LOEWS CORP 10-Q

Item 1. Legal Proceedings. Information on our legal proceedings is set forth in Note 10 to the Consolidated Condensed Financial Statements included under Part I, Item 1. I tem 1A. Risk Factors. Our Annual Report on Form 10-K for the year ended December 31, 2020 includes a detailed discussion of certain risk factors facing the company. Except as described below, there have been no material changes to the risk factors previously disclosed in Part I, Item 1A, Risk Factors of our Annual Report on Form 10-K for the year ended December 31, 2020. Risks Related to Us and Our Subsidiary, CNA Financial Corporation (“CNA”) Any significant interruption in the operation of CNA’s business functions, facilities and systems or its vendors’ facilities and systems could result in a materially adverse effect on its operations. CNA’s business is highly dependent upon its ability to perform, in an efficient and uninterrupted manner, through its employees or vendor relationships, necessary business functions (such as internet support and 24-hour call centers), processing new and renewal business and processing and paying claims and other obligations. CNA’s or its vendors’ facilities and systems could become unavailable, inoperable, or otherwise impaired from a variety of causes, including natural events, such as hurricanes, tornadoes, windstorms, earthquakes, severe winter weather and fires, or other events, such as explosions, terrorist attacks, computer security breaches or cyber attacks, riots, hazardous material releases, medical epidemics or pandemics, utility outages, interruptions of CNA’s data processing and storage systems or the systems of third-party vendors, or unavailability of communications facilities. An interruption of CNA’s system availability occurred in March of 2021 as a result of a cybersecurity attack sustained by CNA. Please refer to following risk factor for further information regarding this incident. Likewise, CNA could experience a significant failure, interruption or corruption of one or more of its vendors’ information technology, telecommunications, or other systems for various reasons, including significant failures or interruptions that might occur as existing systems are replaced or upgraded. The shut-down or unavailability of one or more of CNA’s or its vendors’ systems or facilities for these and other reasons could significantly impair CNA’s ability to perform critical business functions on a timely basis. In addition, because CNA’s information technology and telecommunications systems interface with and depend on third-party systems, CNA could experience service denials if demand for such service exceeds capacity or a third-party system fails or experiences an interruption. If sustained or repeated, such events could result in a deterioration of CNA’s ability to write and process new and renewal business, provide customer service, pay claims in a timely manner, or perform other necessary business functions, including the ability to issue financial statements in a timely manner. 43 Index The foregoing risks could also expose CNA to monetary and reputational damages. Potential exposures resulting from the March of 2021 cybersecurity attack, described in the following risk factor, as well as any future incidents may include substantially increased compliance costs and required computer system upgrades and security-related investments. If CNA’s business continuity plans or system security do not sufficiently address these risks, they could have a material adverse effect on CNA’s business, results of operations and financial condition. Based on the information currently known, CNA does not believe that the March of 2021 cybersecurity attack will have a material impact on its business, results of operations or financial condition. However, no assurances can be given, and CNA may be subject to future incidents that could have a material adverse effect or result in operational impairments and financial losses, as well as significant harm to its reputation. Any significant breach in CNA’s data security infrastructure could disrupt business, cause financial losses and damage its reputation, and insurance coverage may not be available for claims related to a breach. A significant breach of CNA’s data security infrastructure may result from actions by its employees, vendors, third-party administrators, or unknown third parties or through cyber attacks. The risk of a breach can exist whether software services are in CNA’s data centers or CNA uses cloud-based software services. Such a breach could affect CNA’s data framework or cause a failure to protect the personal information of its customers, claimants or employees, or sensitive and confidential information regarding its business and may result in operational impairments and financial losses, as well as significant harm to its reputation. The breach of confidential information also could give rise to legal liability and regulatory action under data protection and privacy laws, as well as evolving regulation in this regard. Any such breach of CNA’s data security infrastructure could have a material adverse effect on its business, results of operations and financial condition. CNA sustained a sophisticated cybersecurity attack in March of 2021 involving ransomware that caused a network disruption and impacted certain of its systems. Promptly upon detection, CNA undertook steps to address the incident, including engaging a team of third-party forensic experts and notifying law enforcement and key regulators. As of the date of this report, CNA has restored network systems and resumed normal operations. CNA is continuing to assess the full extent of the impact from the incident, as well as determining any additional actions it may take to improve its existing systems. Although the investigation is ongoing, should CNA determine that personal information was impacted, it is possible that notification to individuals, other parties and/or regulators may be required based on applicable law. As a result or otherwise related to the incident, CNA may be subject to subsequent investigations, claims or actions in addition to other costs, fines, penalties, or other obligations. Although CNA maintains cybersecurity insurance coverage insuring against costs resulting from cyber attacks (including the attack described above), it is possible losses may exceed the amount available under CNA’s coverage and its coverage policy may not cover all losses. Further, future cybersecurity insurance coverage may be difficult to obtain or may only be available at significantly higher costs to CNA. Based on the information currently known, CNA does not believe that the March of 2021 cybersecurity attack will have a material impact on its business, results of operations or financial condition. However, no assurances can be given, and CNA may be subject to future incidents that could have such a material adverse effect or may result in operational impairments and financial losses, as well as significant harm to CNA’s reputation. 44 Index