Company: MTB-PJ
Filing Date: 2025-02-19
Form Type: 10-K
Source: 0001628280-25-006267
Chunk: 70

Company: M&T BANK CORP
Filing Date: 2025-02-19
Form: 10-K
Item: Item 1A
Chunk 70
---
 resources due to the actions of a malicious cyber threat actor), damage to property or physical assets, or events arising from political protests or terrorist acts. Like other U.S. financial services companies, the Company is constantly the target of cyber attacks and other attempts to disrupt its operations. While the Company has policies and procedures designed to prevent or limit the effect of these possible events, there can be no assurance that any failure, disruption, interruption or security breach will not occur or, if any does occur, that it can be sufficiently or timely remediated.

Information security risks for large financial institutions such as M&T have increased significantly in recent years in part because of the proliferation of new technologies, such as AI and digital and mobile banking to conduct financial transactions, the increased connectivity of third parties (including contractors) and electronic devices to our systems, and the increased sophistication and activities of organized crime, hackers, terrorists, nation-states, activists and other external parties. 

36

There have been increasing efforts on the part of third parties, including through cyber attacks, to breach data security at financial institutions or with respect to financial transactions. There have been numerous instances involving financial services and consumer-based companies reporting unauthorized access to and disclosure of client or customer information or the destruction or theft of corporate data, including by executive impersonation and third party vendors, or the freezing of operating systems and databases making them inaccessible or unusable. There have also been several highly publicized cases where hackers have requested "ransom" payments in exchange for not disclosing customer information or for restoring access to, or the usage of, operating systems and databases. Ransomware is a form of malicious software, known as "malware," designed to block access to, and often encrypt, computer systems or data. Once the victim’s computer system or data is locked down and encrypted, rendering it essentially useless, the malicious cyber actor then extorts the victim by demanding a ransom payment in exchange for providing a method to decrypt it. The attacker may also copy the victim’s data in the course of the attack and threaten to sell or publish the data if the ransom is not paid. Ransomware attacks can result in a loss of business functionality and of sensitive data. 

As cyber threats continue to evolve, the Company expects to continue to expend significant additional resources to modify or enhance its layers of defense or to investigate and remediate any information security vulnerabilities especially in light of heightened regulatory expectations around information security. The techniques used by cyber criminals change frequently, may not be recognized until launched and can be initiated by a variety of