Company: HBCYF
Filing Date: 2025-02-20
Form Type: 20-F
Source: 0001089113-25-000040
Chunk: 255

Company: HSBC HOLDINGS PLC
Filing Date: 2025-02-20
Form: 20-F
Chunk 255
---
 brand. The effective functioning of our payment systems, financial control, risk management, credit analysis and reporting, accounting, customer service and other information technology systems, as well as the communication networks between our branches and main data processing centres, are important to our operations. Critical system failure, prolonged service unavailability or a material breach of data security, particularly of confidential customer data, could compromise HSBC Group’s ability to serve its customers. This could breach regulations and could cause long-term damage to HSBC Group’s business and brand that could have a material adverse effect on our financial condition, results of operations, prospects and reputation. We remain susceptible to a wide range of cyber risks that impact and/ or are facilitated by technology The threat of cyber-attacks remains a concern for HSBC, as it does across the entire financial sector. As cyber-attacks continue to evolve, failure to protect our operations may result in disruption for

| 162 | HSBC Holdings plcAnnual Report on Form 20-F |

Risk review

customers, manipulation of data or financial loss. This could adversely impact both us and our customers. Adversaries attempt to achieve their objectives by compromising HSBC or our third party suppliers. They use techniques that include malware (such as ransomware), exploitation of both known and unpublished (zero-day) software vulnerabilities , phishing emails, distributed denial of service attacks, as well as potentially physical compromise of premises, or coercion of staff. Our customers may also be subject to these constantly evolving cyber-attack techniques. The Group, like other financial institutions, has experienced numerous common cyberattacks, including for example, distributed denial of service and phishing attacks. Some of our third-party service providers also have experienced cyberattacks. To date, we have not been materially affected by cybersecurity threats. However, we expect cyberattacks to continue, and our business strategy, results of operations and financial condition could be materially affected by cybersecurity risks and any future material incidents. Cybersecurity risks will continue to increase, due to continued increase of services delivered over the internet; increasing reliance on internet-based products, applications and data storage; the increasing use of AI, which could be used to facilitate sophisticated cyber attacks and an increased use of hybrid working models by HSBC’s employees, contractors, third party service providers and their sub- contractors. Failure to adhere to HSBC’s cybersecurity policies, procedures or controls, employee wrongdoing, or human, governance or technological error could also compromise HSBC’s ability to defend against cyber-attacks. Should any of these cybersecurity risks materialise, they could have a