Company: HBAN
Filing Date: 2025-07-29
Form Type: 10-Q
Source: 0000049196-25-000063
Chunk: 103

Company: HUNTINGTON BANCSHARES INC /MD/
Filing Date: 2025-07-29
Form: 10-Q
Item: Part I, Item 2
Chunk 103
---
 prompt and effective manner with the goal of minimizing disruptions to our business. We actively monitor cyberattacks, such as attempts related to online deception and loss of sensitive customer data. We evaluate our technology, processes, and controls to mitigate loss from cyberattacks and, to date, have not experienced any material losses. Cybersecurity threats continue to evolve and increase across the entire digital landscape. We actively monitor our environment for malicious content and implement specific cybersecurity and fraud capabilities, including the monitoring of phishing email campaigns. In addition, we have implemented specific cybersecurity and fraud monitoring of remote connections by geography and volume of connections to detect anomalous remote logins, since a significant portion of our workforce works remotely from time-to-time. 

Our objective for managing cybersecurity risk is to avoid or minimize the impacts of both internal and external threat events or other efforts to penetrate our systems. We work to achieve this objective by hardening networks and systems against attack, and by diligently managing visibility and monitoring controls within our data and communications environment to recognize events and respond before the attacker has the opportunity to plan and execute on its own goals. To this end, we employ a set of defense-in-depth strategies, which include efforts to make us less attractive as a target and less vulnerable to threats, while investing in threat analytic capabilities for rapid detection and response. Potential concerns related to cybersecurity may be escalated to our board-level ROC and/or Technology Committee, as appropriate. 

As a complement to the overall cybersecurity risk management, we use a number of internal training methods, both formally through mandatory courses and informally through written communications and other updates, to ensure awareness of the risks of cybersecurity threats at all levels across the organization. Internal policies and procedures have been implemented to encourage the reporting of potential phishing attacks or other security risks. We also use third-party services to test the effectiveness of our cybersecurity risk management framework, and any such third-parties are required to comply with our policies regarding information security and confidentiality. 

2025 2Q Form 10-Q     29

Table of Contents

Compliance Risk

Financial institutions are subject to many laws, rules, and regulations at both the federal and state levels. These broad-based laws, rules, and regulations include, but are not limited to, expectations relating to anti-money laundering, lending limits, client privacy, fair lending, prohibitions against unfair, deceptive, or abusive acts or practices, protections for military members as they enter active duty, and community reinvestment. As such, we utilize various resources to help ensure expectations are met, including a team of