An Alabama bank has told the SEC it obtained representations from the threat actor that the stolen data was deleted
One sentence in Thursday's filing appears nowhere in the four before it.
River Financial Corporation, the Prattville holding company for River Bank and Trust, has been amending the same cybersecurity disclosure since 25 June. Thursday's version, the fourth amendment, says that as part of its response the company "took steps to attempt to suppress the affected data, including obtaining representations from the threat actor that it deleted the data in its possession."
That is a bank telling the Securities and Exchange Commission it has a promise from the party that took its data. The filing does not say how the promise was obtained. It does not say whether anything was paid, and this brief does not suggest that anything was.
Five filings, five weeks
The original Form 8-K went in on 25 June. It said an unauthorised threat actor gained access to the network on or about 16 June, that River identified the activity on or about 19 June, and that ransomware had been deployed across portions of its server environment. Administrative accounts were disabled. Systems were taken offline. A third-party forensic firm came in.
Then the disclosures arrive roughly weekly, and each one hardens the previous one. On 6 July the company had "reason to believe that certain data was potentially impacted" and no evidence that accounts had been. On 10 July the belief became a determination: the threat actor "accessed portions of its network and removed certain data from its environment." That same filing reported two class actions. On 17 July there were four, and the company told the SEC that the principal issue in each is whether the attacker acquired customer information.
Thursday's amendment drops the litigation paragraph and adds the suppression one.
What the company still does not know
The rest of the filing is a repetition of the position River has held since June. The full nature, scope and impact of the incident have not been determined. Whether the incident is reasonably likely to materially impact the business or the financial condition has not been confirmed. Another amendment is promised within four business days of the company knowing.
Item 1.05 is the item Congress and the SEC built for exactly this, and River is using it as designed, which is to say it is publishing what it knows on the day it knows it. The cost of that discipline is that the public record now contains five documents, and the newest one says the investigation is still open on the question of whose information left the building.
The filing runs to two pages and carries no exhibit. It was accepted by EDGAR at 11:40 Eastern and signed by James M. Stubbs, the chief executive.
