Company: L
Filing Date: 2025-02-11
Form Type: 10-K
Source: 0000060086-25-000036
Chunk: 209

Company: LOEWS CORP
Filing Date: 2025-02-11
Form: 10-K
Item: Item 1A
Chunk 209
---
 or experiences an interruption. If sustained or repeated, such events could result in a deterioration of CNA’s ability to perform necessary business functions.

The foregoing risks could expose CNA to monetary and reputational damages. Potential additional exposures relating to significant interruptions to CNA’s operations may include substantially increased compliance costs, as well as increased costs relating to investments in computer system and security-related upgrades, and such costs may not be recoverable under its relevant insurance coverage. CNA has made, and continues to make, investments to improve its security and infrastructure.

If CNA’s business continuity plans or system security do not sufficiently address these risks, they could have a material adverse effect on CNA’s business, results of operations and financial condition.

Any significant breach in CNA’s data security infrastructure or its vendors’ facilities or systems could disrupt business, cause financial losses and damage its reputation, and insurance coverage may not be available for claims related to a breach.

A significant breach of CNA’s data security infrastructure may result from actions by its employees, vendors, third-party administrators, or unknown third parties or through cyber attacks. The risk of a breach can exist whether software services are in CNA’s or third party administered data centers or are cloud-based software services. The sophistication of cybersecurity threats continues to escalate, and the measures CNA takes to mitigate the risk of cyber incidents and to safeguard its systems and data may be insufficient. Further, the increasing use of artificial intelligence, both within CNA’s systems to achieve operational efficiencies and within threat actors’ attack strategies, may further expose its systems to the risk of cyber-attacks. Breaches have occurred, and may occur again, in CNA’s systems and in the systems of its vendors and third-party administrators, both current and former, in that past vendors and third-party administrators may still retain certain confidential and sensitive information in their systems.  During the third quarter of 2024, CNA was notified of a data breach resulting from a ransomware attack that impacted a former vendor. This incident resulted in required breach notifications to CNA’s impacted long-term care policyholders, with such notifications made by the subject vendor. In the same quarter, CNA was notified of a data breach resulting from a ransomware attack that impacted a current vendor. This incident resulted in required breach notifications to impacted individuals, which included insurance claimants and their representatives, with such notifications made by the subject vendor.

Breaches could affect CNA’s data framework or cause a failure to protect the personal information of its customers, claimants or employees