Orrstown Financial Services

Cybersecurity incident disclosed to the SEC (8-K Item 8.01)

(b) On May 21, 2026, the Company received notice from a third-party vendor that such vendor had experienced a cybersecurity incident whereby a third-party gained unauthorized access to sensitive personal information of certain of the Company's customers. The Company is one of a number of organizations that have been affected by this vendor's cybersecurity incident. Based on the Company's investigation to date, the Company's information systems and networks have not been accessed, compromised or affected by the incident. The vendor has informed the Company that there is currently no indication