SR Bancorp reports data security incident at service provider Mercadien; customer PII accessed

SR Bancorp, Inc.

• Unauthorized actor accessed Mercadien's servers, acquiring Bank customer data including SSN, account numbers, and DOB.
• Somerset Regal Bank's systems were not impacted; no disruption to operations, customer access, or payment systems.
• Customer notifications are being provided through Mercadien as required by federal and state laws.
• Company states incident has not had and is not expected to have a material impact on financial condition or results.