CNA FINANCIAL CORP

Previous wording

We are subject to the uncertain effects of emerging and potential claims and coverage issues that arise as industry practices and legal, judicial, social, economic and other environmental conditions change. Further, the impact of social inflation continues to be significant and the trajectory of its future impact remains uncertain. In addition, passage of reviver statutes that extend, or eliminate, the statute of limitations for the reporting of claims, including statutes passed in certain states with respect to sexual molestation and sexual abuse, increase the uncertainty of the frequency of claims. These issues, have had, and may continue to have, a negative effect on our business, results of operations and financial condition by either extending coverage beyond the original underwriting intent or by increasing the number or size of claims, resulting in further increases in our reserves. The effects of unforeseen emerging or potential claim and coverage issues are extremely difficult to predict and may be material.

Current wording

We are subject to the uncertain effects of emerging and potential claims and coverage issues that arise as industry practices and legal, judicial, geopolitical, social, economic and other environmental conditions change. Further, the impact of social inflation continues to be significant and the trajectory of its future impact remains uncertain. Any imposition of significant tariffs by the U.S., as well as any related retaliatory tariffs, may result in considerable increases in certain costs that would increase the cost of claims. In addition, passage of reviver statutes that extend, or eliminate, the statute of limitations for the reporting of claims, including statutes passed in certain states with respect to sexual molestation and sexual abuse, increase the uncertainty of the frequency of claims, and the impact of social inflation has, and may continue to, increase the severity of these claims. These issues, have had, and may continue to have, a negative effect on our business, results of operations and financial condition by either extending coverage beyond the original underwriting intent or by increasing the number or size of claims, resulting in further increases in our reserves. The effects of unforeseen emerging or potential claim and coverage issues are extremely difficult to predict and may be material.

Previous wording

Our future policy benefit reserves for long-term care policies are based on our best estimate actuarial assumptions, which are assessed quarterly and updated at least annually. Key actuarial assumptions include morbidity, persistency (inclusive of mortality), anticipated future premium rate increases and expenses. The adequacy of the reserves is contingent upon actual experience and our future expectations related to these key assumptions. If actual or expected future experience differs from these assumptions, the reserves may not be adequate, requiring us to increase reserves. The required increase in reserves is recorded as a charge against our earnings in the period in which reserves are determined to be insufficient. These charges have been and in the future could be substantial. The reserves are discounted using upper-medium grade fixed income instrument yields as of each reporting date. Discount rates are subject to interest rate and market volatility. See the Life & Group Policyholder Reserves portion of Reserves - Estimates and Uncertainties section of MD&A in Item 7 for more information.

Current wording

Our future policy benefit reserves for long-term care policies are based on our best estimate actuarial assumptions, which are assessed quarterly and updated at least annually. Key actuarial assumptions include morbidity, persistency, anticipated future premium rate increases and expenses. The adequacy of the reserves is contingent upon actual experience and our future expectations related to these key assumptions. If actual or expected future experience differs from these assumptions, the reserves may not be adequate, requiring us to increase reserves. The required increase in reserves is recorded as a charge against our earnings in the period in which reserves are determined to be insufficient. These charges have been and in the future could be substantial. The reserves are discounted using upper-medium grade fixed income instrument yields as of each reporting date. Discount rates are subject to interest rate and market volatility. See the Life & Group Policyholder Reserves portion of Reserves - Estimates and Uncertainties section of MD&A in Item 7 for more information.

Previous wording

Morbidity and persistency experience, inclusive of mortality, can be volatile and may be negatively affected by many factors including, but not limited to, policyholder behavior, judicial decisions regarding policy terms, socioeconomic factors, cost of care inflation, changes in health trends and advances in medical care.

Current wording

Morbidity and persistency experience can be volatile and may be negatively affected by many factors including policyholder behavior, judicial decisions regarding policy terms, socioeconomic factors, cost of care inflation, changes in health trends and advances in medical care.

Previous wording

A prolonged period during which investment returns remain at low levels could result in shortfalls in investment income on assets supporting our obligations under long-term care policies. This risk is more significant for our long-term care products because the long potential duration of the policy obligations exceeds the duration of the supporting investment assets. In addition, we may not receive regulatory approval for the level of premium rate increases we request. Any adverse deviation between the level of future premium rate increases approved and the level included in our reserving assumptions may require an increase to our reserves.

Current wording

A prolonged period during which investment returns remain at low levels could result in shortfalls in investment income on assets supporting our obligations under long-term care policies. This risk may be more significant for our long-term care products when the long potential duration of the policy obligations exceeds the duration of the supporting investment assets. In addition, we may not receive regulatory approval for the level of premium rate increases we request. Any adverse deviation between the level of future premium rate increases approved and the level included in our reserving assumptions may require an increase to our reserves.

Previous wording

Catastrophe losses are an inevitable part of our business. Various events can cause catastrophe losses. These events can be natural or man-made, and may include hurricanes, tornadoes, windstorms, earthquakes, hail, severe winter weather, fires, floods, riots, strikes, civil unrest, cyber-attacks, pandemics and acts of terrorism. The frequency and severity of these catastrophe events are inherently unpredictable. Exposure to cyber risk is increasing systematically due to greater digital dependence, which increases the potential for, and the potential losses due to, a catastrophic cyber event. Catastrophic cyber-attack scenarios are not bound by time or geographic limitations and cyber-related catastrophic perils don’t have well-established definitions or fundamental physical properties. In addition, longer-term natural catastrophe trends may be changing and new types of catastrophe losses may be developing due to climate change, its associated extreme weather events linked to rising temperatures and its effects on global weather patterns, greenhouse gases, sea, land and air temperatures, sea levels, rain, hail and snow. Climate studies by government agencies, academic institutions, catastrophe modeling organizations and other groups indicate that climate change may be altering the frequency and/or severity of catastrophic weather events, such as hurricanes, tornadoes, windstorms, floods and other natural disasters.

Current wording

Catastrophe losses are an inevitable part of our business. Various events can cause catastrophe losses. These events can be natural or man-made, and may include hurricanes, tornadoes, windstorms, earthquakes, hail, severe winter weather, droughts, fires, floods, riots, strikes, civil unrest, cyber-attacks, pandemics and acts of terrorism. The frequency and severity of these catastrophe events are inherently unpredictable. Exposure to cyber risk is increasing systematically due to greater digital dependence, which increases the potential for, and the potential losses due to, a catastrophic cyber event. Catastrophic cyber-attack scenarios are not bound by time or geographic limitations and cyber-related catastrophic perils don’t have well-established definitions or fundamental physical properties. In addition, longer-term natural catastrophe trends may be changing and new types of catastrophe losses may be developing due to climate change, its associated extreme weather events linked to rising temperatures and its effects on global weather patterns, greenhouse gases, sea, land and air temperatures, sea levels, rain, drought, hail and snow. Climate studies by government agencies, academic institutions, catastrophe modeling organizations and other groups indicate that climate change may be altering the frequency and/or severity of catastrophic weather events, such as hurricanes, tornadoes, windstorms, earthquakes, hail, severe winter weather, droughts, fires and floods.

Previous wording

We have experienced, and may continue to experience, increased claim submissions and litigation related to denial of claims based on policy coverage or the facts of the claim, in certain lines of business that are implicated by the COVID-19 pandemic and mitigating actions taken by our customers and governmental authorities in response to its spread. These lines include primarily healthcare professional liability, workers' compensation, commercial property related business interruption coverage, management liability (directors and officers, employment practices and professional liability lines) and trade credit. We recorded significant losses during 2020, a significant portion of which remain classified as incurred but not reported (IBNR) reserves, in these areas and may experience continued losses, which could be material.

Current wording

We have experienced, and may continue to experience, claim submissions and litigation related to denial of claims based on policy coverage or the facts of the claim, in certain lines of business that are implicated by the COVID-19 pandemic and mitigating actions taken by our customers and governmental authorities in response to its spread. These lines include primarily commercial property related business interruption coverage, healthcare professional liability, management liability (directors and officers, employment practices and professional liability lines) and workers' compensation. We recorded significant losses during 2020, a portion of which remain classified as incurred but not reported (IBNR) reserves, in these areas and may experience continued losses, which could be material.

Previous wording

Our property and casualty insurance subsidiaries have exposures related to A&EP claims. Our experience has been that establishing claim and claim adjustment expense reserves for casualty coverages relating to A&EP claims is subject to uncertainties that are greater than those presented by more traditional property and casualty claims. Additionally, traditional actuarial methods and techniques employed to estimate the ultimate cost of claims for more traditional property and casualty exposures are less precise in estimating claim and claim adjustment expense reserves for A&EP. As a result, estimating the ultimate cost of both reported and unreported A&EP claims is subject to a higher degree of variability. On August 31, 2010, we completed a retroactive reinsurance transaction under which substantially all of our legacy A&EP liabilities were ceded to National Indemnity Company (NICO), a subsidiary of Berkshire Hathaway Inc., subject to an aggregate limit of $4 billion (Loss Portfolio Transfer). The cumulative amount ceded under the Loss Portfolio Transfer as of December 31, 2023 was $3.6 billion. If the other parties to the Loss Portfolio Transfer do not fully perform their obligations, net losses incurred on A&EP claims covered by the Loss Portfolio Transfer exceed the aggregate limit of $4 billion, or we determine we have exposures to A&EP claims not covered by the Loss Portfolio Transfer, we may need to increase our recorded net reserves which would result in a charge against our earnings. These charges could be substantial. Additionally, if the A&EP claims exceed the limit of the Loss Portfolio Transfer, we will need to assess whether to purchase additional limit or to reassume claim handling responsibility for A&EP claims from an affiliate of NICO. Any additional reinsurance premium or future claim handling costs would also reduce our earnings.

Current wording

Our property and casualty insurance subsidiaries have exposures related to A&EP claims. Our experience has been that establishing claim and claim adjustment expense reserves for casualty coverages relating to A&EP claims is subject to uncertainties that are greater than those presented by more traditional property and casualty claims. Additionally, traditional actuarial methods and techniques employed to estimate the ultimate cost of claims for more traditional property and casualty exposures are less precise in estimating claim and claim adjustment expense reserves for A&EP. As a result, estimating the ultimate cost of both reported and unreported A&EP claims is subject to a higher degree of variability. On August 31, 2010, we completed a retroactive reinsurance transaction under which substantially all of our legacy A&EP liabilities were ceded to National Indemnity Company (NICO), a subsidiary of Berkshire Hathaway Inc., subject to an aggregate limit of $4 billion (Loss Portfolio Transfer). The cumulative amount ceded under the Loss Portfolio Transfer as of December 31, 2024 was $3.7 billion. If the other parties to the Loss Portfolio Transfer do not fully perform their obligations, net losses incurred on A&EP claims covered by the Loss Portfolio Transfer exceed the aggregate limit of $4 billion, or we determine we have exposures to A&EP claims not covered by the Loss Portfolio Transfer, we may need to increase our recorded net reserves which would result in a charge against our earnings. These charges could be substantial. Additionally, if the A&EP claims exceed the limit of the Loss Portfolio Transfer, we will need to assess whether to purchase additional limit or to reassume claim handling responsibility for A&EP claims from an affiliate of NICO. Any additional reinsurance premium or future claim handling costs would also reduce our earnings.

Previous wording

We face potential exposure to various types of existing, new and emerging mass tort claims, including those related to exposure to potentially harmful products or substances, such as glyphosate, lead paint, per- and polyfluoroalkyl substances (PFAS) and opioids; claims arising from changes that expand the right to sue, remove limitations on recovery, extend the statutes of limitations or otherwise repeal or weaken tort reforms, such as those related to abuse reviver statutes, including New York reviver statutes; and claims related to new and emerging theories of liability, such as those related to global warming and climate change. Evolving judicial interpretations and new legislation regarding the application of various tort theories and defenses, including application of various theories of joint and several liability, as well as the application of insurance coverage to these claims, give rise to new and potentially more severe claim activity. For example, we have recorded, and may continue to record, increases in our mass tort reserves, driven substantially by abuse reviver statutes that have resulted in increased claims. Similar and continuing mass tort claim activity, including activity based on changing judicial interpretations and recent and proposed legislation, could have a material adverse effect on our business, results of operations and financial condition.

Current wording

We face potential exposure to various types of existing, new and emerging mass tort claims, including those related to exposure to potentially harmful products or substances, such as glyphosate, lead paint, per- and polyfluoroalkyl substances (PFAS) and opioids, sexual abuse and molestation claims, claims arising from changes that expand the right to sue, remove limitations on recovery, extend the statutes of limitations or otherwise repeal or weaken tort reforms, such as those related to abuse reviver statutes, including New York reviver statutes; and claims related to new and emerging theories of liability, such as those related to global warming and climate change. Evolving judicial interpretations and new legislation regarding the application of various tort theories and defenses, including application of various theories of joint and several liability, as well as the application of insurance coverage to these claims, give rise to new and potentially more severe claim activity. For example, we have recorded, and may continue to record, increases in our mass tort reserves, driven substantially by abuse reviver statutes that have resulted in increased claims. Similar and continuing mass tort claim activity, including activity based on changing judicial interpretations and recent and proposed legislation, could have a material adverse effect on our business, results of operations and financial condition.

Previous wording

We face intense competition in our industry; we may be adversely affected by the cyclical nature of the property and casualty business and the evolving landscape of our distribution network.

Current wording

We face intense competition in our industry; we may be adversely affected by the cyclical nature of the property and casualty business and by the evolving landscape of our distribution network.

Previous wording

All aspects of the insurance industry are highly competitive and we must continuously allocate resources to refine and improve our insurance products and services to remain competitive. We compete with a large number of stock and mutual insurance companies and other entities, some of which may be larger or have greater financial or other resources than we do, for both distributors and customers. This includes agents, brokers and managing general underwriters who may increasingly compete with us to the extent that markets continue to provide them with direct access to providers of capital seeking exposure to insurance risk. Insurers compete on the basis of many factors, including products, price, services, ratings and financial strength. The competitor landscape has evolved substantially in recent years, with significant consolidation and new market entrants, such as insurtech firms, resulting in increased pressures on our ability to remain competitive, particularly in obtaining pricing that is both attractive to our customer base and risk-appropriate to us.

Current wording

All aspects of the insurance industry are highly competitive and we must continuously allocate resources to refine and improve our insurance products and services to remain competitive. We compete with a large number of stock and mutual insurance companies and other entities, some of which may be larger or have greater financial or other resources than we do, for both distributors and customers. This includes agents, brokers and managing general underwriters who may increasingly compete with us, including as a result of markets continuing to provide them with direct access to providers of capital seeking exposure to insurance risk. Insurers compete on the basis of many factors, including products, price, services, ratings and financial strength. The competitor landscape has evolved substantially in recent years, with significant consolidation and new market entrants, such as insurtech firms, resulting in increased pressures on our ability to remain competitive, particularly in obtaining pricing that is both attractive to our customer base and risk-appropriate to us.

Previous wording

We market our insurance products worldwide primarily through independent insurance agents, insurance brokers, and managing general underwriters who also promote and distribute the products of our competitors. Any change in our relationships with our distribution network agents, brokers or managing general underwriters, including as a result of consolidation or their increased promotion and distribution of our competitors' products, could adversely affect our ability to sell our products. As a result, our business volume and results of operations could be materially adversely impacted.

Current wording

We market our insurance products worldwide primarily through independent insurance agents, insurance brokers, and managing general underwriters who also promote and distribute the products of our competitors, and in certain cases their own products. Any change in our relationships with our distribution network agents, brokers or managing general underwriters, including as a result of consolidation or their increased promotion and distribution of our competitors' or their own products, could adversely affect our ability to sell our products. As a result, our business volume and results of operations could be materially adversely impacted.

Previous wording

Technological changes in the way insurance transactions are completed in the marketplace, and our ability to react effectively to such change, may present significant competitive risks. For example, more insurers are utilizing "big data" analytics to make underwriting and other decisions that impact product design and pricing. If such utilization is more effective than how we use our data and information, we will be at a competitive disadvantage. There can be no assurance that we will continue to compete effectively with our industry peers due to technological changes; accordingly, this may have a material adverse effect on our business, results of operations and financial condition.

Current wording

Technological changes in the way insurance transactions are completed in the marketplace, and our ability to react effectively to such change, may present significant competitive risks. For example, more insurers are utilizing or may begin utilizing "big data" analytics or artificial intelligence to make underwriting or other decisions that impact product design and pricing. If such utilization is more effective than how we use our data and information, we will be at a competitive disadvantage. There can be no assurance that we will continue to compete effectively with our industry peers due to technological changes; accordingly, this may have a material adverse effect on our business, results of operations and financial condition.

Previous wording

In addition, agents and brokers, technology companies, or other third parties may create alternate distribution channels for commercial business that may adversely impact product differentiation and pricing. For example, they may create a digitally enabled distribution channel that may adversely impact our competitive position. Our efforts or the efforts of agents and brokers with respect to new products or alternate distribution channels, as well as changes in the way agents and brokers utilize greater levels of data and technology, could adversely impact our business relationship with independent agents and brokers who currently market our products, resulting in a lower volume and/or profitability of business generated from these sources.

Current wording

In addition, agents and brokers, technology companies, or other third parties may create alternate distribution channels for commercial business that may adversely impact product differentiation and pricing. For example, they may create a digitally enabled distribution channel that may adversely impact our competitive position. Our efforts or the efforts of agents and brokers with respect to new products or alternate distribution channels, as well as changes in the way agents and brokers utilize greater levels of data and technology, including artificial intelligence, could adversely impact our business relationship with independent agents and brokers who currently market our products, resulting in a lower volume and/or profitability of business generated from these sources.

Previous wording

Loews beneficially owned approximately 92% of our outstanding shares of common stock as of December 31, 2023, and is in a position to control actions that require the consent of stockholders, including the election of directors, amendment of our Restated Certificate of Incorporation and any merger or sale of substantially all of our assets. In addition, four officers of Loews, along with the Co-Chairman of the Board of Loews, serve on our Board of Directors. We have also entered into services agreements and a registration rights agreement with Loews, and we may in the future enter into other agreements with Loews. It is possible that potential conflicts of interest could arise in the future for our directors who are also officers and/or directors of Loews with respect to a number of areas relating to the past and ongoing relationships of Loews and us, including tax and insurance matters, financial commitments and sales of common stock pursuant to registration rights or otherwise.

Current wording

Loews beneficially owned approximately 92% of our outstanding shares of common stock as of December 31, 2024, and is in a position to control actions that require the consent of stockholders, including the election of directors, amendment of our Restated Certificate of Incorporation and any merger or sale of substantially all of our assets. In addition, and as of January 1, 2025 three officers of Loews, including the CEO of Loews (who is also a director of Loews), along with one additional director of Loews (who is also the Chairman of the Board of Loews) and one director emeritus of Loews, serve on our Board of Directors. We have also entered into services agreements and a registration rights agreement with Loews, and we may in the future enter into other agreements with Loews. It is possible that potential conflicts of interest could arise in the future for our directors who are also officers and/or directors of Loews with respect to a number of areas relating to the past and ongoing relationships of Loews and us, including tax and insurance matters, financial commitments and sales of common stock pursuant to registration rights or otherwise.

Previous wording

Our investment portfolio is exposed to various risks, such as interest rate, credit spread, issuer default, equity prices and foreign currency, which are unpredictable. Financial markets are highly sensitive to changes in economic conditions, monetary policies, tax policies, interest rates, domestic and international geopolitical issues and many other factors. Changes in financial markets, including fluctuations in interest rates, credit, equity prices and foreign currency prices, and many other factors beyond our control can adversely affect the value of our investments, the realization of investment income and the rate at which we discount certain liabilities. Our investment portfolio is also subject to increased valuation uncertainties when investment markets are illiquid. The valuation of investments is more subjective when markets are illiquid, thereby increasing the risk that the estimated fair value (i.e., the carrying amount) of the portion of our investment portfolio that is carried at fair value in our financial statements is not reflective of the prices at which actual transactions could occur.

Current wording

Our investment portfolio is exposed to various risks, such as interest rate, credit spread, issuer default, equity prices and foreign currency, which are unpredictable. Financial markets are highly sensitive to changes in economic conditions, monetary policies, tax policies, interest rates, domestic and international geopolitical issues and many other factors. Any imposition of significant tariffs by the U.S., as well as any related retaliatory tariffs, may adversely impact the general economy and the financial markets, and adversely affect the valuation of our investments. Changes in financial markets, including fluctuations in interest rates, credit, equity prices and foreign currency prices, and many other factors beyond our control can adversely affect the value of our investments, the realization of investment income and the rate at which we discount certain liabilities. Our investment portfolio is also subject to increased valuation uncertainties when investment markets are illiquid. The valuation of investments is more subjective when markets are illiquid, thereby increasing the risk that the estimated fair value (i.e., the carrying amount) of the portion of our investment portfolio that is carried at fair value in our financial statements is not reflective of the prices at which actual transactions could occur.

Previous wording

Any significant interruption in the operation of our business functions, facilities and systems or our vendors' facilities and systems could result in a materially adverse effect on our operations.

Current wording

Any significant interruption in the operation of our business functions, facilities or systems or our vendors' facilities or systems could result in a materially adverse effect on our operations.

Previous wording

Our business is highly dependent upon our ability to perform, in an efficient and uninterrupted manner, through our employees or vendor relationships and using our and their facilities and systems, necessary business functions, such as internet support and 24-hour call centers, processing new and renewal business, providing customer service, processing and paying claims and other obligations and issuing financial statements.

Current wording

Our business is highly dependent upon our ability to perform, in an efficient and uninterrupted manner, through our employees or vendor relationships and using our and their facilities and systems, necessary business functions, such as providing internet support and 24-hour call centers, processing new and renewal business, providing customer service, processing and paying claims and other obligations and issuing financial statements.

Previous wording

Our, or our vendors', facilities and systems could become unavailable, inoperable, or otherwise impaired from a variety of causes, including natural events, such as hurricanes, tornadoes, windstorms, earthquakes, severe winter weather and fires, or other events, such as explosions, terrorist attacks, computer security breaches or cyber-attacks, riots, hazardous material releases, medical epidemics or pandemics, utility outages, interruptions of data processing and storage systems or unavailability of communications facilities. An interruption in our system availability occurred in March 2021 as a result of a cybersecurity attack we sustained. Please refer to the immediately following risk factor for further information regarding this incident. Likewise, we could experience a significant failure, interruption or corruption of one or more of our or our vendors' information technology, telecommunications, or other systems for various reasons, including significant failures or interruptions that might occur as existing systems are replaced or upgraded. The shut-down or unavailability of one or more of our or our vendors’ systems or facilities for these or any other reasons could significantly impair our ability to perform critical business functions in a timely basis.

Current wording

Our, or our vendors', facilities and systems could become unavailable, inoperable, or otherwise impaired from a variety of causes, including natural events, such as hurricanes, tornadoes, windstorms, earthquakes, severe winter weather and fires, or other events, such as explosions, terrorist attacks, computer security breaches or cyber-attacks, riots, hazardous material releases, medical epidemics or pandemics, utility outages, interruptions of data processing and storage systems or unavailability of communications facilities or systems. An interruption in our system availability occurred in March 2021 as a result of a cybersecurity attack we sustained. Please refer to the immediately following risk factor for further information regarding this incident. Likewise, we could experience a significant failure, interruption or corruption of one or more of our or our vendors' information technology, telecommunications, or other systems for various reasons, including significant failures or interruptions that might occur as existing systems are replaced or upgraded. The shut-down or unavailability of one or more of our or our vendors’ systems or facilities for these or any other reasons could significantly impair our ability to perform critical business functions in a timely basis.

Previous wording

The foregoing risks could expose us to monetary and reputational damages. Potential additional exposures relating to significant interruptions to our operations may include substantially increased compliance costs, as well as increased costs relating to investments in computer system and security-related upgrades, and such costs may not be recoverable under our relevant insurance coverage. We have made, and continue to make, investments to improve our security and infrastructure. Some of these investments are a direct result of the March 2021 cybersecurity attack, described in the immediately following risk factor, which are not recoverable under existing insurance coverage.

Current wording

The foregoing risks could expose us to monetary and reputational damages. Potential additional exposures relating to significant interruptions to our operations may include substantially increased compliance costs, as well as increased costs relating to investments in computer system and security-related upgrades, and such costs may not be recoverable under our relevant insurance coverage. We have made, and continue to make, investments to improve our security and infrastructure.

Previous wording

Any significant breach in our data security infrastructure or our vendors’ facilities and systems could disrupt business, cause financial losses and damage our reputation, and insurance coverage may not be available for claims related to a breach.

Current wording

Any significant breach in our data security infrastructure or our vendors’ facilities or systems could disrupt business, cause financial losses and damage our reputation, and insurance coverage may not be available for claims related to a breach.

Previous wording

A significant breach of our data security infrastructure may result from actions by our employees, vendors, third-party administrators, or unknown third parties or through cyber-attacks. The risk of a breach can exist whether software services are in our or third party administered data centers or are cloud-based software services. Breaches have occurred, and may occur again, in our systems and in the systems of our vendors and third-party administrators.

Current wording

A significant breach of our data security infrastructure may result from actions by our employees, vendors, third-party administrators, or unknown third parties or through cyber-attacks. The risk of a breach can exist whether software services are in our or third party administered data centers or are cloud-based software services. The sophistication of cybersecurity threats continues to escalate, and the measures we take to mitigate the risk of cyber incidents and to safeguard our systems and data may be insufficient. Further, the increasing use of artificial intelligence, both within our systems to achieve operational efficiencies and within threat actors’ attack strategies, may further expose our systems to the risk of cyber-attacks. Breaches have occurred, and may occur again, in our systems and in the systems of our vendors and third-party administrators, both current and former, in that past vendors and third-party administrators may still retain certain confidential and sensitive information in their systems. During the third quarter of 2024, we were notified of a data breach resulting from a ransomware attack that impacted a former vendor. This incident resulted in required breach notifications to our impacted long term care policyholders, with such notifications made by the subject vendor. In the same quarter, we were notified of a data breach resulting from a ransomware attack that impacted a current vendor. This incident resulted in required breach notifications to impacted individuals, which included insurance claimants and their representatives, with such notifications made by the subject vendor.

Previous wording

Such a breach could affect our data framework or cause a failure to protect the personal information of our customers, claimants or employees, or sensitive and confidential information regarding our business or policyholders and may result in operational impairments and financial losses, significant harm to our reputation and the loss of business with existing or potential customers. The breach of confidential information also could give rise to legal liability and regulatory action under data protection and privacy laws, as well as evolving regulation in this regard. During the second quarter of 2023, we were notified of a breach in the file transfer software, MOVEit Transfer, used by a vendor of one of our third-party administrators. This incident resulted in required breach notifications to the Company's long-term care policyholders, with such notifications made by the subject vendor. While we do not believe such notifications and resultant actions will have a material adverse effect on our business, this or similar incidents, or any other such breach of our or our vendors’ data security infrastructure could have a material adverse effect on our business, results of operations and financial condition.

Current wording

Breaches could affect our data framework or cause a failure to protect the personal information of our customers, claimants or employees, or sensitive and confidential information regarding our business or policyholders and may result in operational impairments and financial losses, significant harm to our reputation and the loss of business with existing or potential customers. The breach of confidential information also could give rise to legal liability and regulatory action under data protection and privacy laws, as well as evolving regulation in this regard. While we do not believe such breaches that have occurred and resultant actions will have a material adverse effect on our business, these or similar incidents, or any other such breach of our or our vendors’ data security infrastructure could have a material adverse effect on our business, results of operations and financial condition.

Previous wording

The risks relating to future breaches in our, or our vendors', data security infrastructure, including in connection with cyber incidents, could have a material adverse effect on our business, results of operations or financial condition or may result in operational impairments and financial losses, as well as significant harm to our reputation.

Current wording

The risks relating to future breaches in our, or our vendors', data security infrastructure or systems, including in connection with cyber incidents, could have a material adverse effect on our business, results of operations or financial condition or may result in significant operational impairments and financial losses, as well as significant harm to our reputation.

Previous wording

We may incur losses which arise from employees or third-party service providers engaging in intentional, negligent or inadvertent misconduct, fraud, errors and omissions, failure to comply with internal guidelines, including with respect to underwriting authority, or failure to comply with regulatory requirements. Our or our third-party service providers' controls may not be able to detect all possible circumstances of such noncompliant activity and the internal structures in place to prevent this activity may not be effective in all cases. Any losses relating to such non-compliant activity could adversely affect our business, results of operations and financial condition.

Current wording

We may incur losses which arise from employees or third-party service providers engaging in intentional, negligent or inadvertent misconduct, fraud, errors and omissions, failure to comply with internal guidelines, including with respect to underwriting authority, or failure to comply with regulatory requirements. Our or our third-party service providers' controls may not be able to detect all possible circumstances of such noncompliant activity and the internal structures in place to prevent this activity may not be effective in all cases. Any losses relating to such non-compliant activity could materially adversely affect our business, results of operations and financial condition.

Previous wording

In the event that one or more of our vendors suffers a bankruptcy, is sold to another entity, sustains a significant business interruption or otherwise becomes unable to continue to provide products or services at the requisite level, we may be adversely affected. We may suffer operational impairments and financial losses associated with transferring business to a new vendor, assisting a vendor with rectifying operational difficulties, failure by vendors to properly perform service functions or assuming previously outsourced operations ourselves. Our inability to provide for appropriate servicing if a vendor becomes unable to fulfill its contractual obligations to us, either through transitioning to another service provider temporarily or permanently or assuming servicing internally, may have a materially adverse effect on our business, results of operations and financial condition.

Current wording

In the event that one or more of our vendors suffers a bankruptcy, is sold to another entity, sustains a significant business interruption or otherwise becomes unable to continue to provide products or services at the requisite level, we may be adversely affected. We may suffer operational impairments and financial losses associated with failure by vendors to properly perform service functions, transferring business to a new vendor, assisting a vendor with rectifying operational difficulties or assuming previously outsourced operations ourselves. Our inability to provide for appropriate servicing if a vendor becomes unable to fulfill its contractual obligations to us, either through transitioning to another service provider temporarily or permanently or assuming servicing internally, may have a materially adverse effect on our business, results of operations and financial condition.

Previous wording

Insurance companies such as ours are subject to capital adequacy standards set by regulators to help identify companies that merit further regulatory attention. In the U.S., these standards apply specified risk factors to various asset, premium and reserve components of our legal entity statutory basis of accounting financial statements. Current rules, including those promulgated by insurance regulators and specialized markets, such as Lloyd's, require companies to maintain statutory capital and surplus at a specified minimum level determined using the applicable jurisdiction's regulatory capital adequacy formula. If we do not meet these minimum requirements, we may be restricted or prohibited from operating our business in the applicable jurisdictions and specialized markets. If we are required to record a material charge against earnings in connection with a change in estimated insurance reserves, or the occurrence of a catastrophic event or otherwise, or if we incur significant losses related to our investment portfolio, which severely deteriorates our capital position, we may violate these minimum capital adequacy requirements unless we are able to raise sufficient additional capital. We may be limited in our ability to raise significant amounts of capital on favorable terms or at all.

Current wording

Insurance companies such as ours are subject to capital adequacy standards set by regulators to help identify companies that merit further regulatory attention. In the U.S., these standards apply specified risk factors to various asset, premium and reserve components of our legal entity statutory basis of accounting financial statements. For IAIGs, such as CNA, the standards also seek to quantify risk across the insurance group in order to assess group capital. Current rules, including those promulgated by insurance regulators and specialized markets, such as Lloyd's, require companies to maintain statutory capital and surplus at a specified minimum level determined using the applicable jurisdiction's regulatory capital adequacy formula. If we do not meet these minimum requirements, we may be restricted or prohibited from operating our business in the applicable jurisdictions and specialized markets. If we are required to record a material charge against earnings in connection with a change in estimated insurance reserves, or the occurrence of a catastrophic event or otherwise, or if we incur significant losses related to our investment portfolio, which severely deteriorates our capital position, we may violate these minimum capital adequacy requirements unless we are able to raise sufficient additional capital. We may be limited in our ability to raise significant amounts of capital on favorable terms or at all.

Previous wording

Ratings are an important factor in establishing the competitive position of insurance companies. Our insurance company subsidiaries, as well as our public debt, are rated by rating agencies, including, A.M. Best Company (A.M. Best), Moody's Investors Service, Inc. (Moody's), Standard & Poor's (S&P) and Fitch Ratings, Inc. (Fitch). Ratings reflect the rating agency's opinions of an insurance company's or insurance holding company's financial strength, capital adequacy, enterprise risk management practices, operating performance, strategic position and ability to meet its obligations to policyholders and debt holders, and may also reflect opinions on other areas such as information security and climate risk, as well as ESG matters more broadly.

Current wording

Ratings are an important factor in establishing the competitive position of insurance companies. Our insurance company subsidiaries, as well as our public debt, are rated by rating agencies, including, A.M. Best Company (A.M. Best), Moody's Investors Service, Inc. (Moody's), Standard & Poor's (S&P) and Fitch Ratings, Inc. (Fitch). Ratings reflect the rating agency's opinions of an insurance company's or insurance holding company's financial strength, capital adequacy, enterprise risk management practices, operating performance, strategic position and ability to meet its obligations to policyholders and debt holders, and may also reflect opinions on other areas such as information security and climate risk.

Previous wording

These rules and regulations relate to, among other things, the standards of solvency (including risk-based capital measures), government-supported backstops for certain catastrophic events (including terrorism), investment restrictions, accounting and reporting methodology, establishment of reserves and potential assessments of funds to settle covered claims against impaired, insolvent or failed private or quasi-governmental insurers. In addition, rules and regulations have recently been introduced, or are being considered, in the areas of information security and ESG, which may also affect our business. We also are subject to numerous regulations governing the protection of personal and confidential information of our clients and employees, including medical records, credit card data and financial information. These laws and regulations, including regulations related to cybersecurity protocols (which continue to evolve in breadth, sophistication and maturity in response to an ever-evolving threat landscape), are increasing in complexity and number, change frequently, sometimes conflict, and could expose us to significant monetary damages, regulatory enforcement actions, fines and/or criminal prosecution in one or more jurisdictions. In response to climate change, regulators at the federal, state and international level also could impose new regulations requiring disclosure of underwriting or investment in certain industry sectors.

Current wording

These rules and regulations relate to, among other things, the standards of solvency (including risk-based capital measures), government-supported backstops for certain catastrophic events (including terrorism), investment restrictions, accounting and reporting methodology, establishment of reserves and potential assessments of funds to settle covered claims against impaired, insolvent or failed private or quasi-governmental insurers. In addition, rules and regulations are being introduced, or are being considered, in the areas of artificial intelligence, information security and climate change, which may also affect our business. We also are subject to numerous regulations governing the protection of personal and confidential information of our customers and employees, including medical records, credit card data and financial information. These laws and regulations, including regulations related to cybersecurity protocols (which continue to evolve in breadth, sophistication and maturity in response to an ever-evolving threat landscape), are increasing in complexity and number, change frequently, sometimes conflict, and could expose us to significant monetary damages, regulatory enforcement actions, fines and/or criminal prosecution in one or more jurisdictions. Regulators at the federal, state and international level have adopted or may adopt new regulations related to, among other matters, climate change and greenhouse emissions, and could impose new regulations requiring disclosure of underwriting or investment in certain industry sectors.

Previous wording

Regulatory powers also extend to premium rate regulations which require that rates not be excessive, inadequate or unfairly discriminatory. State jurisdictions ensure compliance with such regulations through market conduct exams, which may result in losses to the extent non-compliance is ascertained, either as a result of failure to document transactions properly or failure to comply with internal guidelines, or otherwise. The jurisdictions in which we do business may also require us to provide coverage to persons whom we would not otherwise consider eligible or restrict us from withdrawing from unprofitable lines of business or unprofitable market areas. Each jurisdiction dictates the types of insurance and the level of coverage that must be provided to such involuntary risks. Our share of these involuntary risks is mandatory and generally a function of our respective share of the voluntary market by line of insurance in each jurisdiction.

Current wording

Regulatory powers also extend to premium rate regulations which require that rates not be excessive, inadequate or unfairly discriminatory. State jurisdictions ensure compliance with such regulations through market conduct exams, which may result in losses to the extent non-compliance is ascertained, either as a result of failure to document transactions properly, failure to comply with internal guidelines or otherwise. The jurisdictions in which we do business may also require us to provide coverage to persons whom we would not otherwise consider eligible or restrict us from withdrawing from unprofitable lines of business or unprofitable market areas. Each jurisdiction dictates the types of insurance and the level of coverage that must be provided to such involuntary risks. Our share of these involuntary risks is mandatory and generally a function of our respective share of the voluntary market by line of insurance in each jurisdiction.