Company: L
Filing Date: 2025-02-11
Form Type: 10-K
Source: 0000060086-25-000036
Chunk: 210

Company: LOEWS CORP
Filing Date: 2025-02-11
Form: 10-K
Item: Item 1A
Chunk 210
---
, or sensitive and confidential information regarding its business or policyholders and may result in operational impairments and financial losses, significant harm to its reputation and the loss of business with existing or potential customers. The breach of confidential information also could give rise to legal liability and regulatory action under data protection and privacy laws, as well as evolving regulation in this regard. While CNA does not believe such breaches that have occurred and resultant actions will have a material adverse effect on its business, these or similar incidents, or any other such breach of CNA’s or its vendors’ data security infrastructure could have a material adverse effect on its business, results of operations and financial condition.

23

As previously disclosed, CNA sustained a sophisticated cybersecurity attack in March 2021 involving ransomware that caused a network disruption and impacted certain of its systems. CNA’s investigation into the incident revealed that an unauthorized third party copied some personal information relating to certain current and former employees, contract workers and their dependents and certain other persons, including some policyholders. Although CNA currently has no indication that the impacted data has been misused, or that CNA or its policyholder data was specifically targeted by the unauthorized third party, it may be subject to subsequent investigations, claims or actions in addition to other costs, fines, penalties, or other obligations related to impacted data, whether or not such data is misused. In addition, the misuse, or perceived misuse, of sensitive or confidential information regarding its business or policyholders could cause harm to CNA’s reputation and result in the loss of business with existing or potential customers, which could adversely impact its business, results of operations and financial condition.

Although CNA maintains cybersecurity insurance coverage insuring against costs resulting from cyber attacks (including the March 2021 attack), CNA does not expect the amount available under its coverage policy to cover all losses from cyber-attacks. In addition, potential disputes with its insurers about the availability of insurance coverage could occur. Further, should CNA experience future cyber incidents, or should industry trends drive rate increases resulting from growth in volume and significance of cyber incidents broadly, it may incur higher costs for cybersecurity insurance coverage.

The risks relating to future breaches in CNA’s, or its vendors’ data security infrastructure or systems, including in connection with cyber incidents, could have a material adverse effect on its business, results of operations or financial condition or may result in significant operational impairments and financial losses, as well as significant harm to CNA’s reputation.

Inability to detect and prevent significant employee or third