US bank places trust in ransomware crew that promised to delete its data
Would you trust a ransomware extortionist to delete the data they stole? One bank certainly wants you to. Well over a month into a ransomware cleanup job, River Financial Corporation tells regulators that it “took steps to attempt to suppress the affected data, including obtaining representations from the threat actor that it deleted the data in its possession.”
For context, placing this kind of trust in this kind of individual has been proven to be a bad idea. When globo-cops took down LockBit in 2024, they found evidence that victim data was retained even after the victim had paid the extortion demands.
In its Form 8-K filing with the SEC, River Bank did not explicitly state whether or not it paid any of the criminals’ ransom demands, although ransomware crooks are not commonly known to offer a victim data deletion for free.
REG AD
The Register asked the company for a more explicit comment on this matter, but it did not immediately respond.
REG AD
River Bank first disclosed its cyber woes to the Securities and Exchange Commission (SEC) on June 16, admitting from the outset that ransomware had been deployed across portions of its servers.
MORE CONTEXT
- Greedy ransomware crews return for seconds after victims cough up first extortion payments
- Charities remain locked out of CAF Bank online accounts
- Confused by the SEC's IT security breach reporting rules? Read this
- US chip testing firm shrugged off ransomware hit as minor – then came the data leak
-
software Techie lured out of retirement to support software only he remembered
-
NETWORKS Three becomes one as Vodafone buys out merger partner
-
security Word worm crawls into Copilot, spreads chaos
-
DEVOPS Dev who gave HashiCorp its name returns with a faster terminal multiplexer
-
DATABASES After rewriting SQLite in Rust, Turso turns its sights on Postgres - SYSTEMS A deep dive into Nvidia's Vera CPU and the Olympus cores that power it 88 custom cores, 176 funky threads, 1.5 TB of laptop RAM, and 1.8 TB/s of NVLink connectivity — this isn't your typical datacenter chip
- OFF-PREM Enterprise cloud infrastructure uptake shows no sign of slowing Cloud revenue now north of $143 billion a quarter, and growth is accelerating
- DEVOPS Dev who gave HashiCorp its name returns with a faster terminal multiplexer Persistent sessions could be just the beginning
- SECURITY Anthropic and OpenAI are competing to see whose agents can go rogue harder Whoever wins, we lose
- SYSTEMS UK wants datacenters to pay a fee for grid connection requests Refundable charge intended to discourage time wasters from filing applications that will never be realized
- Security Russians are posing as Signal support to launch phishing attacks PLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more!
- Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attack PLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more
- Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructure Voting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included
- Security EQT buys majority share in Swiss cybersecurity biz Acronis Went at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified
- Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sight On the plus side, infosec's a good bet for a long, stable career
- FOSS smashed one Microsoft monopoly. After 20 years of failure, it's time to smash another Word up
- GNOME can look like Windows – and Flashback can do it without extensions New 'Simple-taskbar' is an option, but there's a simpler, stabler way
- A moment of silence, please, for the final release of Debian on x86-32 New Debian versions hit FOSSland in the form of 13.6 and 12.15
- Baddies caught exploiting extensions bugs with perfect 10 scores on vulnerable Joomla websites Flaws in iCagenda, Balbooa Forms extensions can impact open source CMS that powers a million sites worldwide
- Frame: A new X11 server – implemented directly in assembly Joins yserver, Phoenix, and of course XLibre – and outlier Arcan
- Cinnamon 6.8 will support Wayland – if you want it Next version of Linux Mint’s desktop has both kinds of display server
In response, it took affected systems offline, disabled admin accounts, and brought in external incident responders to determine the full scope of the damage.
Only July 6, messaging suggested it was aware that some data was “potentially impacted” by the attack, before admitting that certain data was removed from its environment four days later.
A side note on cyber verbiage
“Removed” is an interesting and unusual word to see in a disclosure when describing what an intruder did with their access.
The usual nomenclature is “stolen,” despite in most cases it being more accurate to say data was “copied” from a victim’s environment.
Some of the more nebulous announcements say data was “acquired” or “retrieved.” Sometimes “affected.”
The more cowardly ones simply stick with “accessed,” even though the word does not denote a change of ownership.
By July 10, River was aware the data had been removed, and two class action lawsuits had been filed against it, to top things off.
A week later, it told investors that an additional two class actions had been filed, bringing the total to four.
River has not yet completed its investigation, per its most recent filing, and therefore has not confirmed the full scope or impact of the attack. ®
[](https://www.facebook.com/sharer.php?u=https%3A%2F%2Fwww.theregister.com%2Fcyber-crime%2F2026%2F07%2F31%2Fus-bank-places-trust-in-ransomware-crew-that-promised-to-delete-its-data%2F5281888) [](https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.theregister.com%2Fcyber-crime%2F2026%2F07%2F31%2Fus-bank-places-trust-in-ransomware-crew-that-promised-to-delete-its-data%2F5281888) [](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.theregister.com%2Fcyber-crime%2F2026%2F07%2F31%2Fus-bank-places-trust-in-ransomware-crew-that-promised-to-delete-its-data%2F5281888) [](https://bsky.app/intent/compose?text=US%20bank%20places%20trust%20in%20ransomware%20crew%20that%20promised%20to%20delete%20its%20data%0Ahttps%3A%2F%2Fwww.theregister.com%2Fcyber-crime%2F2026%2F07%2F31%2Fus-bank-places-trust-in-ransomware-crew-that-promised-to-delete-its-data%2F5281888) [](https://www.reddit.com/submit?url=https%3A%2F%2Fwww.theregister.com%2Fcyber-crime%2F2026%2F07%2F31%2Fus-bank-places-trust-in-ransomware-crew-that-promised-to-delete-its-data%2F5281888&title=US%20bank%20places%20trust%20in%20ransomware%20crew%20that%20promised%20to%20delete%20its%20data) [](https://api.whatsapp.com/send?text=US%20bank%20places%20trust%20in%20ransomware%20crew%20that%20promised%20to%20delete%20its%20data%0Ahttps%3A%2F%2Fwww.theregister.com%2Fcyber-crime%2F2026%2F07%2F31%2Fus-bank-places-trust-in-ransomware-crew-that-promised-to-delete-its-data%2F5281888)
REG AD