Company: SFB
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0000950170-25-027702
Chunk: 59

Company: STIFEL FINANCIAL CORP
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1A
Chunk 59
---
 personal, and other information in our computer systems and networks. There have been numerous highly publicized cases involving financial services companies reporting the unauthorized disclosure of client or other confidential information in recent years, as well as cyber attacks involving the theft, dissemination, and destruction of corporate information or other assets, in some cases as a result of failure to follow procedures by employees or contractors or as a result of actions by third parties. There have also been numerous highly publicized cases where hackers have requested “ransom” payments in exchange for not disclosing customer information or for restoring access to information or systems. Like other financial services firms, we experience malicious cyber activity directed at our computer systems, software, networks, and its users on a daily basis. This malicious activity includes attempts at unauthorized access, implantation of computer viruses or malware, and denial-of-service attacks. We also experience large volumes of phishing and other forms of social engineering attempted for the purpose of perpetrating fraud against our company, our associates, our advisors, or our clients. Additionally, like many large enterprises, we provide secure remote work capabilities, which can introduce potential cyber vulnerabilities as well. 

We also face increased cybersecurity risk for a period of time after acquisitions as we transition the acquired entity’s historical systems and networks to our standards. We also face additional cybersecurity risk related to an increased focus on mobile and cloud technologies. Our reliance on public cloud services introduces cybersecurity risks, including potential data breaches, unauthorized access, and compromised application programming interfaces (APIs) which could impact the confidentiality, integrity, or availability of our systems and data. Likewise, our mobile and web-facing technologies expose us to risks such as data leakage, malicious applications, phishing attacks, and network level threats which pose similar risks. We seek to continuously monitor for and nimbly react to any and all such malicious cyber activity, and we develop our systems to protect the confidentiality, integrity, and availability of our data and technology infrastructure and data from misuse, misappropriation, or corruption.

Cyber attacks can originate from a variety of sources, including threat actors affiliated with foreign governments, organized crime, or terrorist organizations. Threat actors may also attempt to place individuals within our company or induce associates, clients, or other users of our systems to disclose sensitive information or provide access to our data, and these types of risks may be difficult to detect or prevent. Although cybersecurity incidents among financial services firms are on the rise, we have not experienced any material losses relating to cyber attacks or other information security breaches. However, the techniques used in these attacks are increasingly