Company: WBS-PG
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0000801337-25-000004
Chunk: 182

Company: WEBSTER FINANCIAL CORP
Filing Date: 2025-03-03
Form: 10-K
Item: Item 1A
Chunk 182
---
 of their own systems, capacity constraints, and cyber-attacks, each of which could pose a cybersecurity risk.

In recent years, information security risks for financial institutions have risen due to the increased sophistication and activities of organized crime, hackers, terrorists, hostile foreign governments, activists, and other external parties. There have been instances involving financial services and consumer-based companies reporting unauthorized access to, and disclosure of, customer information or the destruction or theft of corporate data. There have also been highly publicized cases where hackers have requested ransom-payments in exchange for allowing access to systems and/or not disclosing customer information.

Our inherent risk and exposure to information security matters remains heightened, and as a result, the continued development and enhancement of our controls, processes, and practices designed to protect operational systems, computers, software, data, and networks from attack, damage, or unauthorized access remains a high priority for us. While we have purchased network and privacy liability insurance coverage, which includes digital asset loss, business interruption loss, network security liability, privacy liability, network extortion, and data breach coverage, such insurance may not cover any and all actual losses. As cybersecurity threats and related regulations continue to evolve, we may be required to expend significant additional resources to modify our protective measures or to investigate and remediate any information security vulnerabilities.

We are subject to complex state and federal laws and regulations regarding data privacy and security, which impact how we conduct our business.

We are subject to complex and evolving data privacy laws, rules and contractual obligations (collectively “data privacy laws”) that relate to the privacy and security of the personal information of our customers and employees, or any other natural persons. These data privacy laws require, among other things, that we make certain privacy disclosures, maintain a robust security program, require disclosures and notifications during a cyber or information security incident, and regulate our collection, use, sharing, retention, and safeguarding of consumer or employee information. State and federal regulators may also hold us responsible for privacy and data protection obligations performed by our third-party service providers while providing services to us, as well as disclosures and notifications during a cyber or information security incident. Consumers also have the option to direct us and other financial institutions not to share information about transactions and experiences with affiliated companies for the purpose of marketing products or services.

14

Table of Contents

State regulators have also been increasingly active in implementing privacy and cybersecurity regulations. Several states have also recently strengthened their data breach notification and data privacy requirements. We expect this trend of state-level activity in those areas to continue and are continually