Item 1A. Risk Factors
Item 1A. Risk Factors
There have been no material changes to our risk factors disclosed in our Annual Report on Form 10-K for the fiscal year ended September 30, 2022; however, in light of recent developments with a third-party service provider, the Company is supplementing its risk factors in this Form 10-Q.
One of the Bank's third-party service providers reported experiencing a security breach that resulted in our customers' data being compromised.
During June 2023, a third-party service provider (the "Service Provider") to the Bank confirmed to the Bank that files with personally identifiable information related to Bank customers had been compromised during a security incident experienced by the Service Provider (the "Incident"). The Bank uses the Service Provider to process transactions. The Incident resulted from a zero-day vulnerability in a managed file sharing software called MOVEit. MOVEit is used by thousands of organizations around the world for securely transferring sensitive and confidential information and other data. The vulnerability was exploited in a large-scale, cyber campaign that impacted government agencies, universities, and corporations around the world.
As a result of the Incident, an unauthorized party was able to obtain access to certain Bank customers' data in the Service Provider's possession that contained social security numbers, account numbers, and other personally identifiable information. The Bank confirmed the Service Provider has fixed the vulnerability noted above and the Bank has implemented additional security procedures when sharing files with the Service Provider. When the Bank received notice of the Incident from the Service Provider, the Bank promptly enacted response protocols. The Service Provider has provided appropriate notifications to potentially affected customers. The Bank is working with the Service Provider to identify any others potentially impacted by the Incident. The Bank is not aware of any other third-party incidents related to the MOVEit vulnerability that has affected personally identifiable information associated with Bank customers.
We may incur certain expenses related to the Incident and the Bank remains subject to risks and uncertainties as a result of the Incident, including adverse effects on our business and reputation, litigation risk and additional regulatory scrutiny. We currently believe the Incident will not have a material adverse effect on the Company or the Bank's operations or financial results.
Text extracted from the filing as submitted to EDGAR. Formatting, tables and exhibits are simplified for reading; the original document is authoritative for anything you rely on.