channels and use consumer AI tools that may use uploaded data for training, creating security blind spots.
Governance controls
Community Bank is evaluating the customer data that was affected and is sending notifications in accordance with relevant laws.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.