COMMUNITY TRUST BANCORP INC /KY/

ITEM 8.01 OTHER EVENTS On May 31, 2023 Progress Software Corporation published information related to a vulnerability in its software tool MOVEit Transfer (“MOVEit”). Community Trust Bancorp, Inc. (“CTBI”) does not use MOVEit on its internal networks. However, on Wednesday, August 9, 2023, CTBI received written notice from a third party prominent financial institution vendor that certain of CTBI’s customer data was potentially accessed due to the vendor’s utilization of MOVEit in its service offering to CTBI. Based on the investigation to date, including information provided from the vendor, CTBI’s customers could have had personal information copied through the cyberattack. The vendor confirmed that it implemented the recommended patches released by Progress Software Corporation for the MOVEit platform. CTBI worked with the vendor to determine the potentially impacted customers and the extent of information potentially exposed, and CTBI is notifying potentially affected customers appropriately. The incident did not impact the ongoing operations of CTBI, and CTBI carries cyber insurance which it expects to cover many of the costs related to the incident. FORWARD-LOOKING STATEMENTS This filing contains forward-looking statements made pursuant to the safe-harbor provisions of the Private Securities Litigation Reform Act of 1995. Such forward-looking statements can often, but not always, be identified by the use of words like “believe”, “continue”, “pattern”, “estimate”, “project”, “intend”, “anticipate”, “expect” and similar expressions or future or conditional verbs such as “will”, “would”, “should”, “could”, “might”, “can”, “may”, or similar expressions. These forward-looking statements include, but are not limited to, statements relating to the impact of the cybersecur