VALLEY NATIONAL BANCORP 10-Q

Item 1A. Risk Factors The section titled Risk Factors in Part I, Item 1A of our 2020 Annual Report on Form 10-K includes a discussion of the many risks and uncertainties we face, any one or more of which could have a material adverse effect on our business, results of operations, financial condition (including capital and liquidity). The information presented below provides an update to, and should be read in conjunction with, the risk factors and other information contained in our 2020 Annual Report on Form 10-K. Except as presented below, there have been no material changes to these risk factors. Cyber-attacks could compromise our information or result in the data of our customers being improperly divulged or our systems being disrupted which could expose us to liability, losses and escalating operating costs. Valley regularly collects, processes, transmits and stores confidential information regarding its customers, employees and others for whom it services loans. In some cases, this confidential or proprietary information is collected, compiled, processed, transmitted or stored by third parties on Valley’s behalf. Information security risks have increased because of the proliferation of new technologies and the increased sophistication and activities of perpetrators of cyber-attacks. Many financial institutions and companies engaged in data processing have reported significant breaches in the security of their websites or other systems, some of which have involved sophisticated and targeted attacks intended to obtain unauthorized access to confidential information, destroy data, denial-of-service, or sabotage systems, often through the introduction of computer viruses or malware, cyber-attacks and other means. In addition, recently there have been well-publicized “ransomware” attacks against various U.S. companies with the intent to materially disrupt their computer network and services. Valley frequently experiences attempted cybersecurity attacks against its systems. In 2021, there was a breach by a threat actor of a legacy network from an acquired bank. The breach resulted in the unauthorized access of certain data stored on the legacy network. The legacy network was isolated from Valley’s network, which was not affected by the incident. There can be no assurances that Valley will not incur breaches of our systems or that of our vendors which may expose the data of our customers or disrupt our services, exposing us to significant damage, on-going operational costs and/or reputational harm. Cyber risk exposure will remain elevated or increase in the future due to, among other things, the increasing size and prominence of Valley in the financial services industry, our expansion of Internet and mobile banking tools and new products based on customer needs, and the system and customer account conversions associated with the integration of merger targets. Successful attacks on any one of many our third-party service providers may 82 adversely affect our business and result in the disclosure or misuse of our confidential information or that of our customers. There can be no assurance that we or our third-party service providers will not suffer a cyber-attack that exposes us to significant damages, operational costs, or reputational harm.