River Financial Corporation filed an amended Form 8-K on July 30, 2026, providing an update on the cybersecurity incident first reported on June 19. The filing offers incremental detail on the company's investigation and its efforts to contain the fallout from the breach.
Investigation Progress and Data Suppression Efforts
Since the original filing, River's investigation has confirmed that an unauthorized threat actor accessed portions of its network and removed certain data from its environment. The company stated it is continuing to work to determine the nature and scope of the information involved, including whether any personally identifiable information was affected.
A notable development in the amended filing is River's disclosure that it took steps to suppress the affected data. The company obtained representations from the threat actor that it deleted the data in its possession. While such representations are a common element of ransomware negotiations, they do not provide certainty that the data has not been copied, sold, or otherwise retained elsewhere, and the company did not characterize the reliability of these assurances.
Unresolved Scope and Financial Impact
As of the July 30 filing, the full nature, scope, and impact of the incident have not yet been determined. River has not confirmed whether the incident is reasonably likely to materially impact its business or financial condition. The company indicated it will file another amendment to the Form 8-K within four business days after it determines that such information is available.
Context of Ongoing Litigation
This update arrives against a backdrop of mounting legal exposure. Previous filings have disclosed that at least four class action lawsuits have been filed against the company in connection with the ransomware incident. The July 30 amendment does not mention the litigation or provide any updates on the status of those cases. The company had previously stated it was evaluating the complaints.
River Financial, an Alabama-based bank holding company, reported strong financial results for the period ending June 30, 2026, including a 24.2% increase in tangible book value per share and a 36.3% rise in year-to-date net income, according to a separate filing. The cybersecurity incident and resulting litigation represent a material operational risk that the company has not yet quantified in financial terms.