Company: WTFCN
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0001015328-25-000093
Chunk: 228

Company: WINTRUST FINANCIAL CORP
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1A
Chunk 228
---
 vendors, activists and other external parties, including those involved in corporate espionage. Even the most advanced internal control environment may be vulnerable to compromise. Targeted social engineering attacks and "spear phishing" attacks are 

40

becoming more sophisticated and are extremely difficult to prevent. In such an attack, an attacker will attempt to fraudulently induce colleagues, customers or other users of our systems and networks to disclose sensitive information (including confidential, personal, proprietary and other information) in order to gain access to its data or that of its clients. Persistent attackers may succeed in penetrating defenses given enough resources, time, and motive. The techniques used by cyber criminals change frequently and may not be recognized until launched or until well after a breach has occurred. The risk of a security breach caused by a cyber-attack, information security breach or other similar incident at a vendor or by unauthorized vendor access has also increased in recent years. Additionally, the existence of cyber-attacks, information security breaches or other similar incidents at third-party vendors with access to our data may not be disclosed to us in a timely manner. While we generally perform cybersecurity diligence on our key vendors, because we do not control our vendors and our ability to monitor their cybersecurity is limited, we cannot ensure the cybersecurity measures they take will be sufficient to protect any information we share them. Due to applicable laws and regulations or contractual obligations, we may be held responsible for cyber-attacks, information security breaches or other similar incidents attributed to our service providers as they relate to the information we share with them.

We also face indirect technology, cybersecurity and operational risks relating to the customers, clients and other third parties with whom we do business or upon whom we rely to facilitate or enable our business activities, including, for example, financial counterparties, regulators and providers of critical infrastructure such as internet access and electrical power. As a result of increasing consolidation, interdependence and complexity of financial entities and technology systems, a technology failure, cyber-attack, information security breach or other similar incident that significantly degrades, deletes or compromises the systems, networks or data of one or more financial entities could have a material impact on counterparties or other market participants, including us. This consolidation, interconnectivity and complexity increases the risk of operational failure, on both individual and industry-wide bases, as disparate systems need to be integrated, often on an accelerated basis. Any third-party technology failure, cyber-attack, information security breach, termination, constraint or other similar incident could, among other things, adversely affect our ability to effect transactions,