BayFirst Financial Corp.

BayFirst Financial Corp. notified SEC Form 8-K on Oct 30, 2025 of a data breach, which occurred on Aug 14, 2025. Data exposed: Social Security number, Financial / bank account, Date of birth, Tax ID / EIN / ITIN, Name.

Case file (dates, days to notice against the statute, what the letter offers, prior incidents)

Organization: BayFirst Financial Corp.
Source: SEC Form 8-K · source record
Date reported: Oct 30, 2025
Date(s) of breach: August 14, 2025
Residents affected: Not published by this source
Data exposed: Social Security number Financial / bank account Date of birth Tax ID / EIN / ITIN Name
Notice letter: Form 8-K filing
Discovered: Aug 14, 2025, as stated in the letter
"Cybersecurity Incidents On August 14, 2025, BayFirst National Bank (“BayFirst”) was notified of a cybersecurity incident experienced by a third-party provider of marketing services."
Days to notice: 77 days from discovery (Aug 14, 2025) to the Federal (SEC) record (Oct 30, 2025).
Third party: The letter attributes the incident to a vendor or service provider
First seen by BreachTally: 2026-11-12 23:16 UTC
Ticker: BAFN

Dates and counts as filed by the organization with the agency. The breach window and the report date often differ by months.

Item 1.05 excerpt

Item 1.05. Cybersecurity Incidents On August 14, 2025, BayFirst National Bank (“BayFirst”) was notified of a cybersecurity incident experienced by a third-party provider of marketing services. On October 28, 2025, the third-party provider confirmed that some customer information was exposed by this incident. Upon learning of the incident, the third-party provider immediately launched an investigation, worked with BayFirst to understand the scope of the issue, and engaged the appropriate cybersecurity experts to assist. The third-party provider also promptly notified law enforcement. The incident was limited to the third-party provider’s environment. Based on the information available to date, personal information, including name, date of birth, and social security/tax identification numbers of some BayFirst customers were accessed without authorization. To date, there is no evidence of the misuse, or attempted misuse, of personal information as a result of this incident. Impacted customers will be notified directly of this incident. BayFirst cannot quantify any material impact to its financial condition or operations, at this time.

Data reproduced from a public government filing. Spot an error? Email support@breachtally.com with the record link. Corrections are applied and noted.