Orrstown Financial Services IncORRF

Orrstown Financial Services Inc. closed the quarter to 31 March 2026 with $21.8 million of net income on revenue of $37.1 million reported for the full year 2025, a performance that would look tidy if the bank hadn’t filed an 8-K on 22 July 2026 disclosing a data incident that ‘may have a material impact’ on its financial condition. The 10-Q filed 8 May 2026 shows shareholders’ equity at $603.2 million, liabilities at $4.97 billion, and operating cash flow of $25.5 million for Q1 2026, a cash engine that could cushion any regulatory fallout. Still, the wording in the 8-K is careful: customers are being notified and offered credit monitoring, but the filing does not quantify the impact, leaving the market to guess whether the incident is a rounding error or a balance-sheet reshuffle.

Orrstown is a Pennsylvania-chartered bank and savings and loan holding company that trades on the OTCQB under the same name; it owns Orrstown Bank, its commercial-banking subsidiary, whose 2011 and 2025 equity-incentive plans litter the proxy statements with the usual management desks language about ‘aligning shareholder and executive interests.’ If you need a visual reminder of the bank’s merchant-services product, there’s an 1800×1200 hero image of a white Flex Pocket terminal on the product page, but the only thing flexing harder than the terminal is the ambiguity around the bank’s latest filing.

The numbers are unambiguous: as of 31 March 2026, Orrstown reported $5.58 billion of assets, $4.97 billion of liabilities, and $603.2 million of shareholders’ equity. Net cash provided by operating activities in the quarter was $25.5 million, while capex for the same period was a mere $422,000, which suggests the bank is not splurging on new branches. Diluted EPS came in at $1.12 on 19.4 million diluted shares, figures that feel like a rounding error compared with the 8-K’s admission that a data incident could matter.

The bank’s merchant-services page explains that the product lets any business accept debit and credit cards ‘safely and securely,’ a promise that now sounds like a marketing department’s version of a bank’s risk register. The site is still live, the terminal image is still in place, and the evidence stops at ‘may have a material impact’-so the gap between polished product prose and filed reality remains unquantified.

What changed this week: on 22 July 2026, Orrstown filed an 8-K disclosing the data incident; on 10 July 2026, the bank’s latest 13F-HR showed its listed equity positions; and on 8 May 2026, the 10-Q laid out the balance-sheet and cash-flow figures above. What remains unproven is the scale of the incident’s impact, whether regulators will demand provisions, and whether the board’s recent Form 4 activity signals conviction or merely optics. The next piece of evidence that would materially change the file is a follow-up 8-K quantifying the incident’s financial effect, or a 10-Q/10-K line-item adjustment in loan-loss provisions, customer remediation costs, or regulatory fines.