River Financial Corporation Confirms Data Deletion by Ransomware Attackers

Securityaffairs.Co

River Financial Corporation Confirms Data Deletion by Ransomware Attackers

First seen 3 Aug 2026, 15:20 UTC • •51.9

Article Content

1 / 6

Browse articles

ThreatCluster •August 4, 2026 at 14:52 UTC

•River Financial Corporation experienced a ransomware attack starting June 16, 2026.
•The company received assurances from attackers that stolen data was deleted.
•At least four lawsuits have been filed against River Financial due to the incident.

River Financial Corporation reported that hackers deleted data stolen during a ransomware attack that began on June 16, 2026. The company detected the intrusion three days later and took immediate containment measures, including disabling compromised accounts and taking affected systems offline. They are currently working with a third-party forensic firm to assess the full scope of the breach. Despite assurances from the attackers regarding data deletion, River has not confirmed whether any personally identifiable information was accessed. The company has faced at least four lawsuits related to the incident and continues to investigate the potential impact on its business. River has not disclosed the identity of the threat actor or the method of compromise used in the attack.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 96d ago How this analysis works

Timeline

2026-06-16

Ransomware attack initiated

Unauthorized access to River's network was gained, leading to a ransomware deployment.

2026-06-19

Intrusion detected

River Financial Corporation identified the ransomware activity three days after the attack began.

2026-06-25

SEC filing on investigation status

River disclosed that the investigation into the breach's scope and impact was ongoing.

2026-07-30

Assurances of data deletion received

River obtained confirmations from the attackers that the stolen data had been deleted, though ransom payment details remain unconfirmed.

Securityaffairs.Co

2026-08-04

Investigation ongoing

River Financial Corporation continues to assess the impact of the ransomware attack and has not yet determined the full extent of the breach.

More articles in this cluster (5)

Threat Graph

9 entities, 8 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (5)

Data Breach
Ransomware
T1041 - Exfiltration Over C2 Channel
T1078 - Valid Accounts
T1486 - Data Encrypted for Impact

Organization (3)

River Bank
River Bank & Trust
River Financial Corporation

Threat Actor (1)

Lockbit

Relationships

Lockbit uses Data Breach
Lockbit uses Ransomware
Lockbit uses T1041 - Exfiltration Over C2 Channel
Lockbit uses T1078 - Valid Accounts
Lockbit uses T1486 - Data Encrypted for Impact
Lockbit targets River Bank
Lockbit targets River Bank & Trust
Lockbit targets River Financial Corporation

Following this threat?

Track Lockbit and River Bank in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

SAP Exploits Surge: Days to Zero Report Highlights Critical Vulnerabilities A report from Onapsis Research Labs and Recorded Future reveals that the median time from the release of a SAP Security Note to the first public exploit has drastically decreased to 1-3 days, down from 489 days in 2021. The report analyzed over 1.2 million events and noted a 123% increase in underground discussions…

Ransomware Groups Exploit PAN-OS Flaw, Target Critical Infrastructure Ransomware groups, including Qilin and INC, are exploiting a critical authentication bypass vulnerability (CVE-2026-0257) in Palo Alto Networks' PAN-OS GlobalProtect and Prisma Access. This flaw allows attackers to establish unauthorized VPN sessions, bypassing multifactor authentication controls. Since its disclosure…