Cybersecurity incident disclosed by River Financial Corp in a Form 8-K (June 2026)

Material Cybersecurity Incidents. On or about June 16, 2026, an unauthorized threat actor gained access to the network environment of River Financial Corporation, including River Bank & Trust (together, “River”). River identified the activity on or about June 19, 2026, and determined that ransomware had been deployed across portions of its server environment. River promptly took containment measures, including disabling affected administrative accounts and taking impacted systems offline. River, with the assistance of a third-party forensic firm, is investigating the nature and scope of the incident, including whether any personally identifiable information was subject to unauthorized access or exfiltration. That investigation is ongoing. As of the date of this filing, the full nature, scope, and impact of the incident have not yet been determined. River has not yet determined whether the incident is reasonably likely to materially impact its business or financial condition. Certain operations have been impacted, but River is working with external cybersecurity professionals to fully restore these operations. River will file an amendment to this Current Report on Form 8-K within four business days after it determines that such information is available

Material Cybersecurity Incidents. Since the date of the original filing, River’s investigation has progressed. River has reason to believe that certain data was potentially impacted and is working to determine the nature and scope of the information involved, including whether any personally identifiable information was affected. To date, there is no evidence that accounts have been impacted. As of the date of this filing, the full nature, scope, and impact of the incident have not yet been determined. River has not yet confirmed whether the incident is reasonably likely to materially impact its business or financial condition. River will file an amendment to this Current Report on Form 8-K within four business days after it determines that such information is available

Material Cybersecurity Incidents. Since the date of the original filing, River's investigation has progressed. River has determined that an unauthorized threat actor accessed portions of its network and removed certain data from its environment. River is working to determine the nature and scope of the information involved, including whether any personally identifiable information was affected. To date, River is not aware of any reports of fraud as a direct result of this incident. Following public disclosure of the incident, two class action lawsuits were filed against River relating to the incident. River is evaluating the complaints and intends to respond in ordinary course. Additional claims or litigation relating to the incident may be asserted. As of the date of this filing, the full nature, scope, and impact of the incident have not yet been determined. River has not yet confirmed whether the incident is reasonably likely to materially impact its business or financial condition. River will file an amendment to this Current Report on Form 8-K within four business days after it determines that such information is available

Material Cybersecurity Incidents. As set forth in its Form 8-K filed July 10, 2026, two class action lawsuits were filed relating to the unauthorized threat actor gaining access to the network environment of River Financial Corporation, including River Bank & Trust (together, “River”). A third class action was filed against River on July 10, 2026 and a fourth class action was filed against River on July 16, 2026. The principal issue in each case is whether cybercriminals have acquired access to River’s customers’ personal identifiable information. As of the date of this filing, River has not yet determined the full nature, scope and impact of the incident. In addition, it has not yet been confirmed whether the incident is reasonably likely to materially impact business or the financial condition of River. River will file an amendment to this Current Report on Form 8-K within four business days after it determines that any of the forgoing information is available

Material Cybersecurity Incidents. Since the date of the original filing, River's investigation has progressed. River has determined that an unauthorized threat actor accessed portions of its network and removed certain data from its environment. River is working to determine the nature and scope of the information involved, including whether any personally identifiable information was affected. As part of its response, River took steps to attempt to suppress the affected data, including obtaining representations from the threat actor that it deleted the data in its possession. As of the date of this filing, the full nature, scope, and impact of the incident have not yet been determined. River has not yet confirmed whether the incident is reasonably likely to materially impact its business or financial condition. River will file an amendment to this Current Report on Form 8-K within four business days after it determines that such information is available