The company also disclosed in a regulatory filing that a third-party marketing service provider was the victim of a cybersecurity incident. The vendor confirmed in late October that certain customer information — including names, dates of birth, and Social Security or tax identification numbers — had been accessed without authorization, BayFirst said in the filing.
The breach was limited to the third party’s systems, and BayFirst’s own environment was unaffected. The provider immediately launched a probe, engaged cybersecurity experts, and notified law enforcement to contain and assess the event.
BayFirst said there is no evidence of misuse or attempted misuse of the exposed data, adding that impacted customers are being notified.