Form 8-K
SEC current-report form; Item 1.05 requires cybersecurity-incident disclosure within four business days of materiality.
River Financial Corporation filed its fifth disclosure, an amended Form 8-K, on 30 July 2026, still unable to determine materiality more than six weeks after a 19 June intrusion.
Last refreshed: 3 August 2026 · Appears in 2 active topics
When does ransomware disruption force a listed manufacturer to tell the markets?
Timeline for Form 8-K
Mentioned in: A fifth filing, materiality still open
Cybersecurity: Threats and DefencesWest Pharma SEC 8-K on ransomware halt
Cybersecurity: Threats and DefencesMentioned in: Red Cat signs Ukraine's state arms exporter
Drones: Industry & DefenceBackground
Form 8-K is the Securities and Exchange Commission's current-report filing, required from all NYSE- and Nasdaq-listed companies to disclose material events between regular quarterly and annual reports. Since the SEC's 2023 cybersecurity disclosure rule, Item 1.05 of Form 8-K compels listed companies to disclose a material cybersecurity incident within four business days of determining it is material, covering the incident's Nature, scope, timing and material impact.
West Pharmaceutical Services and Stryker established in April and May 2026 that the materiality threshold can be crossed by operational disruption alone, independent of attribution or extortion claims. River Financial's serial amendments through July 2026 show the other side of that precedent: the four-day clock runs from the internal materiality determination, and when that determination itself stays open, filers can find themselves issuing repeated amendments rather than one clean disclosure.
A serial filer keeps materiality open
River Financial Corporation, parent of a small Alabama bank, first disclosed a ransomware attack on 25 June 2026, three days after the 19 June intrusion, without confirming whether customer data had been stolen. It filed a fifth disclosure, an amended Form 8-K, on 30 July, still unable to determine whether the breach is material or whether personal data was taken, resting part of its assessment on the attacker's own claim that the stolen data was deleted .
The case extends the precedent set by West Pharmaceutical Services, which crossed the SEC's materiality threshold in May 2026 through operational disruption alone, without any ransom-group attribution at filing . River Financial's repeated amendments show the four-business-day clock can run for weeks in practice when materiality itself stays genuinely unresolved.