US bank reported customer SSNs entered into an unauthorized AI app
What happened
Community Bank disclosed in an SEC filing that customer names, dates of birth and Social Security numbers had been entered into an unapproved AI application. The bank opened an investigation and notified regulators.
Community Bank, a subsidiary of CB Financial Services serving southwestern Pennsylvania, Ohio and West Virginia, told the US Securities and Exchange Commission that on 5 May 2026 it became aware of an internal incident in which non-public customer information had been handled using an AI-based software application the bank had not approved. Press reports based on the filing describe an employee putting customer data into an outside AI tool, which would expose it to that tool's provider. The data included names, dates of birth and Social Security numbers. The bank did not name the application or say how many customers were affected, and said there was no disruption to its operations, customer accounts or systems. It judged the incident material on 7 May because of the volume and sensitivity of the information.
How it happened
Supply chain and access: Shadow AI. Staff put sensitive data into an AI tool their organization had not approved.
Sources do not say whose AI model was involved. The product type was AI-powered app.
Impact
Data was exposed. Data involved: personal data and financial. The impact was confined to one organization and its users or customers.
Severity is rated High, calculated from how far the incident reached and how sensitive the data was.
Was the AI at fault?
No. The failure was in the systems, settings or people around the AI, not in the model's behaviour.
Status and timeline
Confirmed by the affected organization, the AI vendor, a regulator or a named security research firm.
It became public on 11 May 2026.
The bank secured the information, opened an investigation with outside cybersecurity advisers, filed a Form 8-K and began notifying affected customers and regulators as required by law. Law firms have since announced investigations into possible claims.