Company: HBAN
Filing Date: 2025-02-14
Form Type: 10-K
Source: 0000049196-25-000020
Chunk: 149

Company: HUNTINGTON BANCSHARES INC /MD/
Filing Date: 2025-02-14
Form: 10-K
Item: Item 1A
Chunk 149
---
led employees or vendors, activists, and other external parties, including those involved in corporate espionage, any of whom may enhance their efforts through the use of AI. Even the most advanced internal control environment may be vulnerable to compromise. Due to increasing geopolitical tensions, nation state cyber-attacks and ransomware are both increasing in sophistication and prevalence. Targeted social engineering and email attacks (i.e., “spear phishing” attacks) are becoming more sophisticated and are extremely difficult to prevent. In such an attack, an attacker will attempt to fraudulently induce colleagues, contractors, customers, clients, or other users of our systems and infrastructure to disclose sensitive information in order to gain access to our, our customers’, or our clients’ systems and infrastructure, or the confidential, proprietary, personal, or other information stored or processed thereon. Persistent attackers may succeed in penetrating defenses given enough resources, time, and motive. The techniques used by cyber threat actors change frequently, may not be recognized until launched, and may not be recognized until well after a cyber-attack or other information or security breach has occurred. The speed at which new vulnerabilities are discovered and exploited, often before security patches are published, continues to rise. Remote work further increases the risk that we may experience cyber-attack or other information or security breaches as a result of our employees, colleagues, contractors, and other third parties with which we do business or upon which we rely working remotely on less secure systems and environments. 

The risk of a security breach caused by a cyber-attack or other information security breach at a third party with which we do business or upon which we rely, or by unauthorized access by such third party, has also increased in recent years. Additionally, the existence of cyber-attacks or other information or security breaches at such third parties with access to our confidential, proprietary, personal, and other information may not be disclosed to us in a timely manner. Further, our ability to monitor such third parties’ cybersecurity practices is limited. Although we generally have agreements relating to cybersecurity and data privacy in place with third parties, we cannot guarantee that such agreements will prevent a cyber-attack or other information or security breach impacting our confidential, proprietary, personal, or other information, or enable us to obtain adequate or any reimbursement from such third parties in the event we should suffer any disruption, compromise, failure, liability, reputational harm, or other cost or expense. Due to applicable laws and regulations or contractual obligations, we may be held responsible for cyber-attacks or other information or security