Poca Valley Bank Listed by Storm Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On September 29, 2026, the ransomware group known as Storm listed Poca Valley Bank on its leak site. That listing is an unverified claim by the group. As of writing, Poca Valley Bank has not publicly confirmed that an incident occurred, that systems were accessed, or that any customer or internal data left its control. Public detail beyond the existence of the listing is limited.

For customers and counterparties of a community bank, a leak-site claim still matters because it raises the possibility of exposure of financial and identity-related information. Until the bank or a regulator confirms otherwise, the responsible approach is to treat the listing as an allegation, watch for official statements, and take proportionate personal precautions if you bank with the institution.

What the listing says

According to the listing attributed to Storm, Poca Valley Bank appears among organizations the group has named on its leak site. The reported summary associated with the claim describes the institution as a FinTech-oriented bank based in Roane County, West Virginia, United States, offering personal and business checking and savings accounts, loans, and online and mobile banking services. The listing does not, in the material available for this report, provide a confirmed count of people affected, a technical description of how access was supposedly obtained, a timeline of intrusion, or an inventory of files.

Data types named as exposed are not disclosed in the available record. The number of people affected is unknown. Method, ransom demand, negotiation status, and whether any sample files were posted are likewise undisclosed in the facts at hand. Storm’s placement of a name on a leak site is a form of pressure common to extortion crews; it is not independent verification that theft occurred or that published descriptions of “what was taken” are accurate.

Poca Valley Bank has not, as of writing, publicly confirmed the incident. Readers should separate the group’s marketing language on its site from established fact.

Inside Storm

Storm is known in public reporting as a ransomware and data-extortion operation: actors who seek to encrypt systems, exfiltrate copies of data, or both, then threaten publication on a leak site to coerce payment. Like other groups in this category, Storm’s public face is typically a blog or portal where victims are named and, in some cases, file samples or archives are advertised. Listings can be incomplete, recycled, exaggerated, or false; crews have incentives to inflate impact.

Well-documented patterns across this class of actor include double-extortion (encryption plus leak threats), use of initial access such as compromised credentials or vulnerable remote services in many campaigns industry-wide, and timed publication deadlines. None of those general patterns should be read as a proven playbook for this specific listing. For Poca Valley Bank, the only incident-specific assertion in the available facts is that Storm has listed the bank. Claims about what Storm obtained from this victim, if anything, remain the group’s unverified statements.

Who is Poca Valley Bank?

Poca Valley Bank is described in the available summary as a bank serving individuals and businesses, with a footprint tied to Roane County, West Virginia, and a product set that includes checking and savings accounts, loans, and digital channels such as online and mobile banking and cash management. Community and regional banks typically sit at the center of local deposits, lending, and payment activity. They hold customer identity and account records as a normal part of regulated banking, and they connect to payment networks, core processors, and business clients.

A leak-site claim involving a bank is consequential because banking relationships concentrate sensitive personal and commercial information and because trust and continuity of service matter to depositors and borrowers. That consequence follows from the role of the institution, not from any confirmed outcome of this listing. Whether Storm’s claim reflects a new intrusion, an older event, misattribution, or bluff is not established in public confirmation from the bank or regulators in the material provided.

What was likely exposed

The facts state that data types named as exposed are not disclosed, and the number of people affected is unknown. It is therefore not possible to state what, if anything, was taken. Asserting a specific inventory would repeat attacker marketing without evidence.

If files from a bank of this type were ever obtained by an unauthorized party, organizations in this sector typically hold records such as customer names and contact details, government identifiers used for account opening and tax reporting, account numbers and transaction histories, loan and underwriting files, business banking and treasury information, and internal employee or vendor records. Those are sector norms, not a finding about this listing. Exact contents tied to Storm’s claim remain unconfirmed.

Conditional risk discussion is the appropriate frame: if customer banking data were involved, identity theft, account takeover attempts, and targeted phishing are the usual concerns; if only internal or limited files were involved, the direct customer impact could be narrower. Neither scenario is established here.

What's at stake

For individuals, the stake in any genuine banking-data exposure is practical rather than abstract: fraudulent applications for credit, social-engineering calls that reference real account details, password-reset and account-takeover attempts, and long-lived misuse of static identifiers. For businesses that bank with the institution, cash-management credentials, payroll instructions, and vendor payment details—if they were ever in scope—could be misused in payment diversion schemes. Again, these are risks that apply if relevant data were actually obtained and misused; they are not proof that such data left Poca Valley Bank.

For the organization, a public extortion listing can create reputational pressure, customer inquiries, and regulatory attention even when claims are disputed or unproven. Leak-site posts do not by themselves establish negligence, encryption of production systems, or successful exfiltration. They establish that a named crew has chosen to associate the bank’s name with a threat of publication.

Uncertainty itself is part of the picture: unknown affected counts and undisclosed data types mean customers cannot yet map the claim to a precise personal exposure. Official communication from the bank, card networks, or regulators—if and when it appears—would be the source for confirmed scope.

If your data was involved

If you are a Poca Valley Bank customer and you want to act on a precautionary basis while the claim remains unconfirmed, start with basics: monitor account activity and statements closely; enable strong, unique passwords and multi-factor authentication on banking and email accounts; be skeptical of unexpected calls, texts, or emails that cite a “breach” and push for credentials, codes, or urgent payments; and consider freezes or fraud alerts with major credit bureaus if you are concerned about identity misuse. Report suspicious transactions to the bank through official channels you look up independently, not through links in unsolicited messages.

Do not assume your data is in criminal hands solely because of a leak-site name. Treat steps as conditional on possible involvement. You can also run a free exposure scan of your email to check whether your information has already surfaced in known breach datasets elsewhere, which can help separate this unverified listing from other, documented exposures.

Continue to watch for statements from Poca Valley Bank and from relevant authorities. Until confirmation exists, Storm’s listing should be read as an allegation by an extortion group, not as a settled account of what happened to the bank or its customers.

AICompiled with AI assistance from public sources and published under our editorial standards.