World news and discussion on TalkFuse.
US bank places trust in ransomware crew that promised to delete its data
River Financial Corporation told US regulators it had sought assurances from the ransomware group behind a June attack that stolen data had been deleted. The disclosure matters because ransomware gangs have previously retained victim data despite payments or deletion promises, leaving affected organisations exposed to further extortion and data leaks.
The bank took systems offline, disabled administrator accounts and hired external responders after discovering ransomware on parts of its servers. It said by 10 July that data had been removed from its environment, but has not confirmed the attackās full scope or whether it paid a ransom; four class-action lawsuits have since been filed.
In short
- River Bank relied on ransomware criminalsā deletion assurances.
- The attack involved data removed from bank systems.
- Four class actions followed the incident.
Steelman: both sides, in good faith
The strongest fair case each way ā we don't pick a winner.
The case for
Once ransomware compromises an organisation, pragmatic crisis management becomes necessary. The bank's responseātaking systems offline, hiring external responders, and seeking documented deletion assurancesārepresents a reasonable attempt to mitigate harm given limited options. Obtaining written commitments from threat actors, whilst imperfect, provides documentation for customers, regulators and insurers, and represents a recognised incident response tactic when breaches cannot be prevented.
The case against
The bank's trust in ransomware crews to delete stolen data contradicts extensive documented evidence that such gangs routinely retain victim information despite assurances, leaving organisations perpetually vulnerable to further extortion and leaks. This pragmatic approach fails to adequately protect customer data and rewards attackers, incentivising more ransomware campaigns. True accountability should address the bank's security failures enabling the breach, not rely on trust in demonstrably unreliable actors.
Explained simply
Ransomware is a type of cyberattack in which criminals lock or steal an organisationās data and demand money. Even if a victimās systems are restored, copies of stolen information may remain with the attackers.
River Financial Corporation is a US bank that reported a ransomware attack in June. It told regulators it sought assurances that the group responsible had deleted data taken in the attack; such promises can be difficult to verify.
The incident matters because stolen customer or business information can be used for further demands or released publicly. The bank has not confirmed the full scope of the attack or whether it paid a ransom, and four class-action lawsuits have been filed.
Americas Cybersecurity Technology World