Company: HBAN
Filing Date: 2025-02-14
Form Type: 10-K
Source: 0000049196-25-000020
Chunk: 150

Company: HUNTINGTON BANCSHARES INC /MD/
Filing Date: 2025-02-14
Form: 10-K
Item: Item 1A
Chunk 150
---
 breaches attributed to such third parties as they relate to the information we share with them.

34     Huntington Bancshares Incorporated

Table of Contents

Cyber-attacks or other information or security breaches, whether directed at us or third parties, may result in a material loss or have material consequences. Furthermore, the public perception that a cyber-attack or other information or security breach on our systems or infrastructure has been successful, whether or not this perception is correct, may damage our reputation with customers, clients, and third parties with which we do business. Hacking of confidential, proprietary, personal, and other information and identity theft risks, in particular, could cause serious reputational harm. A successful penetration or circumvention of our cybersecurity measures could cause us serious negative consequences, including: loss of customers, clients, and business opportunities; costs associated with maintaining business relationships after a cyber-attack or other information or security breach; significant business disruption to our operations and business, misappropriation, exposure, or destruction of our confidential, proprietary, personal, and other information, intellectual property, funds, and/or those of our customers or clients; or damage to our, our customers’, our clients’, and/or third parties’ systems or infrastructure. The occurrence of any of these events could result in a violation of applicable data privacy laws and regulations and other laws and regulations, litigation exposure, regulatory fines, penalties or intervention, loss of confidence in our cybersecurity measures, reputational damage, reimbursement or other compensatory costs, additional compliance costs, and could adversely impact our results of operations, liquidity, and financial condition. In addition, we may not have adequate insurance coverage to compensate for losses from a major cyber-attack or other information or security breach. We also cannot be sure that our existing insurance coverage will continue to be available on acceptable terms or at all or that our insurers will not deny coverage to any future claim.

We face significant operational risks which could lead to financial loss, expensive litigation, and loss of confidence by our customers, regulators, and capital markets.

We are exposed to many types of operational risks, including the risk of fraud or theft by colleagues or outsiders, unauthorized transactions by colleagues or outsiders, operational errors by colleagues, business disruption, and system failures. Huntington executes against a significant number of controls, a large percent of which are manual and dependent on adequate execution by colleagues and third-party service providers. There is inherent risk that unknown single points of failure through the execution chain could give rise to material loss through inadvertent errors or malicious attack. These operational risks could lead