Company: BCS
Filing Date: 2025-02-13
Form Type: 20-F
Source: 0000312069-25-000114
Chunk: 385

Company: BARCLAYS PLC
Filing Date: 2025-02-13
Form: 20-F
Chunk 385
---
 and new developments on operational resilience, which are considered in risk factor (iv) ‘Regulatory change agenda and impact on business model’ above. b) Cyberattacks Cyberattacks continue to be a global threat inherent across all industries, with the number and severity of attacks continuing to rise. The financial sector remains a primary target for cybercriminals, hostile nation states (including nation-state-sponsored groups), opportunists and hacktivists. The Group experiences numerous attempts to compromise its cybersecurity protections. In 2024, cybersecurity incidents experienced by the Group included distributed denial of service (DDoS), phishing and credential stuffing. The Group cannot provide absolute security against cyberattacks. Malicious actors, who are increasingly sophisticated in their methods, tactics, techniques and procedures, seek to steal money, gain unauthorised access to, destroy or manipulate data, and disrupt operations. Further, some attacks may not be recognised or discovered until launched or after initial entry into the environment, such as novel or zero-day attacks that are launched before patches are available and defences can be readied. Other attacks may take advantage of the window during which patching or the deployment of other defences is underway, but not yet complete. Malicious actors are also increasingly developing methods to avoid detection and alerting capabilities, including by employing counter-forensic tactics, making response activities more difficult. Cyberattacks can originate from a wide variety of sources and target the Group in numerous ways, including via the Group's networks, systems, applications, devices, or parties such as service providers and other suppliers, counterparties, employees, contractors, customers or clients, presenting the Group with a vast and complex defence perimeter. Moreover, the Group does not have direct control over the cybersecurity of the systems of its clients, customers, counterparties and third-party service providers and suppliers, limiting the Group’s ability to effectively protect and defend against certain threats. Some of the Group’s third-party service providers and suppliers have experienced successful attempts to compromise their cybersecurity. These have included incidents resulting in the compromise of the Group's data and ransomware attacks that disrupted service providers’ or suppliers’ operations and, in some cases, have had impacts on the Group's operations. Such cyberattacks are likely to continue. Many of the Group's' agreements with third parties include liability or indemnification provisions, but the Group may not be able to recover sufficiently, or at all, under these provisions to adequately offset any losses or other adverse impacts the Group may incur from third party incidents. Inadequacies in, or failures in the