Business Context and Reporting Period
Orrstown Financial Services, Inc. (ORRF) filed a Current Report on Form 8-K dated May 29, 2026. The filing addresses two primary events: the scheduled redemption of outstanding subordinated notes and a cybersecurity incident involving a third-party vendor.
Key Financial Metrics and Events
- Debt Redemption: The Company will redeem $31,000,000 of 4.5% Fixed-to-Floating Rate Subordinated Notes due 2030 on June 30, 2026.
- Redemption Price: 100% of the principal amount plus accrued and unpaid interest up to, but excluding, the redemption date.
- Interest Rate: As of March 31, 2026, the interest rate on these Notes was 7.72%.
- Origin: The Notes were assumed following the merger with Codorus Valley Bancorp, Inc. on July 1, 2024.
Material Changes and Unusual Items
Cybersecurity Incident
On May 21, 2026, the Company was notified of a cybersecurity incident at a third-party vendor that resulted in unauthorized access to sensitive personal information of certain customers. The Company is one of several organizations affected.
- Impact on Systems: The Company's internal information systems and networks were not accessed, compromised, or affected.
- Data Misuse: There is currently no indication that customer information has been misused.
- Customer Action: Impacted customers will be notified and offered credit monitoring services.
- Financial Impact: Management states the incident has not had and is not expected to have a material impact on operations, financial condition, or results of operations.
Guidance, Outlook, and Risks
The filing includes a cautionary note regarding forward-looking statements. While management does not currently anticipate material financial impact from the cybersecurity incident, they highlight potential risks including:
- Legal, reputational, and financial risks arising from the incident.
- Potential regulatory inquiries or litigation.
- Costs incurred in connection with the incident response.
No specific financial guidance or outlook regarding future earnings or revenue was provided in this filing.
Investor Verification Checklist
- Verify the exact redemption date (June 30, 2026) and the final accrued interest calculation for the $31 million Notes.
- Monitor future filings for updates on the scope of the third-party vendor cybersecurity incident and any resulting litigation or regulatory fines.
- Confirm the status of customer notifications and credit monitoring enrollment related to the data breach.
- Review the Company's next quarterly report (10-Q) to confirm the absence of material financial impact from the incident as projected.