Company: MFAN
Filing Date: 2025-02-20
Form Type: 10-K
Source: 0001055160-25-000004
Chunk: 269

Company: MFA FINANCIAL, INC.
Filing Date: 2025-02-20
Form: 10-K
Item: Item 1A
Chunk 269
---
feasance or other intentional or unintentional acts by third parties and bad actors, including third-party service providers. Furthermore, borrower data, including personally identifiable information, may be lost, exposed, or subject to unauthorized access or use as a result of accidents, errors, or malfeasance by our employees, independent contractors, or others working with us or on our behalf. Our servers and systems, and those of our service providers, may be vulnerable to computer malware, break-ins, denial-of-service attacks, and similar disruptions from unauthorized access to our computer systems, which could result in someone obtaining unauthorized access to borrowers’ data or our data, including other confidential business information. In the past, we have experienced unauthorized access to certain data and information. Our cybersecurity systems and processes that are intended to protect this type of data and information; however, they may not be effective in preventing unauthorized access in the future.  Furthermore, because the techniques used to obtain unauthorized access to, or to compromise, systems change frequently and often are not recognized until launched against a target, we may be unable to anticipate these techniques or implement adequate preventative measures. We may also experience cybersecurity incidents that may remain undetected for an extended period.

We may be liable for losses suffered by individuals whose personal information is compromised as a result of a breach of the security of the systems that we or third-parties and service providers of ours store this information on, and any such liability could be material. Even if we are not liable for such losses, any breach of these systems could expose us to material costs in notifying affected individuals and providing credit monitoring or other services to them, as well as regulatory fines or penalties. In addition, any breach of these systems could disrupt our normal business operations and expose us to reputational damage and lost business, 

20  

revenues, and profits. Any insurance we maintain against the risk of this type of loss may not be sufficient to cover actual losses, or may not apply to the circumstances relating to any particular breach.  We may not be able to secure cybersecurity insurance at prices or on terms acceptable to us.

Cybersecurity incidents could also significantly damage our reputation with existing and prospective loan sellers, borrowers, and third parties with whom we do business. Any publicized security problems affecting our businesses and/or those of such third parties may negatively impact the market perception of our products and discourage market participants from doing business with us. These risks may increase in the future as we continue to increase our reliance on the internet and use of web-based product offerings and on