Company: CMA
Filing Date: 2025-02-24
Form Type: 10-K
Source: 0000028412-25-000108
Chunk: 238

Company: COMERICA INC
Filing Date: 2025-02-24
Form: 10-K
Item: Item 1
Chunk 238
---
 could include computer viruses, malicious or destructive code, phishing attacks, denial of service or information, ransomware, improper access by employees or vendors, attacks on personal email of employees, ransom demands to not expose security vulnerabilities in Comerica's systems or the systems of third parties, or other security breaches, and could result in the destruction or exfiltration of data and systems. As cyber threats continue to evolve, Comerica may be required to expend significant additional resources to continue to modify or enhance its protective measures or to investigate and remediate any information security vulnerabilities or incidents. Despite efforts to ensure the integrity of Comerica’s systems and implement controls, processes, policies and other protective measures, Comerica may not be able to anticipate all security breaches or it (or the third parties whose systems Comerica relies upon) may not be able to implement guaranteed preventive measures against such security breaches. Cyber threats are rapidly evolving, and Comerica may not be able to anticipate or prevent all such attacks and could be held liable for any security breach or loss.

Although Comerica has programs in place related to business continuity, disaster recovery, physical security and information security to maintain the confidentiality, integrity, and availability of its systems, business applications and customer information, such disruptions may still give rise to interruptions in service to customers and loss or liability to Comerica, including loss of customer data. Like other financial services firms, Comerica and its third-party providers continue to be the subject of cyber attacks. Although to this date Comerica has not experienced any material losses or other material consequences related to cyber attacks, future cyber attacks or future threats of cyber attacks could be materially disruptive and damaging, and Comerica may not be able to anticipate or prevent all such attacks. Further, cyber attacks may not be detected in a timely manner.

Cyber attacks or other information or security breaches, whether directed at Comerica or third parties, may result in a material loss or have material consequences. Furthermore, the public perception that a cyber attack on Comerica’s systems has been successful, whether or not this perception is correct, may damage its reputation with customers and third parties with whom it does business. Hacking of personal information and identity theft risks, in particular, could 

19

cause serious reputational harm. A successful penetration or circumvention of system security could cause Comerica material negative consequences, including loss of customers and business opportunities, costs associated with maintaining business relationships after an attack or breach; significant business disruption to Comerica