SEC Form 8-K Item 1.05 (material cybersecurity incidents) Primary notice
Disclosed in an 8-K filed Oct. 30, 2025, on SEC EDGAR.
- Organization as reported
- BayFirst Financial Corp., FL
- Category as reported
Item 1.05 Material Cybersecurity Incidents
- Notice date as reported
- Oct. 28, 2025
- Filing date
- Oct. 30, 2025
- Observed by BreachRecords
- 2026-10-18 20:33 UTC (revision 8082, doc:bafn-20251028.htm)
- Archived copy
- Held in the private archive (provenance)
Cybersecurity Incidents On August 14, 2025, BayFirst National Bank (“BayFirst”) was notified of a cybersecurity incident experienced by a third-party provider of marketing services. On October 28, 2025, the third-party provider confirmed that some customer information was exposed by this incident. Upon learning of the incident, the third-party provider immediately launched an investigation, worked with BayFirst to understand the scope of the issue, and engaged the appropriate cybersecurity experts to assist. The third-party provider also promptly notified law enforcement. The incident was limited to the third-party provider’s environment. Based on the information available to date, personal information, including name, date of birth, and social security/tax identification numbers of some BayFirst customers were accessed without authorization. To date, there is no evidence of the misuse, or attempted misuse, of personal information as a result of this incident. Impacted customers will be notified directly of this incident. BayFirst cannot quantify any material impact to its financial condition or operations, at this time