Company: BCDRF
Filing Date: 2025-02-28
Form Type: 20-F
Source: 0000891478-25-000054
Chunk: 957

Company: Banco Santander, S.A.
Filing Date: 2025-02-28
Form: 20-F
Chunk 957
---
, vendors, service providers, counterparties and other third parties to develop secure data and information processing, collection, authentication, management, usage, storage and

transmission capabilities and to ensure the eventual destruction of proprietary, sensitive and confidential information, including personal information, we, our third-party vendors or other third parties with which we do business have been and may continue to be subject to cyberattacks, data breaches, data losses and other security incidents. For example, on 14 May 2024, we announced that we had become aware of an unauthorized access to a Santander database that included certain customer and employee information hosted by a third-party provider (the 2024 Unauthorized Access). For more information on the legal and regulatory risks arising from the privacy, data protection and cybersecurity laws and regulations we are subject to, which, among other things, impose certain obligations with respect to cyberattacks, data breaches, data losses, and other security incidents, see risk factor ‘2.1.2 We are subject to extensive regulation and regulatory and governmental oversight which could adversely affect our business, operations and financial condition – Privacy, data protection and cybersecurity’).

The implementation of our cybersecurity policies, procedures, controls and technical measures is designed to reduce the risk of such cyberattacks, data breaches, data losses and other security incidents but does not guarantee full protection or a risk-free environment. This is especially applicable in the current global environment, with the wars in Ukraine and the Middle East resulting in an increased risk of cyberattacks, data breaches, data losses and other security incidents, and other disruptions in response to, or retaliation for, the sanctions and costs imposed on Russia and certain other countries directly or indirectly involved in the wars. Additionally, the shift to remote work policies for a significant portion of our workforce, as they access our secure systems and networks remotely, and our customers’ increased reliance on digital banking products and other digital services, including mobile payment products, has also increased the risk of cyberattacks, data breaches, data losses and other security incidents (see risk factor '1.3 The outbreak of highly contagious diseases or other public health emergencies, could materially and adversely impact our business, financial condition, liquidity and results of operations').

While we generally perform cybersecurity due diligence on our key vendors, because we do not control our vendors and our ability to monitor their cybersecurity is limited, we cannot ensure the cybersecurity measures they take will be sufficient to protect any information we share with them. Due to applicable laws and regulations or contractual obligations, we may be held responsible for cyberattacks,