We are exposed to risks related to fraud and cyber-attacks.
Cybersecurity, and the continued development and enhancement of controls, processes, and practices designed to
protect customer information, systems, computers, software, data, and networks from attack, damage, or unauthorized access
remain a priority for the Company. As cybersecurity threats continue to evolve, we may be required to expend additional
resources to continue to enhance, modify, and refine our protective measures against these evolving threats.
We are continuously enhancing and expanding our digital products and services to meet customer and business needs
with desired outcomes. These digital products and services often include storing, transmitting, and processing confidential
customer, employee, financial, and business information. Due to the nature of this information, and the value it has for internal
and external threat actors, we, and our third-party service providers, continue to be subject to cyber-attacks and fraud activity,
including through the use of rapidly evolving AI technologies, that attempts to gain unauthorized access, misuse information
and information systems, steal information, disrupt or degrade information systems, spread malicious software, and other illegal
activities.
We believe we have robust preventive, detective, and administrative safeguards and security controls to minimize the
probability and magnitude of a material event. However, if we are unable to maintain them, we may fall victim to a material
adverse cybersecurity event. Because the tactics and techniques used by threat actors to bypass safeguards and security controls
change frequently, and often are not recognized until after an event has occurred, we may be unable to anticipate future tactics
and techniques, or to implement adequate and timely protective measures. The use of AI technologies by cybercriminals
continues to be a major concern, as deep-fake technologies continue to improve, allowing bad actors to manipulate or fabricate
visual and audio content and convincingly fake identities.
We are subject to additional risk with respect to third-party vendors that process or handle personal and financial data
of our customers, partners, suppliers or employees. These third-party vendors may themselves use other vendors to store or
process our data, which further elevates our risk exposure. Our third-party vendors have been, and may in the future be, subject
to security incidents, including those caused by computer viruses, malware, ransomware, phishing attempts, social engineering,
hacking or other means of unauthorized access. Control failures of security measures managed by our third-party service
providers could cause us to suffer damage to our reputation and could require us to incur substantial expenses, which could
have a materially adverse effect on our business, financial condition, and results of operations.
To date, we have no knowledge of a material cyber-attack or other material information security incident affecting the
systems we operate and control. However, our risk and exposure to these matters remains heightened because of, among other
things, the evolving nature of these threats, the continuation of a remote or hybrid work environment for our employees and
service providers, and our plans to continue to implement and expand digital banking services, expand operations, and use
third-party information systems that includes cloud-based infrastructure, platforms, and software. Recent instances of attacks
specifically targeting banks and financial services businesses indicate that the risk to our systems remains significant. We, and
our third-party providers, are regularly the subject of attempted attacks and the ability of the attackers and the method of their
attacks continues to grow in sophistication. Threat actors, including nation state attackers, could also use artificial intelligence
for malicious purposes, increasing the frequency and complexity of their attacks. Potential threats to our technologies, systems,
networks, and other devices, as well as those of our employees, third party vendors, and other third parties with whom we
interact, include Distributed Denial of Service ("DDoS") attacks, computer viruses, hacking, malware, ransomware, credential
stuffing, phishing, and other forms of social engineering. Such cyber-attacks and other security incidents are designed to lead to
various harmful outcomes, such as unauthorized transactions against our customers’ accounts, unauthorized or unintended
access to confidential information, or the release, gathering, monitoring, disclosure, loss, destruction, corruption, disablement,
encryption, misuse, modification or other processing of confidential or sensitive information (including personal information),
intellectual property, software, methodologies or business secrets, disruption, sabotage or degradation of service, systems or
networks, or other damage. These threats may derive from, among other things, error, fraud or malice on the part of our
employees, insiders, or third parties or may result from accidental technological failure. Any of these parties may also attempt
to fraudulently induce employees, service providers, customers, partners or other third-party users of our systems or networks to
disclose confidential or sensitive information (including personal information) in order to gain access to our systems, networks
or data or that of our customers, partners, or third parties with whom we interact, or to unlawfully obtain monetary benefit
through misdirected or otherwise improper payments or through the creation of false identifies. A cyber-attack or other security
incident on the systems we operate and control could cause us to suffer damage to our reputation, result in productivity losses,
require us to incur substantial expenses, including response costs associated with investigation and resumption of services,
remediation expenses costs associated with customer notification and credit monitoring services, increased insurance premiums,
regulatory penalties and fines, and costs associated with civil litigation, any of which could have a materially adverse effect on
our business, financial condition, and results of operations.
We also face additional costs when our customers become the victims of cyber-attacks. For example, various retailers
have reported that they have been the victims of a cyber-attack in which large amounts of their customers’ data, including debit
