Company: TCBI
Filing Date: 2025-02-11
Form Type: 10-K
Source: 0001077428-25-000036
Chunk: 125

Company: TEXAS CAPITAL BANCSHARES INC/TX
Filing Date: 2025-02-11
Form: 10-K
Item: Item 1A
Chunk 125
---
 sensitive data, including personally identifiable information of its customers and employees and in the ordinary course of business must allow certain vendors access to that data. Breaches of the systems or vendors' or customers’ systems, thefts of data and other breaches and criminal activity may result in significant costs to respond or remediate losses if the Company or its vendors are at fault, damage to the Company’s customer relationships, regulatory scrutiny and enforcement and loss of future business opportunities due to reputational damage. Even the most well-protected information, networks, systems and facilities remain potentially vulnerable because attempted security breaches, particularly cyber-attacks and intrusions, or disruptions will occur in the future, and because the techniques used in such attempts are rapidly and constantly evolving and generally are not recognized until launched against a target, and in some cases are designed not to be detected and, in fact, may not be detected for a period of time or at all. Accordingly, the Company may be unable to anticipate or be prepared for these techniques or to implement adequate security barriers or other preventative measures, and thus it is impossible for the Company to entirely mitigate this risk.

Breaches can be perpetrated by unknown third parties, but could also be facilitated by employees either inadvertently or by consciously attempting to create disruption or certain acts of fraud. The Company’s customers and employees have been, and will continue to be, targeted by parties using fraudulent e-mails and other communications in attempts to misappropriate passwords, bank account information or other personal information or to introduce viruses or other malware through “Trojan horse” programs to the Company’s information systems, the information systems of merchants or third-party service providers and/or customers' computers. Although the Company, with the help of third-party service providers, will continue to implement information security technology solutions and establish operational procedures to protect sensitive data, there can be no assurance that these measures will be effective. The Company advises, or alerts and provides some guidance to customers and evaluates and imposes security requirements on vendors regarding protection of their respective information systems, but there is no assurance that these actions will have the intended positive effects or will be effective to prevent losses or attacks. Successful cyber-attacks on the Company, vendors or customers may affect the Company’s reputation, and failure to meet 

22

customer expectations could have a material impact on the Company’s ability to attract and retain deposits as a primary source of funding.

A security breach or other significant disruption of information systems or those related to customers, merchants and third-party vendors, including as a result of cyber-attacks, could (i) disrupt