Orrstown Bank data breach: customer data held by Mercadien, its advisory firm, and letters to 83,938 people

Why did I get a letter from Orrstown Bank about Mercadien?

Because the bank shared your information with Mercadien for advisory work, and Mercadien's files were reached by an outsider. The letter comes from Orrstown because the bank is the one that gave Mercadien the data. Mercadien has written to people directly too; its own notice, its timeline and its other clients are in the Mercadien entry, which answers "why am I getting mail from Mercadien?".

Orrstown is one of several financial institutions whose customers were caught up in the same incident. Its holding company said so in its SEC filing: it is one of a number of organizations affected by the vendor's incident. The FAIRWINDS Credit Union entry covers another client's notice.

What happened, and when?

Mercadien notified the bank on or about May 21, 2026, and the bank then wrote to the people whose data it had provided. Eight days later, Orrstown Financial Services, the bank's parent, reported the incident in a Form 8-K under Item 8.01. It said a third party had gained unauthorized access to sensitive personal information of certain of its customers held by the vendor. The filing does not name the vendor; the letter does.

Date	What happened	Source
September 17, 2025	Breach date in Indiana's record, the same date Indiana gives for Mercadien's own notice	Indiana record
November 7, 2025	Mercadien detects the incident	Mercadien's letter
May 21, 2026	Mercadien notifies Orrstown	Letter; Form 8-K
May 29, 2026	Form 8-K, Item 8.01	SEC EDGAR
June 11, 2026	Notice sent; reported to Massachusetts	Indiana and Massachusetts records

The bank's own steps were quick: 21 days from Mercadien's notice to the letters. The long gap is earlier. Mercadien says it detected the incident on November 7, 2025, and Indiana's record of Mercadien's own notice gives a breach date of September 17, 2025, so the bank's customers were told about 267 days after their data was reached. The vendor breach guide shows how other notices that pass through a vendor describe it.

Were Orrstown Bank's own systems hacked?

No, according to the bank. The 8-K says its investigation had found that the company's information systems and networks were not accessed, compromised or affected. It also says the vendor had told it there was no indication that customer information had been misused, and that the company did not expect a material impact on its operations or finances. Item 8.01 is the "other events" item; the guide to Item 8.01 and Item 1.05 explains the difference.

What information was involved in the Orrstown Bank breach?

The letter lists name, date of birth, address, Social Security number or individual taxpayer identification number, account number, and government ID numbers such as a driver's license or passport number. It adds that the list was not necessarily complete. Massachusetts marks Social Security numbers, financial accounts and driver's licenses for its 68 residents. The letter says there was no evidence at that time that any of it had been misused.

How many people were affected?

Indiana's record gives 83,938 people in total, 40 in Indiana. Massachusetts counts 68. No other state record fetched for this entry gives a count. Orrstown's notice is filed separately from Mercadien's own, which Indiana records at 488,893 people, so the two totals should not be added or compared as parts of one figure.

What is Orrstown Bank offering?

Twenty-four months of free credit monitoring through Experian IdentityWorks, with identity restoration available for the same period without enrolling. Questions about the product or identity restoration go to Experian at 833-918-4741, with the engagement number in the letter. The enrollment deadline is printed in each letter. The guide to credit monitoring offers explains what the offer covers.

Was my information in the Orrstown Bank data breach?

If you got a letter from Orrstown Bank in June 2026 that names Mercadien, yes: your data was among what the bank gave the firm. If you are an Orrstown customer and got no letter, your data was probably not in the files Mercadien held, but the bank and Experian are the places to ask. If you also got a letter from Mercadien itself, both letters are about the same incident at Mercadien.

What the filings leave open

• How the intruder got into Mercadien's systems, and when the access ended.
• What advisory work Mercadien did for the bank, and why it needed customers' account and ID numbers.
• Where the 83,938 people live; only Indiana and Massachusetts counts are public in the records checked.
• When Mercadien learned that Orrstown customers' data was in the files.