Company: UMBFO
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0000950170-25-028420
Chunk: 43

Company: UMB FINANCIAL CORP
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1A
Chunk 43
---
  Failures or errors in, or breach of the Company’s systems or networks, or those of its third-party service providers or their third-party service providers (collectively, third party service providers), or the Company’s counterparties, may expose the Company to litigation, disclosure requirements, remediation costs, increased costs for security measures, loss of revenue, regulatory scrutiny, governmental investigation and/or other actions, and other potential liability. For example, despite security measures, the Company’s or its third-party service providers’ information technology and infrastructure may be breached or rendered inaccessible due to a variety of factors, including from infrastructure changes or failures, introductions of new functionality, human or software errors, service failures, operational and technological outages, capacity constraints, loss or theft of assets, natural disasters, terrorist attacks, power outages, data breaches, cyber-attacks, denial of service attacks, hacking, ransomware and other computer viruses or malware, or acts of misconduct through pretext calls, electronic phishing or other means, and, as a result, an unauthorized party may obtain access to the Company’s or its customers’ confidential, proprietary, personal, or sensitive data. These risks and uncertainties are rapidly evolving and increasing in complexity, and the Company’s failure to effectively mitigate them could negatively impact its business and operations.

Because the techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently or may be designed to remain dormant until a predetermined event, and often are not recognized until launched against a target, the Company or its third-party service providers may be unable to anticipate or detect these techniques or implement adequate preventative or remedial measures. Though it is difficult to determine what harm may directly result from any specific interruption or data breach, any failure to maintain performance, reliability, security, and availability of the Company’s network infrastructure and the information processed thereby may harm the Company’s brand, its ability to retain existing customers and attract new customers, and its ability to operate.

Risks and exposures related to cybersecurity attacks, particularly for financial institutions, are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats and the expanding use of technology-based products and services by the Company, its third-party service providers, and its customers. The Company can provide no assurances that the safeguards it or its third-party service providers have in place or may implement in the future will prevent all unauthorized infiltrations or breaches and that the Company will not suffer losses related to a security breach in the future, which losses may be material.

As noted