Loading story…
Sawyer Savings Bank, a community financial institution headquartered in Saugerties, New York, was reportedly hit by a ransomware attack attributed to the Storm threat group. Reporting indicates the breach occurred on Aug. 7 at approximately 20:32 UTC and was identified the following morning, affecting the bank’s operations and underscoring continued targeting of U.S. financial services organizations.
Separate reporting said Sawyer Savings Bank branches were closed amid a security probe, aligning with signs of operational disruption following the incident. The event highlights the pressure ransomware incidents can place on smaller banking institutions, where cyber intrusions can quickly translate into customer-facing service interruptions while containment and investigation are underway.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
The ransomware incident at Sawyer Savings Bank was reportedly discovered on the morning of Aug. 8, 2026. The source states discovery occurred at 09:20 UTC.
Sawyer Savings Bank was reportedly breached in a ransomware attack attributed to the threat group Storm. The incident affected the U.S.-based financial institution in Saugerties, New York.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
River Financial Corporation disclosed that a June ransomware attack hit portions of the server environment supporting **River Bank & Trust**, with the intrusion beginning around **June 16** and detected around **June 19**. The attackers accessed parts of the network, exfiltrated data, and deployed ransomware, prompting the company to take affected systems offline and disable compromised administrative accounts while it investigated the breach. In a July 30 filing, River said it obtained representations from the threat actor that the stolen data had been deleted, indicating some level of engagement with the attackers, but the company has not publicly identified the group or explained the initial access vector. River also said it has not yet determined whether **personally identifiable information** was accessed or whether the incident is reasonably likely to have a material impact on its business or financial condition, while at least four lawsuits have already been filed in connection with the attack.
Aug 4, 2026
Several significant data leaks and ransomware incidents have surfaced, affecting a range of organizations including Banco Vimenca, WIRED subscribers, Mexico’s Tax Administration Service (SAT), and New Zealand’s Neighbourly platform. Threat actors have claimed responsibility for exposing sensitive data such as government financial records, large-scale subscriber information, and user communications, with some incidents linked to ransomware groups. While the authenticity of these dark web postings remains unverified, the breadth of affected entities highlights ongoing risks to both financial institutions and government agencies from cybercriminal activity. In the United States, two banks—Artisans' Bank and VeraBank—have notified thousands of customers that their personal information was compromised in a ransomware attack on Marquis Software, a vendor providing data analytics and communication services to financial institutions. The attack, traced to a vulnerability in a SonicWall firewall, resulted in the exposure of names and Social Security numbers, though the banks’ own systems were not directly breached. These incidents underscore the persistent threat posed by supply chain vulnerabilities and the importance of robust third-party risk management for organizations handling sensitive data.
Jun 29, 2026
**Marquis**, a Texas-based fintech and services provider to hundreds of U.S. banks, disclosed that an **August 2025 ransomware attack** exposed the personal and financial data of **672,075 individuals**. Stolen information included names, dates of birth, addresses, phone numbers, Social Security numbers, Taxpayer Identification Numbers, and bank, debit, and credit card details. The company said the intrusion disrupted operations at **74 banks**, while maintaining that the incident was limited to Marquis systems and did not directly impact customer bank environments. Reporting indicates the attackers gained access after compromising a **SonicWall firewall**, and Marquis has alleged in litigation that weaknesses tied to SonicWall allowed threat actors to obtain firewall configuration backup files and use them to breach its network, steal data, and deploy ransomware. The newly filed breach notices provide the clearest accounting so far of the scale of the incident, with a large share of affected individuals located in Texas, and connect the attack to broader concerns around credential and token exposure following SonicWall's earlier security disclosure.
Jun 29, 2026