Company: ISBA
Filing Date: 2025-03-12
Form Type: 10-K
Source: 0000842517-25-000053
Chunk: 29

Company: ISABELLA BANK CORP
Filing Date: 2025-03-12
Form: 10-K
Item: Item 1C
Chunk 29
---
Item 1C. Cybersecurity.

Cybersecurity Risk

As a financial institution, we may be the target of a security breach due to a cybersecurity attack.  While we have not encountered a cybersecurity incident that has materially impacted our operations or financial results, a security breach due to a cyber-attack in the future could result in a material impact to us, our customers, and our third-party vendors.  The risk of such event could increase in the future due to the expansion of mobile banking and other internet-based product offerings, our use of internet-based services for internal and external purposes, acquisition and integration of new products and other offerings, increased use of third-party software solutions, and the growing customer reliance on mobile devices.

Cybersecurity incidents have increased in number and severity and it is expected that these trends will continue.  Techniques used in cyber-attacks evolve frequently, are increasingly sophisticated, and may not be recognized until launched.  Cyber-attacks can originate from a wide variety of sources, including both internal and external sources, cyber-criminals, hacktivists, groups linked to terrorist organizations or hostile countries, or third parties whose objective is to broadly disrupt the operations of financial institutions.  We may be unable to fully prevent cyber-attacks due to the inability to anticipate, detect, or recognize threats to our systems, or to implement effective preventative measures against all breaches.  In addition, we do not have control over the cybersecurity of the systems of our customers, counterparty, and third-party service providers.

Our products, services and systems are accessed through critical company or third-party operations.  These operations involve the storage, processing and transmission of sensitive data, including proprietary or confidential data, regulated data, and personal information of employees and customers.  Successful breaches, employee wrongdoing, or human or technological error could result in unauthorized access, disclosure, modification, misuse, loss, or destruction of company, customer, or other third-party data or systems.  Examples of a breach include theft of sensitive, regulated, or confidential data, including personal information; loss of access to critical data or systems through ransomware, destructive attacks, or other means; and business delays, service or system disruptions, or denials of service.

Should we, or the third parties we do business with, fall victim to successful cyber-attacks or experience other cybersecurity incidents, the result could include negative consequences.  Such consequences could include, but are not limited to: significant disruption of our operations and those with whom we do business, including losing access to important business