Company: MCHB
Filing Date: 2025-07-03
Form Type: S-4
Source: 0001140361-25-024872
Chunk: 84

Company: Mechanics Bancorp
Filing Date: 2025-07-03
Form: S-4
Chunk 84
---
 in Mechanics’ customer relationship management, securities trading, general ledger, deposits, computer systems, electronic underwriting servicing or loan origination systems, or the unauthorized disclosure of confidential and non-public information maintained within Mechanics’ systems. Mechanics also utilizes relationships with third parties to aid in a significant portion of its information systems, communications, data management and transaction processing. These third parties with which Mechanics does business may also be sources of cybersecurity or other technological risks, including operational errors, system interruptions or breaches, unauthorized disclosure of confidential information and misuse of intellectual property, and have experienced cyberattacks. Evolving technologies and the increased use of artificial intelligence and automation by third parties further increase the risk of cyberattacks and threats of cyberattacks against Mechanics or those third parties that Mechanics depends upon. If Mechanics’ third-party service providers encounter any of these issues, then Mechanics could be exposed to disruption of service, reputation damages, and litigation risk, any of which could have a material adverse effect on Mechanics’ business.

In 2023, a third-party vendor of Mechanics confirmed that data specific to Mechanics’ customers was likely obtained in a security incident targeting the vendor’s instance of a secure file transfer program. As a result of this, an

<div align='center'>41</div>

TABLE OF CONTENTS

unauthorized party likely obtained information in the vendor’s possession about Mechanics’ employees and customers. Affected individuals were notified by the applicable vendors. Given the widespread use of such secure file transfer program, additional vendors of Mechanics may have been impacted. Mechanics has incurred, and may continue to incur, expenses related to this incident, and it remains subject to risks and uncertainties as a result of the incident, including litigation and additional regulatory scrutiny. The continued occurrence of cybersecurity incidents and threats thereof across a range of industries has resulted in increased legislative and regulatory scrutiny over cybersecurity and calls for additional data privacy laws and regulations at both the state and federal levels. For example, in 2018, the State of California adopted the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act in 2023, which imposes requirements on companies operating in California and provides consumers with a private right of action if covered companies suffer a data breach related to their failure to implement reasonable security measures. There have been ongoing discussions and proposals in the U.S. Congress with respect to new federal data privacy and security laws to which Mechanics would become subject if enacted. These upcoming and evolving laws and regulations could result in increased operating expenses or increase Mechanics’ exposure to the risk of litigation or regulatory inquiries