Company: NWBI
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0001471265-25-000016
Chunk: 38

Company: Northwest Bancshares, Inc.
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1
Chunk 38
---
 which, among other things: (i) imposes certain limitations on their ability to share nonpublic personal information about their customers with nonaffiliated third parties; (ii) requires that they provide certain disclosures to customers about their information collection, sharing and security practices and afford customers the right to “opt out” of any information sharing by them with nonaffiliated third parties (with certain exceptions); and (iii) requires that they develop, implement and maintain a written comprehensive information security program containing appropriate safeguards based on their size and complexity, the nature and scope of their activities, and the sensitivity of customer information they process, as well as plans for responding to cybersecurity breaches. Like other lenders, Northwest Bank also uses credit bureau data in its underwriting activities, and use of such data is regulated under the Fair Credit Reporting Act, which regulates reporting information to credit bureaus, prescreening individuals for credit offers, sharing of information between affiliates, and using affiliate data for marketing purposes. Similar state laws may impose additional requirements on Northwest Bank. 

In November 2021, the Federal Reserve Board, the Office of the Comptroller of the Currency and the FDIC adopted a regulation that, among other things, requires a banking organization to notify its primary federal regulators as soon as possible (and in any event within 36 hours) after identifying a “computer-security incident” that the banking organization believes in good faith has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, its business or operations in a manner that would, among other things, jeopardize the viability of its operations, result in customers being unable to access their deposit and other accounts, result in a material loss of revenue, profit or stock price, or pose a threat to the stability of the U.S. financial sector.

The enactment of the Cyber Incident Reporting for Critical Infrastructure Act (“CIRCIA”) in 2022, once rulemaking is complete, will separately require, among other things, covered entities to report significant cyber incidents, including ransomware attacks, to the Cybersecurity and Infrastructure Agency (“CISA”) within 72 hours from the time the covered entity reasonably believes the incident occurred (and within 24 hours of making a ransom payment as a result of a ransomware attack). The CISA proposed a rule under the CIRCIA in April 2024 that, among other things, would clarify the scope of cyber incidents to be reported and would further define covered entities subject to the CIRCIA to expressly include companies in the financial services sector that are required to report