River Financial Corporation told US regulators it had sought assurances from the ransomware group behind a June attack that stolen data had been deleted. The disclosure matters because ransomware gangs have previously retained victim data despite payments or deletion promises, leaving affected organisations exposed to further extortion and data leaks.

The bank took systems offline, disabled administrator accounts and hired external responders after discovering ransomware on parts of its servers. It said by 10 July that data had been removed from its environment, but has not confirmed the attack’s full scope or whether it paid a ransom; four class-action lawsuits have since been filed.