River Financial discloses a material cybersecurity incident

What the filing says

On or about June 16, 2026, an unauthorized threat actor gained access to the network environment of River Financial Corporation, including River Bank & Trust (together, "River"). River identified the activity on or about June 19, 2026, and determined that ransomware had been deployed across portions of its server environment. River promptly took containment measures, including disabling affected administrative accounts and taking impacted systems offline.

1. Amended filing · Jul 30, 00:00 UTC
   8-K/A: Since the date of the original filing, River's investigation has progressed. River has determined that an unauthorized threat actor accessed portions of its network and removed certain data from its environment. River is working to determine the nature and scope of the information involved, including whether any personally identifiable information was affected.
2. Amended filing · Jul 17, 00:00 UTC
   8-K/A: As set forth in its Form 8-K filed July 10, 2026, two class action lawsuits were filed relating to the unauthorized threat actor gaining access to the network environment of River Financial Corporation, including River Bank & Trust (together, "River"). A third class action was filed against River on July 10, 2026 and a fourth class action was filed against River on July 16, 2026. The principal issue in each case is whether cybercriminals have acquired access to River's customers' personal identifiable information.
3. Amended filing · Jul 10, 00:00 UTC
   8-K/A: Since the date of the original filing, River's investigation has progressed. River has determined that an unauthorized threat actor accessed portions of its network and removed certain data from its environment. River is working to determine the nature and scope of the information involved, including whether any personally identifiable information was affected.
4. Amended filing · Jul 6, 00:00 UTC
   8-K/A: Since the date of the original filing, River's investigation has progressed. River has reason to believe that certain data was potentially impacted and is working to determine the nature and scope of the information involved, including whether any personally identifiable information was affected. To date, there is no evidence that accounts have been impacted.