Auditor's Server Breach Exposes Somerset Regal Bank Customer Social Security Numbers
Vendor Data Breach
Company Background
SR Bancorp, Inc. (NASDAQ: SRBK) is the holding company for Somerset Regal Bank, a full-service commercial bank headquartered in Bound Brook, New Jersey with 14 branches across Essex, Hunterdon, Middlesex, Morris, Somerset, and Union Counties. With an approximate market capitalization of $140.7 million, the company had $1.14 billion in total assets as of March 31, 2026. The bank was formed through a mutual-to-stock conversion and simultaneous merger with Regal Bancorp, both completed in September 2023.
The bank has grown steadily since the merger. Net loans reached $859.1 million at March 31, 2026, up $61.9 million, or 7.8%, from June 2025, driven by commercial and residential mortgage originations. Net interest margin expanded to 3.00% for the quarter ended March 31, 2026, compared with 2.82% in the prior-year period. Asset quality remains clean: no non-performing loans were reported at March 31, 2026 and there have been no charge-offs in recent periods.
Leadership transitioned at the start of 2026. Christopher J. Pribula became President and Chief Executive Officer on January 1, 2026, succeeding William P. Taylor, who retired as CEO and became Executive Chairman of the bank. The company has also been actively repurchasing stock, retiring 761,229 shares at a cost of $12.0 million in the nine months ended March 31, 2026, and authorized a third buyback program in May 2026 for up to 801,320 additional shares.
What Was Disclosed
Mercadien, P.C. CPAs — which provides internal audit-related services to SR Bancorp and Somerset Regal Bank — discovered that an unauthorized actor had accessed and acquired files stored on Mercadien's computer servers. Those files contained personal data belonging to Somerset Regal Bank customers. According to the disclosure, the compromised information included customer names, social security numbers, account numbers, identification documents, and dates of birth.