AmazonScience/document-haystack

1be responsible for certain losses and penalties if one of our merchant customers suffers a data security breach. Moreover, to the extent 2more consumer confidential information becomes available to bad actors through the cumulative effect of data breaches at companies 3generally, bad actors may find it easier to use such information to gain access to our customer accounts.4Other cyber attacks are not focused on gaining access to credit card or user credential information, but instead seek access to a range 5of other types of confidential information, such as internal emails and other forms of customer financial information, and this 6information may be used to support a ransomware attack. Ransomware attacks have sought to deny access to data and possibly shut 7down systems and devices maintained by target companies. In a ransomware attack, system data is encrypted, stolen or extorted, or 8access is otherwise denied, accompanied by a demand for ransom to restore access to the data or to prevent public disclosure of 9confidential information. Attacks have also been conducted through business email compromise scams that involve using social 10engineering to cause employees to wire funds to the perpetrators in the mistaken belief that the requests were made by a company 11executive or established vendor. These types of phishing attacks have increased over time, and they have evolved to include other 12types of attacks like vishing (through voice messages) and smishing (through SMS text). Other attacks have included distributed 13denial of service cyber attacks, in which individuals or organizations flood commercial websites with extraordinarily high volumes of 14traffic with the goal of disrupting the ability of commercial enterprises to process transactions and possibly making their websites 15unavailable to customers for extended periods of time. Similarly, attacks have been conducted through application program interfaces 16where cyber attackers seek to exploit the interfaces between mobile or web applications. We (as well as other financial services 17companies) have been subject to such attacks. Recent cyber attacks have also included the insertion of malware into software updates 18and the infection of software while it is under assembly, known as a “supply chain attack.” Attacks on our customers may put these 19relationships at risk, particularly if customers’ ability to continue operations is impaired due to the losses suffered.20The techniques used in cyber attacks change rapidly and are increasingly sophisticated, including through the use of generative 21artificial intelligence and deepfakes, and we expect in the future through the use of quantum computing, and we may not be able to 22anticipate cyber attacks or data security breaches. 23In addition to threats from external sources, insider threats represent a significant risk to us. Insiders, including those having legitimate 24access to our systems and the information contained in them, have the easiest opportunity to make inappropriate use of the systems 25and information. Addressing that risk requires understanding not only how to protect us from unauthorized use and disclosure of data, 26but also how to engage behavioral analytics and other tools to identify potential internal threats before any damage is done. In 27addition, due to the increase in the number of employees who work remotely, the opportunity for insiders to grant access to third 28parties or to disclose confidential information of PNC or its customers has increased. As more work is conducted outside of PNC’s 29facilities, the risk of improper access to PNC’s network or confidential information has increased, including for reasons such as a 30failure by an employee or contractor to secure a device with PNC access.31We have been and expect to continue to be the target of some of these types of cyber attacks. To date, none of these types of cyber 32attacks has had a material impact on us. Nonetheless, we cannot entirely block efforts by bad actors to harm us, and there can be no 33assurance that future cyber attacks will not be material. While we maintain insurance coverage that may cover certain aspects of cyber 34risks, such insurance coverage may be insufficient to cover all losses. As a result, we could suffer material financial and reputational 35losses in the future from any of these or other types of attacks or the public perception that such an attack on our systems has been 36successful, whether or not this perception is correct. Attacks on others, some of which have led to serious adverse consequences, 37demonstrate the risks posed by new and evolving types of cyber attacks. 38We need effective programs to limit the risk of failures or breaches occurring in our information systems and to mitigate the 39impact when they do.40We have policies, procedures and systems (including cybersecurity and business continuity programs) designed to prevent or limit the 41effect of possible failures, interruptions or breaches in security of information systems. We continue to devote appropriate resources 42toward improving the reliability of our systems and their security against external and internal threats and expect to continue to do so 43in the future. We design our business continuity and other information and technology risk management programs to allow us to 44provide services in the case of an event resulting in material disruptions of business activities affecting our employees, facilities, 45technology or suppliers. We cannot guarantee the effectiveness of our policies, procedures and systems to protect us in any future 46situation, nor the effectiveness of our oversight of risk at third parties. Although we have policies, procedures and systems designed to 47mitigate third-party risk, our ability to implement policies, procedures and systems designed to prevent or limit the effect of possible 48failures, interruptions or breaches in security of information systems with respect to third-party systems and the financial services 49industry infrastructure is necessarily limited. Should an adverse event affecting another company’s systems occur, we may not have 50financial protection from the other company sufficient to compensate us or otherwise protect us from the consequences.51Methods used by others to attack information systems change frequently (with generally increasing sophistication). A new method of 52attack often is not recognized until launched against a target. Attacks in some cases appear to be supported by foreign governments or 53other well-financed entities and often originate from less regulated and remote areas around the world. We have seen a higher volume 54 55The PNC Financial Services Group, Inc. –  2023 Form 10-K  23