River City Bank rivercitybank.com River City Bank data breach: what happened and what to do
River City Bank said an employee downloaded customer data on September 29, 2020 and later sent it to a third party. The Maine Attorney General lists 17,654 people affected. The data included names, Social Security numbers and financial account numbers. Letters went out from November 20, 2020.
View all 13,177 breaches- Breach date
- 29 Sept 2020
- Made public
- 20 Nov 2020
- Affected
- 17,654
- Data exposed
- Names, Social Security numbers, Bank account numbers
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
River City Bank, a Sacramento, California bank, told customers it found unauthorized activity by one of its own employees on September 29, 2020. According to its notice, the employee downloaded customer data to a personal storage drive and later sent the information to a third party. The bank says it restricted the employee's access to its systems and reported the incident to law enforcement.
Notification letters began going out on November 20, 2020. The Maine Attorney General's breach listing puts the total at 17,654 people.
Sources checked: oag.ca.gov, maine.gov, identitytheft.gov
Last verified against the official page:
What was exposed
The bank's review found database files holding names, Social Security numbers and financial account numbers. The California Attorney General hosts the notice letter.
That combination matters more than a leaked email address. A name with a Social Security number is what someone needs to apply for credit in your name, and an account number gives scammers a convincing reason to call pretending to be your bank.
The bank's response
River City Bank offered a two-year membership in credit monitoring and identity theft protection through Kroll. It said it had no evidence the data had been misused. The notice doesn't say who received the data.
If you got a letter, the Social Security number is the part to act on. A credit freeze is the strongest step you can take yourself.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A credit freeze is free and stops lenders from seeing your credit report, which blocks most new accounts in your name. Place it separately at Equifax, Experian and TransUnion, as the FTC explains.
- 2
Use the free monitoring if you were offered it
River City Bank offered a two-year Kroll membership; use the enrollment steps in your letter. The FTC recommends taking free credit monitoring when a company offers it. Monitoring alerts you to new activity but doesn't block it, so pair it with a freeze.
- 3
Watch your bank account
Review statements for charges you don't recognize, and ask the bank about extra verification on your accounts if you want it.
- 4
Expect scams that mention the breach
Criminals use real details to sound convincing. Treat unexpected calls, texts or emails about this breach, your account or your health coverage as suspect, and contact the company on a number or site you look up yourself.
- 5
Check your credit reports and statements
Review your reports for free at annualcreditreport.com and read bank statements for charges you don't recognize. If someone uses your details, report it at IdentityTheft.gov to get a recovery plan.
- 6
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It checks breach databases for your email, phone and other details, and Serus keeps watching and alerts you if they turn up in a new leak.
Official filings
- California Attorney General , filed 20 Nov 2020
Timeline
-
The breach happened
-
The company made it public
-
Reported to the California Attorney General
Frequently asked
Was I affected by the River City Bank data breach?
Letters went to affected people starting November 20, 2020. If you didn't get one, you can contact the bank to ask. The Maine Attorney General lists 17,654 people affected in total.
What was exposed?
Names, Social Security numbers and financial account numbers, according to the bank's notice.
Do I need to freeze my credit?
A Social Security number was in the data, so a freeze is worth doing. It's free and you can lift it when you apply for credit.
Was the data used for fraud?
River City Bank said it had no evidence of misuse. The notice doesn't say who received the data.
Sources
- oag.ca.gov/system/files/River%20City%20-%20California%20Notice.pdf
- maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/6cc9729d-fb7b-462e-89e9-654e22dcf7d4.shtml
- identitytheft.gov/databreach
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- annualcreditreport.com
Something wrong or out of date? Tell us and we'll re-check it.
