Company: CMA
Filing Date: 2025-02-24
Form Type: 10-K
Source: 0000028412-25-000108
Chunk: 339

Company: COMERICA INC
Filing Date: 2025-02-24
Form: 10-K
Item: Item 1A
Chunk 339
---
 which Comerica is highly dependent are subject to security risks and could be susceptible to cyber attacks, such as denial of service attacks, hacking, terrorist activities, social engineering attacks, malware intrusion, or identity theft. Comerica’s business relies on the secure processing, transmission, storage and retrieval of confidential, proprietary and other information in its computer and data management systems and networks, and in the computer and data management systems and networks of third parties. In addition, to access Comerica’s network, products and services, its customers and other third parties may use personal mobile devices or computing devices that are outside of its network environment and are subject to their own cybersecurity risks. Evolving technologies and the increased use of artificial intelligence and automation by third parties further increase security risks for Comerica and third parties on which Comerica depends.

Cyber attacks could include computer viruses, malicious or destructive code, phishing attacks, denial of service or information, ransomware, improper access by employees or vendors, attacks on personal email of employees, ransom demands to not expose security vulnerabilities in Comerica's systems or the systems of third parties, or other security breaches, and could result in the destruction or exfiltration of data and systems. As cyber threats continue to evolve, Comerica may be required to expend significant additional resources to continue to modify or enhance its protective measures or to investigate and remediate any information security vulnerabilities or incidents. Despite efforts to ensure the integrity of Comerica’s systems and implement controls, processes, policies and other protective measures, Comerica may not be able to anticipate all security breaches or it (or the third parties whose systems Comerica relies upon) may not be able to implement guaranteed preventive measures against such security breaches. Cyber threats are rapidly evolving, and Comerica may not be able to anticipate or prevent all such attacks and could be held liable for any security breach or loss.

Although Comerica has programs in place related to business continuity, disaster recovery, physical security and information security to maintain the confidentiality, integrity, and availability of its systems, business applications and customer information, such disruptions may still give rise to interruptions in service to customers and loss or liability to Comerica, including loss of customer data. Like other financial services firms, Comerica and its third-party providers continue to be the subject of cyber attacks. Although to this date Comerica has not experienced any material losses or other material consequences related to cyber attacks, future cyber attacks or future threats of cyber attacks could be materially disruptive and damaging