Company: SFBC
Filing Date: 2025-03-18
Form Type: 10-K
Source: 0001541119-25-000009
Chunk: 83

Company: Sound Financial Bancorp, Inc.
Filing Date: 2025-03-18
Form: 10-K
Item: Item 1A
Chunk 83
---
 to allocate significant additional resources to bolster our protective measures or investigate and 

39

address crucial information security vulnerabilities or exposures. Despite our efforts, they might not prevent all physical and electronic intrusions, denial of service, cyber-attacks, or security breaches.

Disruptions or failures in the physical infrastructure or operating systems supporting our business and customers, or breaches in the networks, systems, or devices used by customers accessing our services, could result in customer attrition, uninsured financial losses, customer transaction disruptions, productivity losses, technology replacement costs, incident response expenses, legal and regulatory repercussions, reputational damage, litigation, reimbursement or compensation costs, and additional compliance expenses. Any of these outcomes could significantly and adversely affect our financial condition or operational results.

The failure to protect our customers' confidential information and privacy could adversely affect our business.

We are subject to federal and state privacy regulations and confidentiality obligations that, among other things, restrict the use and dissemination of, and access to, certain information that we produce, store or maintain in the course of our business. We also have contractual obligations to protect certain confidential information we obtain from our existing vendors and customers.

These obligations generally include protecting such confidential information in the same manner and to the same extent as we protect our own confidential information, and in some instances may impose indemnity obligations on us relating to unlawful or unauthorized disclosure of any such information.

If we do not comply with privacy regulations and contractual obligations that require us to protect confidential information, or if we experience a security breach or network compromise, we could experience adverse consequences, including regulatory sanctions, penalties or fines, increased compliance costs, remedial costs such as providing credit monitoring or other services to affected customers, litigation and damage to our reputation, which in turn could result in decreased revenues and loss of customers, all of which would have a material adverse effect on our business, financial condition and results of operations.

Our operations rely on certain external vendors.   

We rely on certain external vendors to provide products and services essential to our day-to-day operations. These third-party vendors expose us to operational and information security risks, including operational errors, system failures, interruptions or breaches, and unauthorized disclosures of sensitive or confidential information. Past incidents involving third-party vendors have demonstrated the potential for such risks to disrupt our operations, impair customer service, damage our reputation, or expose us to litigation.

While we work closely with our vendors to implement appropriate security measures and monitoring processes to mitigate these risks, no system is entirely immune to breaches or other security events. Such incidents could materially and adversely affect our