Cybersecurity and data breaches

By sector

Sector is the SEC's industry description of the company. Each count opens that sector's quotes below.

532 paragraphs · National Commercial Banks show all sectors

The Corporation and third parties with whom we interact and/or on whom we rely, are subject to cybersecurity incidents,

Read in the 10-K filed Feb 25, 2026 ↗

Citi may also rely on AI models developed by third parties and be exposed to risks arising from their development and training methods, including potential inclusion of unauthorized material in the training data or limitations in their risk mitigation strategies, over which Citi may have limited visibility or control (see also the operational processes and systems risk factor below). While Citi may provide restrictions on use of certain data in third-party AI applications or models, a third party could breach those terms, which could expose Citi to legal and reputations risks. Citi is also exposed to risks related to the use of AI technologies by counterparties, clients and vendors, where interconnected AI systems could amplify failures and threats of cyber infiltration, as well as cause widespread disruptions.

Read in the 10-K filed Feb 20, 2026 ↗

Moreover, the use of increasingly sophisticated AI technologies by malicious actors and others has increased the risk of fraud, including identity theft and bypassing of verification controls, and exposure to cyberattacks (see the cybersecurity risk factor below), as well as disinformation and market manipulation campaigns, and failure to effectively manage such risks could result in misappropriation of funds, unauthorized transactions, exposure of sensitive client or Company information, reputational harm and increased litigation and regulatory risk.

Read in the 10-K filed Feb 20, 2026 ↗

Technologies, systems, networks and other devices of Capital One, as well as those of our employees, service providers, insiders, customers, partners, network participants, including merchants, and other third parties with whom we interact, have been and may continue to be the subject of cyber-attacks and other security incidents, including computer viruses, hacking,

Read in the 10-K filed Feb 19, 2026 ↗

Furthermore, the Transaction exposes us to additional cybersecurity risks, which we expect to continue until the integration of Discover is completed. These risks include the possibility of previously undetected cybersecurity threats in Discover's operations, systems and networks, as well as risks related to the cybersecurity posture of Discover and its third-party service providers. The materialization of such risks could lead to the degradation or disruption of our operations and services; unauthorized access; breach of confidentiality; and misuse or modification of systems, networks and data. Additionally, in connection with the integration of Discover, failures or difficulties in retaining new personnel, including those with access to our confidential or sensitive information (including personal information), and other difficulties in the organizational,

Read in the 10-K filed Feb 19, 2026 ↗

technological and cultural integration process may heighten the risk of cyber-attacks and other security incidents, including as a result of human error, fraud or malice on the part of current or former employees.

Read in the 10-K filed Feb 19, 2026 ↗

restructurings, consolidations, operational outages, cybersecurity incidents and other similar events that may occur in any industry. For example, we are contingently liable for certain disputed credit card sales transactions that arise between customers and merchants. If a dispute is resolved in the customer’s favor, we will cause a credit or refund of the amount to be issued to the customer and charge back the transaction to the merchant or merchant acquirer. If we are unable to collect this amount from the merchant or merchant acquirer, we will bear the loss for the amount credited or refunded to the customer. Where the purchased product or service is not provided until some later date following the purchase, such as an airline ticket, the likelihood of potential liability increases.

Read in the 10-K filed Feb 19, 2026 ↗

JPMorganChase experiences numerous cyber attacks on its computer systems, software, networks and other technology assets. Cyber attacks could take many forms, and may be designed to:

Read in the 10-K filed Feb 13, 2026 ↗

Threat actors that perpetrate cyber attacks include individuals or groups that are:

Read in the 10-K filed Feb 13, 2026 ↗

JPMorganChase cannot guarantee that it will always detect cybersecurity threats to its systems or implement effective preventive measures against those threats. The reasons for this include:

Read in the 10-K filed Feb 13, 2026 ↗

The cybersecurity risks that JPMorganChase faces could be intensified by factors such as:

Read in the 10-K filed Feb 13, 2026 ↗

JPMorganChase could become increasingly vulnerable to cyber attacks if it does not, in a timely manner, identify and address emerging threats, known vulnerabilities or shortcomings in its cybersecurity controls, or if it fails to prioritize or complete enhancements to address them particularly in jurisdictions that could pose a heightened risk to its operations, including enhancements relating to:

Read in the 10-K filed Feb 13, 2026 ↗

Any of the above cybersecurity risks to which JPMorganChase may be exposed could also affect JPMorganChase’s vendors or other third parties with which it does business or is interconnected, including governmental entities and other market participants. A successful circumvention of JPMorganChase’s systems of any of those third parties could cause serious negative consequences, including:

Read in the 10-K filed Feb 13, 2026 ↗

•increased exposure to cyber attacks, system manipulation, or data loss if AI systems, particularly agentic systems, are not designed and implemented with appropriate safeguards to prevent systems from accessing sensitive data sources or system resources and taking actions

Read in the 10-K filed Feb 13, 2026 ↗

•intensified AI-enabled cyber threats, which may allow malicious actors to exploit vulnerabilities, reverse-engineer security patches, and conduct sophisticated social engineering attacks, potentially resulting in unauthorized access to sensitive information and data breaches, especially if JPMorganChase fails to adequately maintain, secure and upgrade its technological infrastructure in response to rapidly evolving technological advances

Read in the 10-K filed Feb 13, 2026 ↗

evolving, both in the U.S. and internationally, and includes regulatory schemes targeted specifically at AI as well as new and existing provisions in intellectual property, privacy, cybersecurity, consumer protection, employment and other laws applicable to the use of AI and changes in interpretation of the foregoing. These evolving laws and regulations could require changes in our implementation of AI technology and increase our compliance costs and the risk of non-compliance. AI models, particularly generative AI models, may, and often do, produce output or take action that is incorrect, that result in the release of personal, confidential or proprietary information, that reflect or introduce discrimination, errors or biases included in the data on which they are trained or prompts or algorithms on which they rely, that infringe on the intellectual property rights of others or that is otherwise harmful. In addition, the complexity of many AI models makes it challenging to understand why they are generating particular outputs. This limited transparency increases the challenges associated with assessing the proper operation of AI models, understanding and monitoring the capabilities of the AI models, reducing erroneous output, eliminating bias and complying with applicable laws and regulations, including those that require documentation or explanation of the basis on which decisions are made. Additionally, if we do not have sufficient rights to use AI models, the data on which they are trained or prompts or algorithms on which they rely or the output thereof, we could also incur liability through the violation of applicable laws and regulations, third-party intellectual property, privacy or other rights or contracts to which we are a party.

Read in the 10-K filed Feb 24, 2026 ↗

Further, we currently rely, and expect to continue to rely, on AI models developed by third parties, and are and would be dependent in part on the manner in which those third parties develop, train and deploy their models, which involves risks arising from any discrimination, errors or bias in the models and the data on which they are trained or prompts or algorithms on which they rely, as well as the risk of inadvertent disclosure or incorporation of our personal, confidential or proprietary information into publicly available training sets. Any of these risks may impact our ability to realize the benefit of such information or adequately maintain, protect and enforce our intellectual property rights, and could result in regulatory compliance failures and otherwise harm our competitive position and business. The use of AI by companies has resulted in, and may in the future result in, systems failures or errors and cyber-attacks or other similar incidents. We may not be able to sufficiently mitigate, remediate or detect any of the foregoing limitations or risks given our and other market participants’ evolving experience with using AI, the pace of technological change, and rapid adoption of AI by our third-party vendors, clients, counterparties or competitors. Any of these risks could expose us to liability or adverse legal or regulatory consequences and harm our reputation and the public perception of our business or the effectiveness of our security measures.

Read in the 10-K filed Feb 24, 2026 ↗

We are also exposed to risks arising from the use of AI technologies by bad actors to commit fraud and misappropriate funds and to facilitate cyber-attacks and other similar incidents. Generative AI, if used to perpetrate fraud or launch cyberattacks or other similar incidents, could create panic at a particular financial institution or securities exchange, which could pose a threat to financial stability.

Read in the 10-K filed Feb 24, 2026 ↗

These dynamics can lead to higher and more volatile commodity and energy prices, strained global supply chains, increased inflationary pressures and weaker economic growth both globally and in the United States. Financial markets may experience abrupt swings in asset valuations, higher risk premiums and periods of reduced liquidity. Geopolitical events can also spur elevated cyber threats, including state-sponsored and opportunistic cyber-attacks aimed at critical infrastructures and financial systems. Such attacks could disrupt our operations, compromise sensitive data, increase compliance and remediation costs and harm customer relationships.

Read in the 10-K filed Feb 24, 2026 ↗

The Company has experienced, and may continue to experience, failures and disruptions affecting the stability, performance, security, and availability of its applications, operating systems, and infrastructure. These include degraded processing performance, data quality issues, loss of network connectivity, software malfunctions and misconfigurations, and interruptions in the availability and reliability of cloud-based and other third-party systems and services. The Company’s substantial and increasing reliance on cloud service providers and other external technology vendors heightens exposure to risks outside of its control, including system outages, downtime, cyber-attacks, and adverse financial and operating conditions at those providers and vendors. The Company’s expanding use of AI tools and related technologies introduces additional operational risks, including reliance on data integrity and model performance as well as third-party AI services that may fail, degrade, or produce inaccurate or unexpected outputs.

Read in the 10-K filed Feb 24, 2026 ↗

Failures to properly maintain, upgrade, or secure applications, operating systems, and infrastructure may increase the Company’s susceptibility to cybersecurity threats, including supply chain attacks, and may impair the Company’s ability to meet business continuity and resiliency objectives. AI-enabled technologies may further expand the cyber-attack surface and velocity, including exposure to adversarial manipulation, data poisoning, and vulnerabilities in third-party AI and other platforms. These events have resulted in adverse client impacts, including the inability to access account information or conduct transactions through ATM, online, or mobile channels, the exposure of confidential, proprietary, personal, and other sensitive information, the posting of duplicative or delayed transactions, and delays in obtaining assistance through call centers. The Company cannot assure that similar or more severe operational or technology failures and disruptions, including AI-related failures or third-party service interruptions, will not occur in the future or that their effects can be prevented, contained, or remediated in a timely manner.

Read in the 10-K filed Feb 24, 2026 ↗

Regulatory and other legal frameworks surrounding AI continue to evolve and remain uncertain. If we do not have sufficient rights to use models, prompts, algorithms, and datasets on which our AI technologies rely or the related decisions, predictions, analysis, or other output, we could incur significant damages, substantial fees, deprivation of access, or considerable expense through a violation of applicable law, third-party intellectual property, privacy, or other rights, or other violations. New or changing statutes, regulations, or industry standards and practices may increase costs, restrict use cases, or require significant changes to our deployment or our existing systems and controls. If we fail to appropriately respond to changes within the AI landscape, including changing public sentiment, we could face legal, regulatory, or brand and stakeholder risk that may negatively impact our business, operations, financial results, financial condition, or reputation. In addition, the use of AI by companies has resulted in, and may in the future result in, cybersecurity breaches, attacks, and other similar incidents as well as data privacy violations.

Read in the 10-K filed Feb 24, 2026 ↗