SEC Item 1.05 Explained: One Bank, Five Filings, Four Lawsuits

On June 25, River Financial Corporation, the Alabama holding company behind River Bank & Trust, filed a Form 8-K with the SEC. Under Item 1.05, the section reserved for material cybersecurity incidents, it said this:

…determined that ransomware had been deployed across portions of its server environment.

And a few lines later:

…has not yet determined whether the incident is reasonably likely to materially impact its business or financial condition…

Hold on to that second quote, because it never changes. Over the next five weeks River filed four amendments. By the last one, there had been confirmed data theft and four class-action lawsuits, and the company still hadn't said whether any of it was material.

That makes River a perfect way to explain what an Item 1.05 filing actually is, what it tells you, and what it leaves out.

What Item 1.05 is supposed to do

Since December 2023, public companies have had to file an 8-K under Item 1.05 when they experience a cybersecurity incident they determine to be material. The clock is four business days, and it starts when the company decides the incident is material, not when it discovers the attack.

That's the theory. In practice, "material" does a lot of work. In May 2024, the SEC's own staff encouraged companies to disclose incidents they haven't determined to be material under a different item of the 8-K, such as Item 8.01, and to keep Item 1.05 for the ones that are.

River went the other way. It filed under 1.05 while saying it hadn't decided on materiality. You could read that as over-caution or as extra transparency. I lean toward the second, since telling people early is rarely the wrong call. Either way, it means the filing that's supposed to answer "was this material?" spent five weeks not answering it.

One incident, five filings

Here's how River's disclosure unfolded, using only what's in the filings:

1. June 16: unauthorized access begins, according to the original filing
2. June 19: River detects the activity. Ransomware has been deployed across part of its servers, and "certain operations have been impacted."
3. June 25: the original 8-K, four business days after detection
4. July 6: first amendment. River "has reason to believe that certain data was potentially impacted," and says there's "no evidence that accounts have been impacted."
5. July 10: second amendment. The attacker "accessed portions of its network and removed certain data." River isn't aware of any fraud yet. Also: "two class action lawsuits were filed."
6. July 17: third amendment. A third class action was filed on July 10 and a fourth on July 16.
7. July 30: fourth amendment. River "took steps to attempt to suppress the affected data," including "obtaining representations from the threat actor that it deleted the data in its possession."

Read top to bottom, it's a story most breach victims will recognize: an attack, a scramble to find out what was taken, the confirmation that something was taken, and then the lawyers.

A few things jumped out at me.

Read the whole series, not just the latest filing. The original filing describes ransomware; the later amendments describe a "threat actor" that "removed certain data." Each amendment updates part of the picture, so if you only read the most recent one, you'd miss how the incident started.

The lawsuits moved faster than the facts. The first two class actions were filed within about two weeks of the original 8-K, before River had said how many people were affected. (None of the five filings ever gives that number.)

The deletion promise. River says it obtained "representations from the threat actor that it deleted the data in its possession." The filing doesn't describe how. Either way, a criminal's assurance that stolen data is gone is something no one can verify.

To be fair to River, it did something plenty of companies don't: it kept filing. Five updates in five weeks is more information than you get from most breach notices, which tend to say one vague thing once and then go quiet.

What the numbers say

River isn't typical in how often it filed, but it's typical in another way. Here are the Item 1.05 filings in RiversideIQ's database since the rule took effect:

Period	Item 1.05 filings
Dec 2023 – Dec 2024	41
2025	19
Jan – Sep 2026 (so far)	24

That's 84 filings in total, and 26 of them (31%) are amendments. Nearly a third of the "material incident" filings are companies coming back to add what they didn't know the first time. That's one reason you shouldn't treat the first filing as the full story.

The drop after 2024 is striking too. Filings roughly halved in 2025, which lines up with the SEC staff statement steering undecided incidents toward Item 8.01. I can't prove one caused the other, but the timing fits.

And "public company" doesn't mean "giant company." In the last 12 full months, the 21 companies that filed under Item 1.05 included names like Amgen and Stryker, but also small companies like Data I/O and Jewett-Cameron, and three community banks: River Financial, BayFirst Financial, and CB Financial Services.

What this means if you sell security services

Watch the amendments, not just the first filing. The first 8-K is usually the least informed one. The real details show up weeks later, in filings that get a fraction of the attention.

The breached company isn't the only prospect. When a community bank files a ransomware disclosure and gets hit with four class actions in three weeks, every other community bank board in the region hears about it. Those peers are asking "could this be us?", and they haven't been breached yet. That's a much easier conversation than calling the bank that just was.

Small public companies look a lot like your clients. A community bank or a small-cap manufacturer often has an IT team you could count on one hand. When one of them files under Item 1.05, it's a preview of what their unlisted peers are dealing with too.

Read the language, not just the headline. "Has not yet determined whether the incident is reasonably likely to materially impact" is a company telling you it doesn't know yet, and you should read it exactly that way.

The short version

Item 1.05 was meant to make companies say quickly when a cyber incident matters to investors. River Financial's five filings show what that looks like in practice: an honest start, a steady stream of updates, confirmed data theft, four lawsuits, and still no answer to the one question the rule was built around.

Public-company filings are rare, only a few dozen a year, but they're the most detailed breach records you'll find anywhere. Most of the breaches your clients will care about never show up in them. They show up in state Attorney General filings, which is where RiversideIQ spends most of its time.