2025-05-30 MainStreet Bancshares, Inc. Cybersecurity Incident

Page last updated on June 9, 2025

MainStreet Bancshares, Inc. initially disclosed a cybersecurity incident in an SEC 8-K filing on 2025-05-30 16:34:15 EDT.

Company Summary

MainStreet Bank is a provider of commercial banking services for retail and institutional customers.

Incident Details

Material: Unknown
Is Breach: TRUE
Records Compromised: Unknown
Data Types Impacted: No Data Types Tracked (yet)

Compromised Date:
Detected Date:
Disclosure Date: 2025-05-30
Contained Date:
Recovered Date:

Attack Goal: Unknown

Costs: No Costs Tracked (yet)

Filings

8-K filed on 2025-05-30

MainStreet Bancshares, Inc. filed an 8-K at 2025-05-30 16:34:15 EDT
Accession Number: 0001437749-25-019008

Item 8.01 Other Events.

On May 30, 2025, MainStreet Bancshares, Inc. (the “Company”) determined to report information related to a data security incident which it has been investigating. In March 2025, the Company was made aware that an outside vendor to the core bank had been compromised. The Company immediately activated its incident response process to investigate and remediate the incident and initially concluded that the incident’s impact would likely not be material. Although each vendor undergoes a thorough security vetting process, we swiftly ceased all activity with this provider.

On April 28, 2025, we concluded our own review and determined the third-party vendor’s compromised system included personally identifiable information on a small subset of our customer base, approximately 4.65%. The Company determined that its own information technology systems and networks had not been compromised or affected, no unauthorized transactions had been executed, no monies had been transferred to the unknown persons, and customers had been able to continue to execute transactions with the Company. The Company has notified appropriate regulators. On May 26, 2025, appropriate monitoring systems were established and the impacted customers were notified and provided tools to monitor any suspicious activity.

The incident has not had a material impact on the Company’s current operations, and the Company does not anticipate any material impact on the Company’s financial condition, results of operations, reputation, relationships, or prospects.

Company Information