River Financial Corporation filed an amended Form 8-K with the SEC on 30 July, its fifth disclosure on the same ransomware intrusion, and again reported that it has not determined whether the incident is reasonably likely to have a material effect on its business or financial condition1. Whether personally identifiable information was affected also remains undetermined. An 8-K is the filing a US public company uses to tell investors about events they would want to know before trading; an amendment updates one already made, which is why the count of filings on a single incident can climb.
One sentence in the filing carries more weight than the rest. River obtained representations from the threat actor that it deleted the exfiltrated data2. The company is telling its shareholders, in a document filed with a federal regulator, that part of what it knows about the fate of its stolen files comes from the party that stole them. No independent verification of a deletion claim exists, and none is available: files copied out of a network leave no trace when they are or are not destroyed elsewhere.
The sequence matters as much as the content. River's fourth update on 17 July also left materiality open, which puts two disclosure cycles between the same unanswered question. Each amendment resets the clock in practice without resolving anything, and an investor reading the series learns that the company has counsel, a forensics engagement and no conclusion. The negotiation with the intruder, meanwhile, has produced the only statement anyone has about where the data now sits.
