A community bank files the first 8-K for shadow AI.
CB Financial Services filed an SEC Form 8-K under Item 1.05 on 11 May 2026 after an employee, working from a personal device, uploaded customer names, Social Security numbers and dates of birth into an unauthorised AI application while building a presentation. The filing is reported as the first 8-K attributed to shadow AI usage rather than an external intrusion.
There was no attacker, no malware and no breached perimeter. One employee, one unapproved tool, one paste. The bank's COO Jennifer George described the response timeline in a subsequent American Banker interview.
SEC EDGAR · CB Financial Services 8-K filings →One employee mistake triggered SEC disclosure, a 36-hour prudential regulator notice and GLBA customer notice simultaneously. Three separate clocks, three separate audiences, from a single paste into a browser tab nobody had approved.
This is the incident shape most boards are not modelling. They plan for intrusion. The exposure that actually reaches an 8-K is an employee doing ordinary work in a tool the bank never evaluated. You cannot investigate what you never recorded, and you cannot disclose accurately what you cannot reconstruct.
- tool.identity: the application called, approved or not, from which device
- data.classification: PII, SSN, DOB detected in the prompt before it left
- policy.applied: allow / transform / block, with the rule that fired
- user.attribution: who, when, from which network, on what business task
- export: 8-K, prudential notice and GLBA notice packets from one query
Would a paste like that reach your record?
Thirty minutes on the interaction level trail your disclosure clock depends on.
Book a working session →