Item 1.05. Cybersecurity Incidents

On August 14, 2025, BayFirst National Bank (“BayFirst”) was notified of a cybersecurity incident experienced by a third-party provider of marketing services.^¹,² On October 28, 2025, the third-party provider confirmed that some customer information was exposed by this incident.

Upon learning of the incident, the third-party provider immediately launched an investigation, worked with BayFirst to understand the scope of the issue, and engaged the appropriate cybersecurity experts to assist. The third-party provider also promptly notified law enforcement.^³ The incident was limited to the third-party provider’s environment.^⁴ Based on the information available to date, personal information, including name, date of birth, and social security/tax identification numbers of some BayFirst customers were accessed without authorization^⁵,⁶. To date, there is no evidence of the misuse, or attempted misuse, of personal information as a result of this incident. Impacted customers will be notified directly of this incident.

BayFirst cannot quantify any material impact to its financial condition or operations, at this time.^⁷,⁸,⁹