Loading story…
River Financial Corporation disclosed that a June ransomware attack hit portions of the server environment supporting River Bank & Trust, with the intrusion beginning around June 16 and detected around June 19. The attackers accessed parts of the network, exfiltrated data, and deployed ransomware, prompting the company to take affected systems offline and disable compromised administrative accounts while it investigated the breach.
In a July 30 filing, River said it obtained representations from the threat actor that the stolen data had been deleted, indicating some level of engagement with the attackers, but the company has not publicly identified the group or explained the initial access vector. River also said it has not yet determined whether personally identifiable information was accessed or whether the incident is reasonably likely to have a material impact on its business or financial condition, while at least four lawsuits have already been filed in connection with the attack.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
In a July 30 SEC filing, River said it had taken steps to suppress the affected data and obtained representations from the threat actor that the stolen data in the attacker's possession had been deleted. The company said its investigation was still ongoing and it had not yet determined whether personal information was stolen.
In a June 25 SEC filing, River said it was investigating the nature and scope of the incident with help from a third-party forensic firm. The company also said it was assessing whether personally identifiable information had been accessed or exfiltrated.
River identified the malicious activity about three days later and determined that ransomware had been deployed across portions of its server environment. In response, it took affected systems offline and disabled compromised administrative accounts.
River Financial Corporation said an unauthorized threat actor accessed portions of its network environment, including systems affecting River Bank & Trust. The intrusion began on or about June 16, 2026.
Court actions followed the breach, with at least four lawsuits filed against River Financial Corporation in connection with the ransomware incident. The references do not specify the filing dates of the suits.
Subsequent SEC filings revealed that attackers had accessed portions of River's network and exfiltrated certain data from its environment. These filings expanded the known impact beyond ransomware deployment alone.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourceteiss.co.uk
Open sourcesecurityaffairs.com
Open sourcesecurityweek.com
Open sourcesec.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Marquis**, a Texas-based fintech and services provider to hundreds of U.S. banks, disclosed that an **August 2025 ransomware attack** exposed the personal and financial data of **672,075 individuals**. Stolen information included names, dates of birth, addresses, phone numbers, Social Security numbers, Taxpayer Identification Numbers, and bank, debit, and credit card details. The company said the intrusion disrupted operations at **74 banks**, while maintaining that the incident was limited to Marquis systems and did not directly impact customer bank environments. Reporting indicates the attackers gained access after compromising a **SonicWall firewall**, and Marquis has alleged in litigation that weaknesses tied to SonicWall allowed threat actors to obtain firewall configuration backup files and use them to breach its network, steal data, and deploy ransomware. The newly filed breach notices provide the clearest accounting so far of the scale of the incident, with a large share of affected individuals located in Texas, and connect the attack to broader concerns around credential and token exposure following SonicWall's earlier security disclosure.
Jun 29, 2026
Ingram Micro disclosed that a **July 2025 ransomware attack** resulted in the theft of files from internal repositories and a subsequent data breach affecting **~42,000 people** (reported as **42,521** in filings). The company said an unauthorized party accessed and exfiltrated certain files between **July 2–3, 2025**, and that it detected the incident on **July 3**, after which it took systems offline and began containment and remediation with external cybersecurity experts and law enforcement notification. The compromised data primarily involved **employee and job applicant records**, including names, contact details, dates of birth, and government-issued identification numbers such as **Social Security**, driver’s license, and passport numbers, as well as some **employment-related information** (e.g., work-related evaluations). The incident also caused significant operational disruption, including outages impacting internal systems and customer-facing operations; reporting noted that **SafePay** claimed responsibility and alleged theft of **~3.5 TB** of data, though Ingram Micro has not publicly attributed the intrusion to a specific threat group while confirming ransomware was deployed.
Jun 29, 2026
Several significant data leaks and ransomware incidents have surfaced, affecting a range of organizations including Banco Vimenca, WIRED subscribers, Mexico’s Tax Administration Service (SAT), and New Zealand’s Neighbourly platform. Threat actors have claimed responsibility for exposing sensitive data such as government financial records, large-scale subscriber information, and user communications, with some incidents linked to ransomware groups. While the authenticity of these dark web postings remains unverified, the breadth of affected entities highlights ongoing risks to both financial institutions and government agencies from cybercriminal activity. In the United States, two banks—Artisans' Bank and VeraBank—have notified thousands of customers that their personal information was compromised in a ransomware attack on Marquis Software, a vendor providing data analytics and communication services to financial institutions. The attack, traced to a vulnerability in a SonicWall firewall, resulted in the exposure of names and Social Security numbers, though the banks’ own systems were not directly breached. These incidents underscore the persistent threat posed by supply chain vulnerabilities and the importance of robust third-party risk management for organizations handling sensitive data.
Jun 29, 2026