Company: INGVF
Filing Date: 2025-03-06
Form Type: 20-F
Source: 0001628280-25-010764
Chunk: 26

Company: ING GROEP NV
Filing Date: 2025-03-06
Form: 20-F
Item: Item 3
Chunk 26
---
 of cyber attacks, which is a specific risk to ING as a result of its strategic focus on technology and innovation. In particular, threats from Distributed Denial of Service (DDoS), targeted attacks (also called Advanced Persistent Threats) and ransomware have intensified worldwide, and attempts to gain unauthorised access and the sophistication of techniques used for such attacks is increasing. Cyber threats are constantly evolving and the techniques used in these attacks change, develop and evolve rapidly, including the use of emerging technologies, such as advanced forms of artificial intelligence and quantum computing. The new cyber risks introduced by these changes in technology require us to devote significant attention to the identification, assessment and analysis of the risks and the implementation of corresponding preventative measures. We have faced, and expect to continue to face, an increasing number of cyber attacks (both successful and unsuccessful) as we have further digitalised. This includes the continuing expansion of our mobile- and other internet-based products and services, as well as our usage and reliance on cloud technology.
Cybersecurity, the use and safeguarding of customer data and data privacy have become the subject of increasing legislative and regulatory focus. The EU’s second Payment Services Directive (PSD2), GDPR, DORA and the Cyber Resilience Act are examples of such regulations. The resilience of financial institutions against ransomware attacks is now a subject of the yearly stress test executed by the ECB. In certain locations where ING is active, there are additional local regulatory requirements and legislation on top of EU regulations that must be followed for business conducted in that jurisdiction. Some of these legislations and regulations may be conflicting due to local regulatory interpretations. We may become subject to new legislation or regulation concerning cybersecurity, security of customer data in general or the privacy of information we may store or maintain. Compliance with such new legislation or regulation could increase 

ING Group Annual Report 2024 on Form 20-F 

Contents       Part I         Part II        Part III       Additional information        Financial statements    
the Group’s compliance cost. Failure to comply with new and existing legislation or regulation could harm our reputation and could subject the Group to enforcement actions, fines and penalties.
ING may be exposed to the risks of misappropriation, unauthorised access, computer viruses or other malicious code, cyber attacks and other external attacks or internal breaches for purposes of misappropriating assets or sensitive information, corrupting data, or impairing operational performance, each of which could have a security impact. These events could also jeopardise our confidential information or that of our clients or our