Almeida Law Group is investigating a data breach at Centennial Bank (including its division Happy State Bank). The breach occurred on August 7th–14th, 2026 and was discovered on August 17th, 2026. If you were affected, contact Almeida Law Group.
About Centennial Bank (including its division Happy State Bank)
Centennial Bank is the banking subsidiary of Home BancShares, Inc. (NYSE: HOMB), headquartered at 620 Chestnut Street in Conway, Arkansas. It provides commercial and retail banking, wealth management, loans, savings, insurance, and related financial services. Happy State Bank operates as a division of Centennial Bank with over 60 locations across Texas, and the combined institution has locations in Arkansas, Florida, Alabama, Texas, and New York. Because of the breadth of personal and financial data banking institutions collect, a breach involving this type of organization can carry serious risk for customers whose account numbers, government IDs, and related records are exposed.
What Happened?
Centennial Bank (including its division Happy State Bank) was listed in a Texas Attorney General data security breach report. This incident was not a cyberattack but rather a misdirected-file error originating with a third-party vendor. According to a breach notification letter filed with the Massachusetts Attorney General, Fidelity Information Services (FIS), which assists Centennial Bank with customer due diligence processes, was responsible for the disclosure. On August 7th, 2026, an FIS associate preparing a secure email containing a customer file accidentally sent it to an unintended recipient — an employee at another regulated financial institution who happened to share the same first name as the intended bank contact. On August 10th, 2026, the unintended recipient opened the file, recognized the error, closed the file, and notified FIS. FIS reported the incident to Centennial Bank on August 17th, 2026, recalled the email, and terminated access to the file. The unintended recipient confirmed deletion on August 14th, 2026, and their institution issued a Certificate of Destruction on August 26th, 2026. A total of 8,227 individuals were affected. Consumers were notified by U.S. Mail. The data involved included names, addresses, Social Security numbers, driver’s license numbers, government-issued ID numbers, financial account information, health insurance information, and dates of birth.
This is at least the third known data security incident involving Centennial Bank. A July 2022 breach reportedly compromised the personal information of approximately 17,000 customers, and an April 2023 incident involved unauthorized access to the bank’s network and copying of certain files. Centennial Bank did not begin notifying affected individuals about the April 2023 breach until approximately April 19th, 2024 — over a year later. A $5.2 million class action settlement covering both prior incidents received final court approval on July 30th, 2025. No public litigation has been identified specific to this August 2026 incident as of the report date.
Key Facts at a Glance
- Company or Organization: Centennial Bank (including its division Happy State Bank)
- Industry: Financial Services / Banking
- Location: Conway, Arkansas
- Incident type: Third-party vendor misdirected-file disclosure (FIS/Fidelity Information Services)
- Date of breach: August 7th, 2026 – August 14th, 2026
- Date breach discovered: August 17th, 2026
- Date of consumer notification: September 17th, 2026 (date reported to Texas Attorney General)
- Total persons affected: 8,227
- Prior breach: Yes — July 2022 and April 2023 breaches; $5.2 million class action settlement approved July 30th, 2025
- Source: Texas Attorney General data security breach report (BR-0005334); Massachusetts AG breach notification letter; Top Class Actions; ClaimDepot – $5.2M settlement
What Should You Do?
If you received a notice from Centennial Bank or Happy State Bank about this incident, consider enrolling in any identity theft protection services the bank is offering. You should also place a fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion — to help prevent new accounts from being opened in your name. Monitor your existing bank and credit card accounts closely for any transactions you do not recognize, and review your credit reports for unfamiliar accounts or inquiries. You can request free credit reports at AnnualCreditReport.com. Because health insurance information was among the data types exposed, review any Explanation of Benefits statements from your insurer for services you did not receive, and consider checking your medical records for inaccuracies. If you suspect fraud or identity theft, visit IdentityTheft.gov for step-by-step guidance.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
