River Financial Corporation (RVRF) details network data access by attacker
Rhea-AI Filing Summary
River Financial Corporation reports that its ongoing investigation into a June 19, 2026 cybersecurity incident has determined that an unauthorized threat actor accessed portions of its network and removed certain data. The company is working to identify the nature and scope of the information involved, including whether any personally identifiable information was affected.
As part of its response, River obtained representations from the threat actor that the data in its possession was deleted and took steps to suppress the affected data. The full nature, scope, and impact of the incident, including whether it is reasonably likely to materially impact River’s business or financial condition, have not yet been determined. River plans to file another amendment within four business days after it determines that such information is available.
Positive
- None.
Negative
- None.
8-K Event Classification
2 items: 1.05, 9.01
2 items
Item 1.05
Material Cybersecurity Incidents
Business
A cybersecurity incident that the company has determined to be material to investors.
Item 9.01
Financial Statements and Exhibits
Exhibits
Financial statements, pro forma financial information, and exhibit attachments filed with this report.
Key Figures
Date of earliest event: June 19, 2026
Amendment timing: four business days
Filing signature date: July 30, 2026
3 metrics
Date of earliest event
June 19, 2026
Earliest date of the reported cybersecurity incident
Amendment timing
four business days
Planned timeframe to file another amendment after information becomes available
Filing signature date
July 30, 2026
Date the report was signed by the Chief Executive Officer
Key Terms
Material Cybersecurity Incidents, threat actor, personally identifiable information, emerging growth company
4 terms
Material Cybersecurity Incidents regulatory
"ITEM 1.05 Material Cybersecurity Incidents."
threat actor technical
"an unauthorized threat actor accessed portions of its network and removed certain data"
A threat actor is an individual, group, or organization that deliberately tries to harm a company’s systems, data, or operations—ranging from lone hackers and criminal gangs to insiders or state-sponsored teams. For investors this matters because successful attacks can cause direct financial loss, regulatory fines, interrupted business, or damaged trust—like a burglar stealing valuables or sabotaging a storefront, harming the company’s value and future earnings.
personally identifiable information technical
"including whether any personally identifiable information was affected"
Personally identifiable information (PII) is any data that can directly or indirectly identify a single person — for example: full name, home address, national ID numbers, phone or email, financial account details, or unique biometric data. Investors care because mishandling or loss of PII can trigger regulatory fines, costly cleanup and lost customer trust; think of a data breach like losing the keys to many customers’ homes, which can hurt a company’s finances and stock value.
emerging growth company regulatory
"Emerging growth company "
An emerging growth company is a recently public or smaller public firm that qualifies for temporary, lighter regulatory and disclosure rules to reduce the cost and effort of being public. For investors, it means the company may provide less historical financial detail and face fewer reporting requirements than larger firms, so it can grow more quickly but also carries higher uncertainty—like buying a promising early-stage product with fewer user reviews.
AI-generated analysis. How Rhea-AI works. Not financial advice.
FAQ
What cybersecurity incident did River Financial Corporation (RVRF) disclose?
River Financial disclosed a cybersecurity incident in which an unauthorized threat actor accessed parts of its network and removed data. The company is still determining what information was involved and whether any personally identifiable information was affected.
Has personally identifiable information been compromised in the RVRF cyber incident?
River Financial has not yet determined whether personally identifiable information was involved in the incident. The company’s investigation is focused on defining the nature and scope of the affected data, including any potential impact on personal information.
How has River Financial Corporation (RVRF) responded to the cyberattack?
River Financial reports that it took steps to suppress the affected data, including obtaining representations from the threat actor that it deleted the data. The company continues investigating to assess the full nature, scope, and potential business or financial impact.
Is the cybersecurity incident expected to materially impact RVRF’s business or financial condition?
River Financial states it has not yet confirmed whether the incident is reasonably likely to materially impact its business or financial condition. That assessment depends on the ongoing investigation into the incident’s full nature, scope, and the information involved.
When will River Financial Corporation (RVRF) provide further updates on the cyber incident?
River Financial expects to file another amendment within four business days after it determines that additional information is available. That future amendment is intended to provide more detail on the incident’s scope and any confirmed business or financial impacts.