Company: CMA
Filing Date: 2025-02-24
Form Type: 10-K
Source: 0000028412-25-000108
Chunk: 340

Company: COMERICA INC
Filing Date: 2025-02-24
Form: 10-K
Item: Item 1A
Chunk 340
---
, and Comerica may not be able to anticipate or prevent all such attacks. Further, cyber attacks may not be detected in a timely manner.

Cyber attacks or other information or security breaches, whether directed at Comerica or third parties, may result in a material loss or have material consequences. Furthermore, the public perception that a cyber attack on Comerica’s systems has been successful, whether or not this perception is correct, may damage its reputation with customers and third parties with whom it does business. Hacking of personal information and identity theft risks, in particular, could 

19

cause serious reputational harm. A successful penetration or circumvention of system security could cause Comerica material negative consequences, including loss of customers and business opportunities, costs associated with maintaining business relationships after an attack or breach; significant business disruption to Comerica’s operations and business, misappropriation, exposure, or destruction of its confidential information, intellectual property, funds, and/or those of its customers; or damage to Comerica’s or Comerica’s customers’ and/or third parties’ computers or systems, and could result in a violation of applicable privacy laws and other laws, litigation exposure, regulatory fines, penalties or intervention, loss of confidence in Comerica’s security measures, reputational damage, reimbursement or other compensatory costs, and additional compliance costs, and could adversely impact its results of operations, liquidity and financial condition. In addition, although Comerica maintains insurance coverage that may cover certain cyber attack losses (subject to policy terms and conditions), Comerica may not have adequate insurance coverage to compensate for losses from a cybersecurity event.

•Cybersecurity and data privacy are areas of heightened legislative and regulatory focus.

As cybersecurity and data privacy risks for banking organizations and the broader financial system have significantly increased in recent years, cybersecurity and data privacy issues have become the subject of increasing legislative and regulatory focus. The federal bank regulatory agencies continue to assess cybersecurity risks in their supervision and examination of banks, including Comerica. In addition, several states have proposed or adopted cybersecurity legislation and regulations, which require, among other things, notification to affected individuals when there has been a security breach of their personal data. For more information regarding cybersecurity regulation, refer to the “Supervision and Regulation” section of this report.

Comerica receives, maintains and stores non-public personal information of Comerica’s customers and counterparties, including, but not limited to, personally identifiable information and personal financial information. The sharing, use, disclosure and protection