River Financial Corporation is telling regulators it tried to suppress the data affected by a ransomware attack by obtaining “representations from the threat actor that it deleted the data in its possession.” Put plainly: over a month into its cleanup, the bank is leaning on the same criminals who stole the information in the first place. That is the key line, and it should make any executive responsible for cyber risk sit up.

The filing described a response that started with immediate containment and later moved into an accountability step that depends on the attacker keeping a promise. In its Form 8-K with the SEC, River Bank did not explicitly say whether it paid any ransom demands. And that omission matters, because ransomware crews are not commonly known for offering data deletion for free. The Register asked River for more explicit comment, but it did not immediately respond.

To understand why this is such a fraught trust exercise, zoom out to what “promise” has historically meant in ransomware cases. The source points to a precedent: when “globo-cops” took down LockBit in 2024, they found evidence that victim data was retained even after victims paid the extortion demands. That is the backdrop River’s decision is implicitly testing. The question for River is not whether it took technical steps. It is whether a threat actor’s representations can be a meaningful control when the incentives are to extract maximum value, not to disinfect systems.

River’s public disclosures started on June 16, when it first told the SEC that ransomware had been deployed across portions of its servers. The initial playbook sounds familiar to anyone who has watched cyber incidents play out across the financial sector: it took affected systems offline, disabled admin accounts, and brought in external incident responders to determine the full scope of damage. Those early moves address containment and investigation integrity. They are the baseline expectation for a regulated bank.

But the timing of the “representations” step, and what it signals to regulators, investors, and plaintiffs, is where things get uncomfortable. The source notes that by July 6, the messaging suggested some data was “potentially impacted.” Then four days later, River admitted that certain data was removed from its environment. By July 10, River said it was aware the data had been removed. From there, the legal consequences landed fast: two class action lawsuits had been filed against it by July 10. A week later, River told investors that two additional class actions had been filed, bringing the total to four.

That chain of events underlines a second-order reality: when cyber incidents hit public companies, the story is not just about incident response. It becomes a narrative about process, disclosure, and what the company knew, when it knew it, and how it communicated that uncertainty. “Potentially impacted” language is common, but once data deletion claims enter the picture, the bar rises. Plaintiffs and regulators will ask whether the company’s assurances were grounded in independently verifiable evidence or whether they relied on what the threat actor said.

River also has not completed its investigation, according to its most recent filing, and therefore has not confirmed the full scope or impact of the attack. That “not yet confirmed” posture may be responsible from an investigation standpoint, but it creates a moving target. For boards, audit committees, and CISOs, uncertainty is expected early. The risk is that uncertainty plus attacker assurances becomes a compliance and trust problem, not just an operational one.

The broader implication is that this incident is a stress test for how banks operationalize cyber risk controls when ransomware enters the frame. If a regulated financial institution can publicly describe seeking deletion representations from the threat actor, then peer institutions will notice. The next time a bank faces ransomware extortion, executives will be forced to decide how they document attacker communications, what constitutes usable evidence that data was truly removed, and how to avoid giving the appearance of “control by hostage negotiation.” In a sector where regulators evaluate both technical controls and governance, the reputational and legal stakes can escalate as quickly as the malware did.