Company: MCHB
Filing Date: 2025-03-07
Form Type: 10-K
Source: 0001518715-25-000026
Chunk: 33

Company: Mechanics Bancorp
Filing Date: 2025-03-07
Form: 10-K
Item: Item 1A
Chunk 33
---
 other critical business activities such as core systems processing, essential web hosting and deposit and processing services, as well as security solutions, are provided by third party vendors. If those providers fail to update their systems or services in a timely manner to reflect new or changing regulations, or if our personnel operate these systems in a non-compliant manner, our ability to meet regulatory requirements may be impacted and may expose us to heightened regulatory scrutiny and the potential for monetary penalties. These vendors are also sources of operational and informational security risk to us, including from interruptions or failures of their own systems, cybersecurity or ransomware attacks, capacity constraints or failures of their own internal controls. Such third parties are targets of cyber-attacks, computer viruses, malicious code, unauthorized access, hackers, ransomware attacks or information security breaches that have compromised and could again in the future compromise the confidential or proprietary information of HomeStreet and our customers.

The failure to protect our customers' confidential information, data and privacy could adversely affect our business.

We are subject to federal and state privacy regulations and confidentiality obligations, including the California Consumer Privacy Act of 2018 and the California Privacy Rights Act of 2020, that, among other things restrict the use and dissemination of, and access to, certain information that we produce, store or maintain in the course of our business and establishes a new state agency to enforce these rules. We also have contractual obligations to protect certain confidential information we obtain from our existing vendors and customers. These obligations generally include protecting such confidential information in the same manner and to the same extent as we protect our own confidential information, and in some instances may impose indemnity obligations on us relating to unlawful or unauthorized disclosure of any such information.

The continued development and enhancement of our information security controls, processes and practices designed to protect customer information, our systems, computers, software, data and networks from attack, damage or unauthorized access remain a priority for our management as we increase our online and mobile banking offerings. As cyber threats continue to evolve, including supply chain risks, our costs to combat the cybersecurity threat may also increase. Nonetheless, our measures may be insufficient to prevent all physical and electronic break-ins, denial of service and other cyber-attacks or security breaches.

If we do not properly comply with privacy regulations and contractual obligations that require us to protect confidential information, or if we experience a security breach or network compromise, we could face regulatory sanctions, penalties or fines, increased compliance costs, remedial costs such as providing credit monitoring or other services to affected customers, litigation and damage to our reputation