Company: ONBPP
Filing Date: 2025-02-19
Form Type: 10-K
Source: 0000707179-25-000005
Chunk: 49

Company: OLD NATIONAL BANCORP /IN/
Filing Date: 2025-02-19
Form: 10-K
Item: Item 1A
Chunk 49
---
 our reputation, and create significant financial and legal exposure.

Like other U.S. financial services companies, the Company has been and expects to continue to be the target of cyber-attacks and other attempts to disrupt its operations. Although we devote significant resources to maintain and regularly upgrade our systems and processes that are designed to protect the security of our computer systems, software, networks, and other technology assets and the confidentiality, integrity, and availability of information belonging to us and our clients, there is no assurance that our security measures, or those of our external vendors, will provide absolute security. Further, to access our products and services our clients may use computers and mobile devices that are beyond our security control systems. In fact, many other financial services institutions and companies engaged in data processing have reported breaches in the security of their websites or other systems, some of which have involved sophisticated and targeted attacks intended to obtain unauthorized access to confidential information, destroy data, disable or degrade service, or sabotage systems, often through the introduction of computer viruses or malware, cyberattacks, and/or malicious code, or by means of phishing attacks, social engineering and other means.

As our reliance on technology systems and the connectivity of third parties (including contractors) and electronic devices to our systems increase, the potential risks of technology-related interruptions in our operations or the occurrence of cyber incidents also increase. Our technologies, systems, and networks, and those of our external vendors, as well as our customers’ devices are periodically the target of cyberattacks and may be the target of future cyberattacks. Malicious actors may also attempt to fraudulently induce employees, customers or other users of our systems to disclose sensitive information, including passwords and other identifying information, in order to gain access to data or our systems.

Certain financial institutions in the United States have also experienced attacks from technically sophisticated and well-resourced third parties that were intended to disrupt normal business activities by making internet banking systems inaccessible to clients for extended periods. These “denial-of-service” attacks typically do not breach data security systems, but require substantial resources to defend, and may affect client satisfaction and behavior. There have been several well-publicized attacks on various companies, including in the financial services industry, and personal, proprietary, and public e-mail systems in which the perpetrators gained unauthorized access to confidential information and customer data, often through the introduction of computer viruses or malware, cyberattacks, phishing, or other means. Even if not directed at the Company or its subsidiaries specifically, attacks on other entities with whom we do business or on whom we otherwise