XML 35 R2.htm IDEA: XBRL DOCUMENT

Material Cybersecurity Incident Disclosure	Oct. 28, 2025
Material Cybersecurity Incident [Line Items]
Material Cybersecurity Incident Nature [Text Block]	On August 14, 2025, BayFirst National Bank (“BayFirst”) was notified of a cybersecurity incident experienced by a third-party provider of marketing services. On October 28, 2025, the third-party provider confirmed that some customer information was exposed by this incident. Upon learning of the incident, the third-party provider immediately launched an investigation, worked with BayFirst to understand the scope of the issue, and engaged the appropriate cybersecurity experts to assist. The third-party provider also promptly notified law enforcement. The incident was limited to the third-party provider’s environment. Based on the information available to date, personal information, including name, date of birth, and social security/tax identification numbers of some BayFirst customers were accessed without authorization. To date, there is no evidence of the misuse, or attempted misuse, of personal information as a result of this incident. Impacted customers will be notified directly of this incident.
Material Cybersecurity Incident Scope [Text Block]	Upon learning of the incident, the third-party provider immediately launched an investigation, worked with BayFirst to understand the scope of the issue, and engaged the appropriate cybersecurity experts to assist. The third-party provider also promptly notified law enforcement. The incident was limited to the third-party provider’s environment. Based on the information available to date, personal information, including name, date of birth, and social security/tax identification numbers of some BayFirst customers were accessed without authorization. To date, there is no evidence of the misuse, or attempted misuse, of personal information as a result of this incident. Impacted customers will be notified directly of this incident.
Material Cybersecurity Incident Timing [Text Block]	On August 14, 2025, BayFirst National Bank (“BayFirst”) was notified of a cybersecurity incident experienced by a third-party provider of marketing services. On October 28, 2025, the third-party provider confirmed that some customer information was exposed by this incident.
Material Cybersecurity Incident Information Not Available or Undetermined [Text Block]	BayFirst cannot quantify any material impact to its financial condition or operations, at this time.