Company: ASB
Filing Date: 2025-02-12
Form Type: 10-K
Source: 0000007789-25-000013
Chunk: 174

Company: ASSOCIATED BANC-CORP
Filing Date: 2025-02-12
Form: 10-K
Item: Item 1A
Chunk 174
---
 third party technology providers, consulting and forensic testing firms, insurance premium costs and legal fees, in addition to the incremental cost of our personnel who focus a substantial portion of their responsibilities on cybersecurity.

Any successful cyber-attack or other security breach involving the misappropriation, loss, leak or other unauthorized disclosure of sensitive or confidential customer information, confidential and proprietary information relating to our bank and operations, unauthorized access to our information systems or that of our third-party service providers, or unauthorized access to other data that compromises our ability to function could severely damage our reputation, erode confidence in the security of our systems, products and services, expose us to the risk of litigation and liability, disrupt our operations and have a material adverse effect on our business. Any successful cyber-attack may also subject the Corporation to regulatory investigations, litigation (including class action litigation) or enforcement, or require the payment of regulatory fines or penalties or undertaking costly remediation efforts with respect to third parties affected by a cybersecurity incident, all or any of which could adversely affect the Corporation’s business, financial condition or results of operations and damage its reputation. Finally, we cannot guarantee that 

24

any costs and liabilities incurred in relation to an attack or incident will be covered by our existing insurance policies or that applicable insurance will be available to us in the future on economically reasonable terms or at all. 

From time to time, the Corporation engages in acquisitions, including acquisitions of depository institutions. The integration of core systems and processes for such transactions often occurs after the closing, which may create elevated risk of cyber incidents.

The Corporation may be subject to the data risks and cybersecurity vulnerabilities of the acquired company until the Corporation has sufficient time to fully integrate the acquiree’s customers and operations. Although the Corporation conducts comprehensive due diligence of cybersecurity policies, procedures and controls of our acquisition counterparties, and the Corporation maintains adequate policies, procedures, controls and information security protocols to facilitate a successful integration, there can be no assurance that such measures, controls and protocols are sufficient to withstand a cyber-attack or other security breach with respect to the companies we acquire, particularly during the period of time between closing and final integration.

We rely heavily on communications and information systems to conduct our business. We have experienced cybersecurity attacks in the past and our communications and information systems may experience an interruption or breach in security from future attacks. 

We have experienced cybersecurity attacks in the past. Any failure, interruption, or breach in security or operational integrity of our or our third-party vendors' communications and information systems, including those caused by a cybersecurity