Company: BCDRF
Filing Date: 2025-02-28
Form Type: 20-F
Source: 0000891478-25-000054
Chunk: 958

Company: Banco Santander, S.A.
Filing Date: 2025-02-28
Form: 20-F
Chunk 958
---
 data breaches, data losses and other security incidents attributed to our vendors as they relate to the information we share with them.

In addition, we may also be impacted by cyberattacks against national critical infrastructures of the countries where we operate, such as telecommunications networks. Our information technology systems are dependent on such critical infrastructure and any cyberattack against such critical infrastructure could negatively affect our ability to service our customers. As we do not operate such critical infrastructure, we have limited ability to protect our information technology systems from the adverse effects of a cyberattack. For further

| 903 |

| Contents |     | Cross-reference to Form 20-F |     | Consolidated director's report |     | Consolidated financial statements |     | Supplemental information |

information see the ' Risk management and compliance ' chapter in Part 1 of this annual report on Form 20-F.

We have seen in recent years the information technology systems and networks of companies and organizations being increasingly targeted, and the techniques used to obtain unauthorized, improper or illegal access to such information technology systems and networks have become increasingly complex and sophisticated, including through the use of AI. Furthermore, such techniques change frequently and are often not recognized or detected until after they have been launched and can originate from a wide variety of sources, including organized crime, hackers, activists, terrorists, nation-states, nation-state supported actors and others, any of which may see their effectiveness enhanced by the use of AI. As attempted attacks continue to evolve in scope and sophistication, we may incur significant costs in order to modify or enhance our protective measures against such attacks, or to investigate or remediate any vulnerability or resulting breach, or in communicating cyberattacks data breaches, data losses or other security incidents to our customers, affected individuals or regulators, as applicable.

If we cannot maintain effective and secure proprietary, confidential, sensitive and personal data, or if we or our third-party vendors fall victim to successful cyberattacks, penetrations, compromises, breaches or circumventions of our information technology systems or networks, such as the 2024 Unauthorized Access, or experience other data breaches, data losses or other security incidents in the future, we may incur substantial costs and suffer other negative consequences, such as disruption to our operations, misappropriation of personal, proprietary, confidential or sensitive information, remediation costs (including liabilities for stolen assets or information, repairs of system damage, among others), increased cybersecurity protection costs, lost revenues arising from the unauthorized use of personal, proprietary, confidential or sensitive information or the failure to retain or attract our customers following an