{"schema_version":"0.10.0","id":"LR-2026-0605","record_version":1,"title":"Community bank discloses shadow AI data exposure","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":46.5,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":6.08,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"Publisher not yet named · subject to change","original_document":null,"reports_total":1,"reports_independent":0,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"Publisher not yet named · subject to change"}]},"sources_hash":"0ff2c6a6d6663fabfa4c0d47c4ca86006f8e64db52ac8d51a5f18fcf770821ef"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-06-08","incident_class":"privacy_leakage","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"An employee at CB Financial Services' Community Bank in Pennsylvania used an unapproved AI application while mocking up a presentation and entered customer information. The data included customer names, Social Security numbers and dates of birth. The upload was made from a personal device through a fully authenticated channel, and the bank says no threat actor was involved. The bank said it found out on May 5, decided the matter was material, and filed a Form 8-K on May 11. It brought in outside cybersecurity advisors and communicated with regulators, and it says the file and surrounding prompts were deleted after confirmation of upload. Afterward the bank blocked the web domains of unapproved AI tools, tightened employee access to customer data and expanded its data-security policies.","tags":["shadow-ai"],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":"deployer","adversarial_actor":"none","input_provenance":null,"time_to_contain":null,"operations_paused":"no interruption to operations","remediation":"File and surrounding prompts deleted; unapproved AI domains blocked","precursor_events":null,"primary_risk":"RK04","control_chain":[{"layer":"L2","party":"harness_vendor","party_name":null,"control_id":"A6","outcome":"got_around","reason":null,"quote":"The employee instead turned to a tool the bank had not approved, using a personal account.","source_index":0,"reviewed":false}],"remediations":[{"by":null,"kind":"fix","date_reported":null,"controls_added":["A6"],"quote":"Since the incident, the bank has blocked the web domains of unapproved AI tools and is working with the AI company on the cleanup, according to Montgomery.","source_index":0,"reviewed":false}]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"Test: a regulator involved. The filing states the company has been in communication with relevant banking and financial regulators.","harm_class":["privacy"],"affected_description":"Customers whose names, Social Security numbers and dates of birth were exposed","protected_class_involved":null,"data_categories_exposed":["customer names","Social Security numbers","dates of birth"],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.americanbanker.com/news/a-bank-breaks-its-silence-on-its-shadow-ai-breach","publisher":"American Banker","date":"2026-06-08","type":"press","title":"A bank breaks its silence on its shadow-AI breach - American Banker","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"event.incident_class":"C","event.responsible_party":"C","event.adversarial_actor":"C","event.operations_paused":"C","event.remediation":"C","event.tags":"C","impact.harm_class":"C","impact.data_categories_exposed":"C","impact.affected_description":"C","context.industry":"C","context.country":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.control_chain":"C","event.remediations":"C","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"event.incident_class":[{"source_index":0,"quote":"A community bank disclosed a material cybersecurity incident caused not by a hacker but by its own employee feeding customer data into an unauthorized AI tool."}],"event.responsible_party":[{"source_index":0,"quote":"An employee at a Pennsylvania community bank fed customer data into an unapproved AI app."}],"event.adversarial_actor":[{"source_index":0,"quote":"No threat actor broke in, and CB Financial said in its May filing that it expects the incident to have no material impact on its finances."}],"event.operations_paused":[{"source_index":0,"quote":"There was no hacker involved in the incident, and the bank's operations experienced no interruptions."}],"event.remediation":[{"source_index":0,"quote":"The file and all surrounding prompts were deleted immediately upon confirmation of upload."}],"event.tags":[{"source_index":0,"quote":"Wilson Sonsini Goodrich & Rosati calls it the first 8-K to blame a material cybersecurity incident on \"shadow AI,\" meaning AI tools that employees use without their employer's approval."}],"impact.harm_class":[{"source_index":0,"quote":"The data the employee exposed included customers' names, Social Security numbers and dates of birth, CB Financial Services disclosed last month in a filing to the U.S. Securities and Exchange Commission."}],"impact.data_categories_exposed":[{"source_index":0,"quote":"The data the employee exposed included customers' names, Social Security numbers and dates of birth, CB Financial Services disclosed last month in a filing to the U.S. Securities and Exchange Commission."}],"impact.affected_description":[{"source_index":0,"quote":"The data the employee exposed included customers' names, Social Security numbers and dates of birth, CB Financial Services disclosed last month in a filing to the U.S. Securities and Exchange Commission."}],"context.industry":[{"source_index":0,"quote":"A community bank disclosed a material cybersecurity incident caused not by a hacker but by its own employee feeding customer data into an unauthorized AI tool."}],"context.country":[{"source_index":0,"quote":"The data the employee exposed included customers' names, Social Security numbers and dates of birth, CB Financial Services disclosed last month in a filing to the U.S. Securities and Exchange Commission."}],"impact.severity":[{"source_index":0,"quote":"The company said in the filing that it brought in outside cybersecurity advisors and has been \"in communication with relevant banking and financial regulators.\""}],"impact.severity_because":[{"source_index":0,"quote":"The company said in the filing that it brought in outside cybersecurity advisors and has been \"in communication with relevant banking and financial regulators.\""}],"event.control_chain":[{"source_index":0,"quote":"The employee instead turned to a tool the bank had not approved, using a personal account."}],"event.remediations":[{"source_index":0,"quote":"Since the incident, the bank has blocked the web domains of unapproved AI tools and is working with the AI company on the cleanup, according to Montgomery."}],"event.summary":[{"source_index":0,"quote":"An employee at a Pennsylvania community bank fed customer data into an unapproved AI app."},{"source_index":0,"quote":"The employee fed the data into the unapproved tool while mocking up a presentation, Montgomery told American Banker."},{"source_index":0,"quote":"The data the employee exposed included customers' names, Social Security numbers and dates of birth, CB Financial Services disclosed last month in a filing to the U.S. Securities and Exchange Commission."},{"source_index":0,"quote":"\"He accessed it from a personal device through a fully authenticated channel,\" George told American Banker."},{"source_index":0,"quote":"No threat actor broke in, and CB Financial said in its May filing that it expects the incident to have no material impact on its finances."},{"source_index":0,"quote":"Community Bank found out about the incident on May 5."},{"source_index":0,"quote":"CB Financial, the parent company of Community Bank, filed it as a Form 8-K on May 11."},{"source_index":0,"quote":"The file and all surrounding prompts were deleted immediately upon confirmation of upload."},{"source_index":0,"quote":"The bank has also tightened employees' access to customer data and expanded its data-security policies, George said."}]},"notes_on_gaps":"Only one source (American Banker, press) was given. It quotes the bank's filing and its executives; the bank has not named the AI application, the number of customers affected, the upload date or time, or how the upload was detected, so those are omitted. Sources give month and day only (May 5, May 7, May 11); the year is not stated in the quoted sentences and is omitted rather than inferred, so event dates are blank. The system is not described beyond an unapproved AI application; no model, developer, harness, autonomy or agent facts are stated, so system fields are omitted and failure_class is omitted because no autonomous agent is stated. Severity is major by judgement that a regulator is involved (the filing says the bank is in communication with regulators); the bank also reports notifying customers, but no bounded scope count is stated. Reversibility is not stated and is left out. The data-loss-prevention policies are mentioned, but the sources do not say they failed or held for the browser upload, so no DLP control is linked. The 36-hour rule and Gramm-Leach-Bliley duties are general background from the article, not facts the bank stated about its own notices, and the article says it is unclear whether these were met. The detection method is not stated. Tags and the shadow_ai label are the editor's characterisation drawn from the article. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (Publisher not yet named · subject to change)]"},"context":{"industry":"banking","org_size_band":null,"country":"US","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"An employee fed customer data into an unapproved AI tool while mocking up a presentation.","quote":"The employee fed the data into the unapproved tool while mocking up a presentation, Montgomery told American Banker.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"The employee believed the sensitive data had been removed from the file before the upload.","quote":"The employee \"thought the sensitive data had been removed from the file,\" George said.","source_index":0,"grade":"C"},{"step":"reached","text":"The bank believes it reached the AI vendor in time to stop the data being used to train the vendor's model.","quote":"Because the bank caught the upload early, Montgomery believes CB reached the AI vendor in time to stop the customer information from being used to train the vendor's model.","source_index":0,"grade":"C"},{"step":"caught","text":"The bank found out about the incident on May 5.","quote":"Community Bank found out about the incident on May 5.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.americanbanker.com/news/a-bank-breaks-its-silence-on-its-shadow-ai-breach"]},"analysis":{"sections":{"timeline":[{"text":"The bank already offered an approved AI tool to cleared employees before the incident.","quote":"The bank already offered an approved AI tool, with bank-issued accounts for employees cleared to use it, Montgomery said.","source_index":0,"when":null},{"text":"The bank found out about the incident.","quote":"Community Bank found out about the incident on May 5.","source_index":0,"when":"May 5"},{"text":"The company decided the incident was material.","quote":"Two days later, on May 7, the company decided it was material.","source_index":0,"when":"May 7"},{"text":"CB Financial filed a Form 8-K disclosing the incident.","quote":"CB Financial, the parent company of Community Bank, filed it as a Form 8-K on May 11.","source_index":0,"when":"May 11"},{"text":"The file and surrounding prompts were deleted after upload was confirmed.","quote":"The file and all surrounding prompts were deleted immediately upon confirmation of upload.","source_index":0,"when":null},{"text":"After the incident the bank blocked unapproved AI tool domains and worked with the AI company on cleanup.","quote":"Since the incident, the bank has blocked the web domains of unapproved AI tools and is working with the AI company on the cleanup, according to Montgomery.","source_index":0,"when":null},{"text":"After the incident the bank tightened employee access to customer data and expanded data-security policies.","quote":"The bank has also tightened employees' access to customer data and expanded its data-security policies, George said.","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.americanbanker.com/news/a-bank-breaks-its-silence-on-its-shadow-ai-breach"]}}