River Financial Corporation, the holding company behind River Bank, told US regulators it obtained assurances from the ransomware crew that breached it that stolen data was deleted. The reliance on an extortionist’s word drew scrutiny from security watchers.
In a Form 8-K filing with the SEC, the bank said it took steps to attempt to suppress the affected data, including obtaining representations from the threat actor that it deleted the data in its possession. It did not say whether it paid a ransom, and the filing left the full scope of the attack unconfirmed.
River Bank first disclosed the incident on June 16, saying ransomware had been deployed across portions of its servers. It took affected systems offline, disabled admin accounts and brought in external incident responders. By July 6 it warned that some data may have been impacted, and four days later confirmed that data had been removed from its environment.
Four class action lawsuits have since been filed against the bank, two of them disclosed to investors in July.
Deletion promises from ransomware crews are rarely verifiable, and law enforcement takedowns have repeatedly shown stolen data surviving even after victims paid extortion demands. The bank’s investigation remains open, with no confirmed count of affected records.
