PNC Bank 2013 Annual Report Download - page 38

us in this manner depends on secure transmission of
confidential information, which increases the risk of data
security breaches.
Starting in late 2012, there have been several well-publicized
series of apparently related denial of service attacks on large
financial services companies, including PNC. In a denial of
service attack, individuals or organizations flood commercial
websites with extraordinarily high volumes of traffic, with the
goal of disrupting the ability of commercial enterprises to
process transactions and possibly making their websites
unavailable to customers for extended periods of time. The
attacks against PNC have resulted in temporary disruptions in
customers’ ability to access the corporate website and to
perform on-line banking transactions. To date, no customer
data has been lost or compromised and these efforts have not
had a material impact on PNC. We cannot, however, provide
assurance that future attacks of this type might not have a
greater effect on PNC.
As our customers regularly use PNC-issued credit and debit
cards to pay for transactions with retailers and other
businesses, there is the risk of data security breaches at those
other businesses covering PNC account information. When
our customers use PNC-issued cards to make purchases from
those businesses, card account information is provided to the
business. If the business’s systems that process or store card
account information are subject to a data security breach,
holders of our cards who have made purchases from that
business may experience fraud on their card accounts. PNC
may suffer losses associated with reimbursing our customers
for such fraudulent transactions on customers’ card accounts,
as well as for other costs related to data security compromise
events, such as replacing cards associated with compromised
card accounts. In addition, PNC provides card transaction
processing services to some merchant customers under
agreements we have with payment networks such as Visa and
MasterCard. Under these agreements, we may be responsible
for certain losses and penalties if one of our merchant
customers suffers a data security breach.
In late 2013, several large retailers, including most
prominently Target, disclosed that they have suffered
substantial data security breaches compromising millions of
card accounts. To date, PNC’s losses and costs related to these
breaches have not been material, but other similar events in
the future could be more significant to PNC.
Methods used by others to attack information systems change
frequently (with generally increasing sophistication), often are
not recognized until launched against a target, may be
supported by foreign governments or other well-financed
entities, and may originate from less regulated and remote
areas around the world. As a result, we may be unable to
address these methods in advance of attacks, including by
implementing adequate preventive measures.
We have policies, procedures and systems (including business
continuity programs) designed to prevent or limit the effect of
possible failures, interruptions or breaches in security of
information systems. We design our business continuity and
other information and technology risk management programs
to manage our capabilities to provide services in the case of an
event resulting in material disruptions of business activities
affecting our employees, facilities, technology or suppliers.
We regularly seek to test the effectiveness of and enhance
these policies, procedures and systems.
Our ability to mitigate the adverse consequences of such
occurrences is in part dependent on the quality of our business
continuity planning and our ability to anticipate the timing and
nature of any such event that occurs. The adverse impact of
natural and other disasters, terrorist activities, international
hostilities and the like could be increased to the extent that there
is a lack of preparedness on the part of national or regional
governments, including emergency responders, or on the part of
other organizations and businesses with which we deal,
particularly those on which we depend but have no control over.
In recent years, we have incurred significant expense towards
improving the reliability of our systems and their security from
attack. Nonetheless, there remains the risk that an adverse event
might occur. If one does occur, we might not be able to fix it
timely or adequately. To the extent that the risk relates to
products or services provided by others, we seek to engage in
due diligence and monitoring to limit the risk, but here too we
cannot eliminate it. Should an adverse event affecting another
company’s systems occur, we may not have indemnification or
other protection from the other company sufficient to
compensate us or otherwise protect us from the consequences.
The occurrence of any failure, interruption or security breach
of any of our information or communications systems, or the
systems of other companies on which we rely, could result in
a wide variety of adverse consequences to PNC. This risk is
greater if the issue is widespread or results in financial losses
to our customers. Possible adverse consequences include
damage to our reputation or a loss of customer business. We
also could face litigation or additional regulatory scrutiny.
Litigation or regulatory actions in turn could lead to liability
or other sanctions, including fines and penalties or
reimbursement of customers adversely affected by a systems
problem or security breach. Even if we do not suffer any
material adverse consequences as a result of events affecting
us directly, successful attacks or systems failures at other large
financial institutions could lead to a general loss of customer
confidence in financial institutions including PNC. Also,
systems problems, including those resulting from third party
attacks, whether at PNC or at our competitors, would likely
increase regulatory and customer concerns regarding the
functioning, safety and security of such systems generally. In
that case, we would expect to incur even higher levels of costs
with respect to prevention and mitigation of these risks.
20 The PNC Financial Services Group, Inc. – Form 10-K