U.S. bank disclose security lapse after sharing customer data with AI app

Community Bank, a regional financial institution operating across Pennsylvania, Ohio, and West Virginia, disclosed a cybersecurity incident involving the potential exposure of customer data through the use of an unauthorized AI software application, according to an 8-K filing with the U.S. Securities and Exchange Commission.

The bank stated that it detected an exposure of sensitive customer information, including names, dates of birth, and Social Security numbers, due to the use of an unapproved AI-based software. The incident was identified in a filing dated May 7, and the bank has begun evaluating the extent of the data affected. It is not yet clear how many customers were impacted or what specific AI application was involved.

Community Bank indicated it is in the process of notifying affected customers and is complying with relevant legal requirements. The bank did not provide details on how the breach occurred but suggested that an employee may have uploaded customer data to an online AI chatbot, potentially exposing that information to the AI provider.

Why It Matters

This incident underscores the cybersecurity risks associated with AI tools in financial institutions, especially when proper controls are not in place. It highlights the potential for sensitive customer data to be inadvertently shared or misused, which can lead to identity theft, fraud, and loss of customer trust. The breach also raises questions about how banks manage third-party AI applications and data security protocols.

Background

Community Bank’s disclosure follows a broader industry trend of increasing AI adoption in banking and finance, often without comprehensive security measures. Similar incidents involving data sharing with AI platforms have been reported in recent months, prompting regulators and industry leaders to reconsider AI governance and cybersecurity standards. The bank’s incident is among the latest in a series of security lapses linked to AI misuse or misconfiguration.

“We are actively investigating the incident and are committed to protecting our customers’ information.”

— Community Bank CEO John Montgomery

“The bank detected an exposure of non-public customer information due to the use of unauthorized AI software.”

— SEC filing

What Remains Unclear

It remains unclear how many customers were affected, which specific AI application was involved, and whether the breach was due to human error, technical failure, or malicious intent. Details about the extent of the data exposure and the full scope of the incident are still emerging.

What’s Next

Community Bank is expected to complete its evaluation of the affected data and notify all impacted customers. Regulatory agencies may investigate the incident further, and the bank may implement new security protocols for AI tool usage. Industry-wide, there could be increased scrutiny on AI security practices in financial services.

Key Questions

What exactly happened in this security breach?

The bank detected that customer data, including names, dates of birth, and Social Security numbers, was potentially shared through an unauthorized AI application, though details are still being clarified.

How many customers were affected?

The number of affected customers has not been disclosed; the bank is still assessing the scope of the incident.

What AI application was involved?

The specific AI software involved has not been publicly identified, and investigations are ongoing.

Could this happen again?

While the bank is reviewing its controls, the incident highlights the need for stricter AI security measures across the industry to prevent similar breaches.