PCB BANCORP 10-K

Item 3. Legal Proceedings In the normal course of business, the Company is involved in various legal claims. The Company has reviewed all legal claims with counsel and has taken into consideration the views of such counsel as to the potential outcome of the claims in determining the accrued loss contingency. The Company had no accrued loss contingencies for certain legal claims at December 31, 2022. It is reasonably possible the Company may incur losses in addition to the amounts currently accrued. However, at this time, the Company is unable to estimate the range of additional losses that are reasonably possible because of a number of factors, including the fact that certain of these litigation matters are still in their early stages and involve claims for which, at this point, the Company believes have little to no merit. Management has considered these and other possible loss contingencies and does not expect the amounts to be material to the consolidated financial statements. On August 30, 2021, the Bank identified unusual activity on its network. The Bank responded promptly to disable the activity, investigate its source and monitor the Bank’s network. The Bank subsequently became aware of claims that it had been the target of a ransomware attack. On September 7, 2021, the Bank determined that an external actor had illegally accessed and/or acquired certain data on its network. The Bank has been working with third-party forensic investigators to understand the nature and scope of the incident and determine what information may have been accessed and/or acquired and who may have been impacted. The investigation revealed that this incident impacted certain files containing certain Bank customer information. Some of these files contained documents related to loan applications, such as tax returns, Form W-2 information of their employees, and payroll records. The Bank has notified all individuals identified as impacted, consistent with applicable laws. All impacted individuals were offered free Equifax Complete Premier credit monitoring and identify theft protection services. The Bank has notified law enforcement and appropriate authorities of the incident. On December 16, 2021, Plaintiff Min Woo Bae, individually and on behalf of all others similarly situated, filed in the Los Angeles County Superior Court a complaint based on the incident for damages, injunctive relief, and equitable relief, styled Min Woo Bae v. Pacific City Bank , Case Number 21STCV45922 (“the Matter”). In the Matter, Plaintiff seeks to form a class action and alleges causes of action for: (1) negligence; (2) unjust enrichment; (3) violations of California’s Consumer Privacy Act, Civil Code § 1798.150(a); and (4) violations of California’s unfair competition law (Cal. Bus. & Prof. Code § 17200, et seq.). The summons and complaint have been served on the Bank as of the date of this submission. The Bank expresses no opinion on the merits of the Matter. The Bank had answered, responded, and will continue to defend itself from the claims and causes of action asserted in the complaint to the fullest extent permitted by applicable law. Those defenses will be based in part on the fact that the Bank has implemented security procedures, practices, and a robust information security program pursuant to guidance from the applicable financial regulators. The Company continues to monitor and evaluate the data incident for its magnitude and concomitant financial, legal or reputational consequences. During the year ended December 31, 2021, expenses associated with the data incident, all of which are included in Other Expense in Consolidated Statements of Income, totaled $100 thousand, which represents the retention amount on its insurance claims. During the year ended December 31, 2022, the Company incurred additional legal expenses of $220 thousand associated with the on-going legal matters related to the data incident, all of which are included in Professional Fees in Consolidated Statement of Income. The Company anticipates additional expenses will be incurred in future periods; however, the Company does have a cyber-liability insurance policy that should provide insurance coverage for this incident. Item 4. Mine Safety Disclosures Not applicable. 41 Part II