Poca Valley Bank listed on Storm ransomware leak site

• Ransomware group: Storm
• Country: United States
• Sector: Financial Services
• Announcement date: September 30, 2026

Storm ransomware group claims data breach at Poca Valley Bank

The threat actor group known as Storm has listed Poca Valley Bank on its leak site, claiming to possess a significant volume of stolen information. According to the announcement, the group alleges that the institution's data has been compromised, marking a potential security incident for the West Virginia-based financial entity. The listing was made public on September 30, 2026, though the group claims the actual attack occurred on September 28, 2026.

In many modern ransomware campaigns, threat actors utilize leak sites to host stolen data as a form of double extortion. In these scenarios, attackers not only encrypt an organization's internal systems but also threaten to release sensitive information to the public if a ransom is not paid. This tactic is designed to maximize pressure on the victim by leveraging the threat of reputational damage and regulatory scrutiny. While information regarding the Storm group remains limited, their method suggests an intent to exert pressure through the public publication of data.

Details of the alleged data theft

The Storm group has provided specific details regarding the scale of the alleged breach. The group claims to have access to a dataset totaling 59.3 GB. This massive collection of information is reportedly composed of 76,647 files and 7,254 folders. To support their claims, the group has provided 20 image proofs, which are claimed to be financial documents and corporate records.

The specific types of data identified in the listing include:

• Financial documents
• Corporate records

At this stage, the exact nature of the files remains unverified, and the group has not issued a ransom demand according to the available information.

About Poca Valley Bank

Poca Valley Bank is a financial institution based in West Virginia that provides a wide range of banking services. The institution's offerings include personal and business checking and savings accounts, various loan products, and online banking solutions. The bank focuses on providing customer-oriented services through various digital and physical channels, such as mobile banking and cash management solutions.

Potential risks and industry implications

The claim against Poca Valley Bank may pose significant secondary risks, particularly for the institution's customers and employees. The potential exposure of sensitive information can lead to risks such as identity theft and fraud. Because the organization operates within the financial services sector, the alleged leaked data could contain highly sensitive customer information. Such a breach could potentially lead to legal proceedings under relevant US data protection laws and banking regulations.

Furthermore, the incident could have a negative impact on the institution's operational reputation and may result in a loss of customer trust. There is also a possibility that the leaked data could be utilized by malicious actors in targeted phishing attacks, where attackers use stolen details to craft convincing fraudulent communications.

For organizations in the financial sector, maintaining robust defensive postures is critical. This typically involves implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular security awareness training for employees. Additionally, continuous monitoring of network traffic and maintaining offline, immutable backups are standard industry practices to mitigate the impact of ransomware and data exfiltration attempts.