Company: BCDRF
Filing Date: 2025-02-28
Form Type: 20-F
Source: 0000891478-25-000054
Chunk: 143

Company: Banco Santander, S.A.
Filing Date: 2025-02-28
Form: 20-F
Chunk 143
---
 management indicators; and

• special focus on regulatory developments to update and consolidate criteria, methodologies and documents.

In May we became aware of an unauthorized access to a Santander database hosted by a third-party provider. The bank’s operations and systems were not affected, so customers were able to continue to transact securely.

Bank put in place protective actions and corrective actions for clients and employees:

• Affected individuals, where applicable, were notified the incident and dedicated channels were put in place to provide them with further information.

• Information was made public by Santander in its corporate website.

• The bank started an education campaign for clients and employees regarding the most well-known types of fraud. This campaign has been reinforced in response to the incident and to minimize future similar incidents.

• Santander also notified the relevant supervisors and authorities where the group has a presence, including the data protection agencies, prudential supervisors, resolution authorities, and in some jurisdictions law enforcement as required by local regulations.

• Regarding clients, the Fraud Prevention and Cybersecurity teams continue to be on alert and analysing any relevant behaviour that could be associated with cases that take advantage of the information in question. Also, where relevant and appropriate, fraud prevention controls have been reinforced, that aim to mitigate the possible impacts associated with this incident.

Containment was complete and corrective action has been implemented that will minimize the possibility of any similar unauthorized access.

ii. Cybersecurity

Cybersecurity provides vital support to our purpose of helping people and businesses prosper and our aim to provide customers with first-rate digital services.

We have a board- and subsidiary-board approved cybersecurity framework that sets out the governance, functions, roles and responsibilities to manage cybersecurity throughout the Group, including the role of the Chief Information Security Officer (CISO).

Our cybersecurity policies, which develop the cybersecurity framework, are based on international standards and subject to ongoing review in order to maintain and enhance safety levels in the Group. In 2024 we updated our Cybersecurity requirements policy for technical and business areas, which includes security provisions for the different domains.

To assess how we’re doing on cybersecurity within the industry, we monitor our security rating provided by an independent third party. Bitsight Company gives us with a score between 250 and 900 (with 740-900 considered “Advanced”) based on public information and externally visible network traffic and systems. In 2024, we scored 790 points, which put us in the upper quartile among our peers and meant that we hit our target.

Annual report 2024 98

| Contents