MisuseFinancial ServicesFinancePrivilege AbuseEmployee Data InvolvedCustomer Data InvolvedPIIIdentity (basic)Government IDMediumContained

River City Bank, Inc.

bd_7743644ed47174dc · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 29, 2020

Filed

Nov 20, 2020

To disclose

7 weeks

Affected

20state residents only

Linked

4 filings

Confidence

66%

Full breach record for River City Bank, Inc. →

River City Bank notified customers of an insider threat incident where an employee downloaded customer personal information (including SSNs and driver's licenses) to a personal drive and sent it to a third party. The bank discovered the unauthorized activity on September 29, 2020, restricted access, reported to law enforcement, and engaged forensic investigators. Affected individuals were offered two years of identity monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 7 weeks / 52 days

Sep 29, 2020

Discovered

Nov 20, 2020

Filed

vs. sector median

1 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Maine State AGbd_01b6e71c40f1563f2020-11-20Candidate
California State AGbd_1e5cabd0f65b2b872020-11-20Verified
Massachusetts State AGbd_25f4818f23943c702020-11-20Verified

Name: River City Bank, Inc.
norm: river city bank

Name: River City Bank, Inc.
norm: river city bank
Industry: Financial Servicesllm

Discovered: Sep 29, 2020
Materiality determined: —
Notification sent: Nov 4, 2020
Affected individuals: 20state-resident count only
Data types: PIIIdentity (basic)Government ID
Attack vector: Insider
MITRE ATT&CK: T1078 Valid AccountsT1052 Exfiltration Over Physical Medium
Threat actor: Internal
Regulator citations: Reported the incident to law enforcement
Initial access: insider_action

During the incident: Restricted the employee’s system access
Reported the incident to law enforcement
Engaged a forensic investigation firm
Offered complimentary identity monitoring services for two years through Kroll
Changes made: Implementing additional security measures
Training and educating employees on information security and data protection
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(52 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Maine State AGNov 20 · first

California State AGNov 20 · first

Massachusetts State AGNov 20 · first

Montana State AGNov 20 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/rivercitySamp.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 20, 2020
Raw hash: 02bdfd66b2b7bd8fb8e1d1c6d921cbc1142c05344de74ef975b6a13f354dfbd8

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityRiver City Bank, Inc.

Victim entityRiver City Bank, Inc.

Incidentdiscovered Sep 29, 2020

Stated responseRestricted the employee’s system access

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov