River Bank Confirms Stolen Data Deleted After Ransomware Attack

Ransomware Incident and Data Deletion

River Financial Corporation, the holding company for River Bank & Trust, announced that data exfiltrated during a ransomware attack has been deleted by the attackers. The incident, which began on June 16 and was identified three days later, involved the deployment of ransomware across parts of the bank's server environment. Affected systems were taken offline, and compromised administrative accounts were disabled.

Ongoing Investigation and Legal Actions

River, with assistance from a third-party forensic firm, is investigating the scope of the incident, including whether personally identifiable information was accessed or stolen. Filings with the US Securities and Exchange Commission (SEC) indicate that hackers accessed portions of River’s network and exfiltrated data. At least four lawsuits have been filed against the company following the attack. As of a July 30 filing, River has not confirmed if personal information was stolen.

Engagement with Threat Actor

The company engaged with the threat actor to ensure the deletion of the stolen data, which likely involved a ransom payment. River stated it "obtained representations from the threat actor that it deleted the data in its possession." Details regarding the identity of the threat actor or how the network was compromised have not been disclosed.

Uncertain Business Impact

River has not yet determined if the ransomware incident will materially impact its business or financial condition. The investigation remains ongoing to fully assess the consequences of the attack.