Company: HBAN
Filing Date: 2025-02-14
Form Type: 10-K
Source: 0000049196-25-000020
Chunk: 112

Company: HUNTINGTON BANCSHARES INC /MD/
Filing Date: 2025-02-14
Form: 10-K
Item: Item 1
Chunk 112
---
 CIRCIA in 2022, once rulemaking is complete, will require, among other things, certain companies to report significant cyber incidents to the CISA Agency within 72 hours from the time the company reasonably believes the incident occurred (and within 24 hours of making a ransom payment as a result of a ransomware attack). On April 4, 2024, the CISA Agency proposed a rule under the CIRCIA that would clarify the scope of cyber incidents to be reported and would further define covered entities subject to the CIRCIA to expressly include companies in the financial services industry that are required to report cyber incidents to their primary federal regulators.

In addition, effective April 1, 2022, the Federal Reserve, OCC and FDIC issued a rule that, among other things, requires a banking organization to notify its primary federal regulator as soon as possible and within 36 hours after identifying a “computer-security incident” that the banking organization believes in good faith could materially disrupt, degrade or impair its business or operations in a manner that would, among other things, jeopardize the viability of its operations, result in customers being unable to access their deposit and other accounts, result in a material loss of revenue, profit or franchise value, or pose a threat to the stability of the U.S. financial sector.

20     Huntington Bancshares Incorporated

Table of Contents

Cybersecurity and data privacy are also areas of increasing state legislative focus. For example, under California state law, the CCPA broadly defines personal information and substantially increases the rights of California residents to understand how their personal information is collected, used, and otherwise processed by commercial businesses, such as affording them the right to access and request deletion of their information and to opt out of certain sharing and sales of personal information. The CCPA contemplates civil penalties of up to $2,500 for each violation and up to $7,500 for each intentional violation and includes a private right of action (permitting lawsuits to be brought by private individuals instead of the state Attorney General or other government actor for certain breaches). Numerous other states have enacted, or are considering enacting, comprehensive data privacy laws that share similarities with the CCPA. In addition, laws in all 50 U.S. states require businesses to provide notice under certain circumstances to consumers whose personal information has been disclosed as a result of a data breach.

Our cybersecurity and data privacy policies and procedures for the protection of personal information are in effect across all businesses and geographic locations as applicable.

FDIC Insurance 

The