Orrstown Bank Data Breach Notice (Indiana Attorney General): What Was Exposed & What To Do

Orrstown Bank notified Indiana residents of a data breach in a filing reported to the Indiana Attorney General on June 11, 2026. The filing places the incident itself on September 17, 2025, and states that 40 people were affected. The notice describes the exposed material as personal information.

For those whose records may be involved, the practical stakes are straightforward: personal information held by a bank can be reused for identity misuse, account-related fraud, or targeted social engineering. Public detail beyond the filing is limited, so the confirmed picture is narrow—date of the incident, date of the state report, a small affected count, and a general category of data—rather than a full technical narrative.

Inside the incident

According to the Indiana Attorney General filing associated with the Orrstown Bank Data Breach Notice, the bank reported the matter on June 11, 2026. That filing identifies September 17, 2025, as the date of the incident and lists 40 people as affected. The notification characterizes the exposed data as personal information.

The public record provided here does not describe how the incident was detected, whether systems were encrypted or exfiltrated, what specific systems were involved, or how long unauthorized access lasted. Method, root cause, and technical scope are undisclosed in the facts available for this account. What is established is the regulatory notice path: a bank filing with the Indiana Attorney General that ties a September 2025 incident to a June 2026 report and a defined headcount of 40.

No threat group is attributed in the disclosure materials summarized here. Any broader claims about who was responsible, or about listings on leak sites, are not part of the given facts and are not asserted in this article.

How a breach like this happens

In general terms—not as a description of this specific case—incidents that lead banks to send breach notices often follow familiar patterns. An attacker may obtain valid credentials through phishing or reused passwords, exploit an unpatched remote service, or abuse a compromised vendor connection. Once inside, the activity can include searching file shares, customer databases, or document repositories for records that contain names and other personal fields.

Sometimes the path is simpler: a misdirected email, an exposed cloud storage bucket, or a laptop or backup media that was not adequately protected. In other cases, malware on a workstation leads to wider network access. Organizations typically investigate logs, isolate affected systems, and determine which individuals’ records were accessed or acquired before notifying regulators and residents when state law requires it.

None of these general patterns is confirmed as the mechanism in the Orrstown Bank filing summarized here. They are background only, to explain why “personal information” notices appear even when technical detail remains limited in public summaries.

About Orrstown Bank

Orrstown Bank is a banking organization. Institutions in this sector routinely maintain customer and prospect records needed to open accounts, process loans, meet know-your-customer obligations, and communicate about products and services. That work commonly involves names, contact details, government identifiers, account-related data, and other personal fields held under regulatory and contractual duties of care.

A breach notice from a bank matters because the same records that support legitimate banking can, if misused, help someone impersonate a customer, attempt account takeover, or craft convincing fraud. Even when the number of people named in a filing is relatively small—as with the 40 individuals referenced here—the sensitivity of banking-related personal information keeps the consequences individual and concrete rather than abstract.

What data was at risk

The breach notification, as reflected in the facts, names the exposed category as personal information. It does not itemize fields such as Social Security numbers, driver’s license numbers, account numbers, or full financial statements in the material provided for this article. Exact contents beyond that general label are therefore unconfirmed in the public summary used here.

Banks of this kind typically hold identity and contact data, authentication-related information, and account or application records. That is sector background, not a claim that any particular field was proven exposed in this incident. Readers should treat only “personal information,” as stated in the notice, as the disclosed description.

Why it matters

For affected people, the real-world risk is misuse of personal information: fraudulent applications in someone else’s name, social-engineering calls that reference real details, or attempts to reset online access. With only 40 people listed in the filing, the scale is limited compared with mass retail breaches, but impact is still personal for each individual whose record was involved.

For the organization, consequences include notification costs, regulatory scrutiny, customer support load, and the need to harden controls after the fact. The gap between the September 17, 2025 incident date and the June 11, 2026 report date is part of the public timeline; reasons for that interval are not explained in the facts given here and should not be assumed.

Because no detailed technical findings are in the provided record, people who receive or expect a notice should rely on the bank’s official communication for individualized guidance rather than on incomplete secondary summaries.

Were you affected?

If you are an Indiana resident who has banked with Orrstown Bank, watch for an official notice and follow the steps it provides. Practical first moves, in plain terms, include:

• Read any letter or email from the bank carefully and keep a copy; use only contact channels it lists or that you already trust from prior banking relationships.
• Monitor account statements and credit reports for unfamiliar activity; consider a fraud alert if the notice recommends it or if you see suspicious inquiries.
• Treat unexpected calls or messages that cite the breach as potential social engineering until you verify the caller through official bank channels.
• Update passwords on banking and email accounts, and enable multi-factor authentication where available.
• Document dates and reference numbers from any notice in case you need them later for disputes.

Public detail on this incident remains limited to the Attorney General filing facts: incident date September 17, 2025; report date June 11, 2026; 40 people affected; data described as personal information. You can also run a free exposure scan of your email to check whether your information has surfaced in known breach data, which can complement—but not replace—the bank’s own notification and advice.

AICompiled with AI assistance from public sources and published under our editorial standards.