Company: ASB
Filing Date: 2025-02-12
Form Type: 10-K
Source: 0000007789-25-000013
Chunk: 173

Company: ASSOCIATED BANC-CORP
Filing Date: 2025-02-12
Form: 10-K
Item: Item 1A
Chunk 173
---
 common and increasingly sophisticated. 

Cyber-attacks continue to evolve and become more pervasive throughout the financial services sector. In particular, there has been an observed increase in the number of distributed denial of service and ransomware attacks against the financial sector, for which the increase is believed to be partially attributable to politically motivated attacks as well as financial demands coupled with extortion. Further, threat actors continue to exploit publicly known software vulnerabilities and weak authentication controls used by large numbers of banking organizations in order to conduct malicious cyber activities. These types of attacks have resulted in increased supply chain and third-party risk. 

Because the methods of cyber-attacks change frequently or, in some cases, are not recognized until launch, we are not able to anticipate or implement effective preventive measures against all possible security breaches and the probability of a successful attack cannot be predicted. Although we employ detection and response mechanisms designed to contain and mitigate security incidents, early detection may be thwarted by persistent sophisticated attacks and malware designed to avoid detection.

We also face risks related to cyber-attacks and other security breaches in connection with card transactions that typically involve the transmission of sensitive information regarding our customers through various third parties. Some of these parties have in the past been the target of security breaches and cyber-attacks, and because the transactions involve third parties and environments that we do not control or secure, future security breaches or cyber-attacks affecting any of these third parties could impact us, and in some cases we may have exposure and suffer losses for breaches or attacks relating to them. We also rely on numerous other third-party service providers to conduct other aspects of our business operations and face similar risks relating to them. We cannot be sure that such third-party information security protocols are sufficient to withstand a cyber-attack or other security breach.

Cybersecurity risks for financial institutions also have evolved as a result of the increased interconnectedness of operating environments and the use of new technologies, devices and delivery channels to transmit data and conduct financial transactions. The adoption of new products, services and delivery channels contribute to a more complex operating environment, which enhances operational risk and presents the potential for additional structural vulnerabilities. As such, a single cyber-attack is now able to compromise hundreds of organizations and affect a significant number of consumers. In addition, the adoption of hybrid and remote work environments following the COVID-19 pandemic presents institutions with additional cybersecurity vulnerabilities and risks.

The Corporation regularly evaluates its systems and controls and implements upgrades as necessary. The additional cost to the Corporation of our cybersecurity monitoring and protection systems and controls includes the cost of hardware and software,