Company: MTB-PJ
Filing Date: 2025-02-19
Form Type: 10-K
Source: 0001628280-25-006267
Chunk: 72

Company: M&T BANK CORP
Filing Date: 2025-02-19
Form: 10-K
Item: Item 1A
Chunk 72
---
. For example, in recent years, there have been a number of widely publicized cases of outages in connection with access to cloud service providers. Thus, increasing the amount of infrastructure that the Company or its vendors and service providers outsource to the cloud or to other parties may increase M&T’s risk exposure. The failure to properly upgrade or maintain the computer systems could result in greater susceptibility to attacks, particularly in light of the greater frequency and severity of attacks in recent years, as well as the growing prevalence of supply-chain attacks affecting software and information technology service providers. Failures related to upgrades and maintenance also increase risks related to unauthorized access and misuse, as well as the Company’s ability to achieve its business continuity and resiliency objectives. 

The Company could incur higher costs, experience lower revenue, and suffer reputational damage in the event of the theft, loss or misuse of information, including due to a cyber attack. 

Like other financial services firms, the systems, networks and devices of the Company, its customers, employees, service providers or other third parties with whom the Company interacts continue to be the subject of attempted unauthorized access, denial-of-service attacks, computer viruses, hacking, malware, ransomware, phishing or other forms of social engineering, and cyber attacks designed to obtain confidential information, destroy data, disrupt or degrade service, eliminate access or cause other damage. These threats may arise from human error, fraud on the part of employees, insiders or third parties or may result from accidental technology failure or vulnerabilities of suppliers through supply-chain attacks. Further, cybersecurity and information security risks for financial institutions have generally increased because of, among other things, the growth of new technologies (including AI), the use of the Internet and telecommunications technologies (including computers, smartphones, and other mobile devices outside the Company’s systems) by customers to conduct financial transactions, and the increased sophistication and activities of organized crime, fraudsters, hackers, terrorists, activists, instrumentalities of foreign governments and other external parties. 

Although the Company believes that a robust suite of authentication and layered security controls, data encryption and tokenization, threat intelligence, anti-malware defenses and vulnerability management tools exist, the failure of any of these controls could result in a failure to detect, mitigate or remediate these risks in a timely manner. Moreover, potential new regulations may require the Company to disclose information about a cybersecurity event before it has been resolved or fully investigated. Further, as the Company expands its mobile and digital capabilities, cybersecurity risks increase.

A disruption or breach, including as a result