What changed in this filing

/stocks — the workspaceLOADING

Item 3. Legal Proceedings

2022-03-04 compared with 2021-03-11 · 26 added, 0 removed, 9 unchanged (74% of the section changed)

6 unchanged sentences

Management has considered these and other possible loss contingencies and does not expect the amounts to be material to the consolidated financial statements.

On August 30, 2021, the Bank identified unusual activity on its network.

The Bank responded promptly to disable the activity, investigate its source and monitor the Bank’s network.

The Bank subsequently became aware of claims that it had been the target of a ransomware attack.

On September 7, 2021, the Bank determined that an external actor had illegally accessed and/or acquired certain data on its network.

The Bank has been working with third-party forensic investigators to understand the nature and scope of the incident and determine what information may have been accessed and/or acquired and who may have been impacted.

The investigation revealed that this incident impacted certain files containing certain Bank customer information.

Some of these files contained documents related to loan applications, such as tax returns, Form W-2 information of their employees, and payroll records.

The Bank has notified all individuals identified as impacted, consistent with applicable laws.

All impacted individuals were offered free Equifax Complete Premier credit monitoring and identify theft protection services.

The Bank has notified law enforcement and appropriate authorities of the incident.

On December 16, 2021, Plaintiff Min Woo Bae, individually and on behalf of all others similarly situated, filed in the Los Angeles County Superior Court a complaint based on the incident for damages, injunctive relief, and equitable relief, styled Min Woo Bae v.

Pacific City Bank , Case Number 21STCV45922 (“the Matter”).

In the Matter, Plaintiff seeks to form a class action and alleges causes of action for:

(1) negligence;

(2) unjust enrichment;

(3) violations of California’s Consumer Privacy Act, Civil Code § 1798.150(a);

and (4) violations of California’s unfair competition law (Cal.

Code § 17200, et seq.).

The summons and complaint have been served on the Bank as of the date of this submission.

On January 7, 2022, the Court entered a minute order staying the Matter at least until March 4, 2022, when the Court will hold an initial status conference.

The Bank expresses no opinion on the merits of the Matter and intends to answer, respond, and/or otherwise defend itself from the claims and causes of action asserted in the complaint to the fullest extent permitted by applicable law.

The Company continues to monitor and evaluate the data incident for its magnitude and concomitant financial, legal or reputational consequences.

To date, such consequences are not material, however the data incident is still recent and notices to affected individuals only recently began and the lawsuit mentioned above is in its very early stages.

During the year ended December 31, 2021, expenses associated with the data incident, all of which are included in Other Expense in Consolidated Statements of Income (Unaudited), totaled $100 thousand, which represents the retention amount on its insurance claims.

The Company anticipates additional expenses will be incurred in future periods;

however, the Company does have a cyber-liability insurance policy that should provide insurance coverage for this incident.

Mine Safety Disclosures

1 unchanged sentence

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 3. Legal Proceedings