Company: FITBI
Filing Date: 2025-02-24
Form Type: 10-K
Source: 0000035527-25-000079
Chunk: 386

Company: FIFTH THIRD BANCORP
Filing Date: 2025-02-24
Form: 10-K
Item: Item 1A
Chunk 386
---
 of this nature occurred at Fifth Third or one of its third-party providers and such event proved to be material, this could result in disruptions to Fifth Third’s accounting, deposit, lending and other systems, and adversely affect its customer relationships. While Fifth Third heavily invests in information security, technical resiliency, business continuity and disaster recovery planning, and has policies and procedures designed to detect, limit, and prevent the impact of these possible events, there can be no assurance that any such failure, interruption or security breach will not occur or, if any does occur, that it can be remediated in such a way to eliminate the risk.

There will always be efforts on the part of threat actors to breach information security at financial institutions or with respect to financial transactions. There have been several recent instances involving financial services, credit bureaus and consumer-based companies reporting the unauthorized disclosure of client or customer information or the destruction or theft of corporate data, by both private individuals and foreign governments. In addition, because the techniques used to cause such security breaches change frequently, often are not recognized until launched against a target and may originate from remote and less regulated areas around the world, Fifth Third may be unable to 

27 Fifth Third Bancorp

proactively address these techniques or to implement adequate preventative measures. Threat actors, including nation state attackers, could also use artificial intelligence for malicious purposes, increasing the frequency, complexity and effectiveness of their attacks. Despite Fifth Third’s efforts to prevent a cyber-attack and monitoring of data flow inside and outside Fifth Third, due to the increasing sophistication of techniques used by attackers to conceal access to systems, a successful cyber-attack could persist for an extended period of time before being detected, and, following detection, it could take considerable time for Fifth Third to obtain full and reliable information about the cybersecurity incident and the extent, amount and type of information compromised. During the course of an investigation, Fifth Third may not necessarily know the full effects of the incident or how to remediate it, and actions and decisions that are taken or made in an effort to mitigate risk may further increase the costs and other negative consequences of the incident. Furthermore, financial services companies are regularly the target of cyber-attacks such as distributed denial of service, social engineering and ransomware attacks. The unintentional or willful acts or omissions of employees also remains the primary avenue through which threat actors attempt to gain access to company networks, information systems, data and credentials.

An additional risk is the use of third- and fourth-party providers to host critical data and platforms for