Orrstown Bank, a financial institution providing banking and wealth management services, officially reported a security incident to the Maine Attorney General's office on June 11, 2026. This report confirms that sensitive data belonging to its clients was exposed, raising significant concerns among those affected.
The compromised information includes Full Name, Social Security Number, Financial Account Number, Date of Birth, Routing Number, Credit Score Information, Transaction History, and Mailing Address. The exposure of these detailed data categories puts individuals at an elevated risk of financial fraud, unauthorized account takeovers, and other forms of identity-related crimes.
Specifically, the leak of Financial Account Numbers and Social Security Numbers is particularly severe. Bad actors can leverage such data for an extended period to open new fraudulent accounts, drain existing savings, or intercept tax refunds, often without immediate detection by the victim. This ongoing threat requires continuous monitoring.
Financial institutions like Orrstown Bank are under strict legal obligations, such as the Gramm-Leach-Bliley Act (GLBA), to implement robust safeguards for customer nonpublic personal information. A data breach of this scope suggests potential failures in these foundational security requirements, which could indicate a lack of due care in protecting client data.
If you have received a data breach notification letter from Orrstown Bank, it serves as formal acknowledgment that your private financial information was compromised.
Individuals who received a notification letter should review the letter carefully, monitor their financial accounts and credit reports for suspicious activity, and consider their legal options. Our firm offers free case evaluations to help victims understand their rights and potential for legal recourse following such an event.
Holding financial institutions accountable for security lapses is crucial for maintaining consumer trust and ensuring the highest standards of data protection. Exploring legal action can contribute to these efforts, compelling companies to invest more robustly in cybersecurity measures.