Company: FCNCB
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0000798941-25-000010
Chunk: 260

Company: FIRST CITIZENS BANCSHARES INC /DE/
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1A
Chunk 260
---
We, as well as our customers, regulators, third-party service providers, and other third parties with whom we do business, have been subject to, and are likely to continue to be the target of, cyberattacks. These cyberattacks include computer viruses, malicious or destructive code, ransomware, phishing attacks, denial of service or other security breaches that could result in the unauthorized release, gathering, monitoring, misuse, loss or destruction of confidential, proprietary or personal data. As cyber threats continue to evolve, we have been and will continue to be required to expend significant resources to continuously enhance our protective measures and may be required to expend significant resources to investigate and remediate any information security vulnerabilities or incidents. We could continue to experience cyberattacks, and we acknowledge that we cannot implement guaranteed preventive measures against all security threats. Additionally, a security breach may be difficult to detect, even after it occurs, which may compound the issue related to such breach.

Continued geopolitical and geographical turmoil, including the ongoing conflicts in Ukraine and the Middle East, as well as increasing tensions in the South China Sea, has heightened the risk of cyberattacks and has created new risks for cybersecurity. For example, the U.S. government has warned that sanctions imposed against Russia by the United States in response to its conflict with Ukraine could motivate Russia to engage in malicious cyber activities against the United States. In addition, the U.S. government has warned that Iran may pose an increased cyber threat to U.S. critical infrastructure, such as the financial services sector, as the conflicts in the Middle East continue. If such cyberattacks occur, it could result in severe costs and disruptions to governmental entities and companies and their operations. The impact of the conflict and retaliatory measures is continually evolving and cannot be predicted with certainty. FCB has a higher risk of being impacted by geopolitical events due to FCB’s expanded geographic footprint and increased prominence. Our Enterprise Cyber Security Office (“ECSO”) continues in its efforts to closely monitor changes in the threat landscape. 

26

Cybersecurity risks for large banking institutions, such as FCB, have significantly increased in recent years in part because of the proliferation of new technologies, including generative AI, the use of the internet and mobile banking to conduct financial transactions, and the increased sophistication of criminal activities. In March 2024, the U.S. Treasury cautioned financial institutions with respect to AI vulnerabilities and threat-actor capabilities, and in September 2024, the DOJ updated guidance to prosecutors in their investigations of corporations, including an expectation of corporations having