BayFirst reports $18.9M Q3 loss, exits SBA 7(a) lending; customer data exposed in cyber incident

BayFirst Financial Corp.

Net loss of $18.9M ($4.66 EPS) vs net loss of $1.2M in Q2 2025; includes $12.4M in one-time charges.
Exiting SBA 7(a) lending; definitive agreement to sell loans to Banesco USA at 97% of balances; close expected Q4 2025.
Provision for credit losses $10.9M; ACL ratio increased to 2.61% of loans held for investment from 1.65%.
Book value per share fell to $17.90 from $22.30; Tier 1 leverage ratio declined to 6.64% from 8.11%.
Third-party marketing provider exposed customer names, DOBs, and SSNs; no evidence of misuse to date.

Key facts

Extracted from this filing and checked against the source text.

Cybersecurity Incidents SEC 8-K Item 1.05 confidence 0.9

BayFirst Financial Corp. disclosed a cybersecurity incident: A third-party provider of marketing services experienced a cybersecurity incident resulting in unauthorized access to personal information of some BayFirst customers. Impact: No evidence of misuse or attempted misuse to date; BayFirst cannot quantify any material impact to financial condition or operations at this time. Materiality is still being assessed. Discovered 2025-08-14.

Nature: A third-party provider of marketing services experienced a cybersecurity incident resulting in unauthorized access to personal information of some BayFirst customers.
Impact: No evidence of misuse or attempted misuse to date; BayFirst cannot quantify any material impact to financial condition or operations at this time.
Materiality: assessing
Discovery: 2025-08-14

Exact text from the filing

Based on the information available to date, personal information, including name, date of birth, and social security/tax identification numbers of some BayFirst customers were accessed without authorization.

View on SEC.gov

Browse all cybersecurity incidents →

BayFirst Financial Corp. filing history →

Source: SEC EDGAR

accession 0001649739-25-000246

view filing index on sec.gov

view primary document

Machine-readable: JSON · Markdown · Plain text

This headline and bullets were generated automatically by deepseek-v4-flash:cloud@v2 from the public filing. Read the source on SEC.gov before relying on any specific claim. Not investment advice. See methodology for how this pipeline works.