CNA FINANCIAL CORP

Previous wording

Our business faces many risks and uncertainties. These risks and uncertainties could lead to events or circumstances that have a material adverse effect on our results of operations, equity, business and insurer financial strength and corporate debt ratings. We have described below material risks that we face. There may be additional risks that we do not yet know of or that we do not currently perceive to be material that may also affect our business. You should carefully consider and evaluate all of the information included in this report and any subsequent reports we may file with the SEC or make available to the public before investing in any securities we issue.

Current wording

Our business faces many risks and uncertainties. These risks and uncertainties could lead to events or circumstances that have a material adverse effect on our results of operations, equity, business, financial condition and insurer financial strength and corporate debt ratings. We have described below material risks that we face. There may be additional risks that we do not yet know of or that we do not currently perceive to be material that may also affect our business. You should carefully consider and evaluate all of the information included in this report and any subsequent reports we may file with the SEC or make available to the public before investing in any securities we issue.

Previous wording

We are subject to the uncertain effects of emerging and potential claims and coverage issues that arise as industry practices and legal, judicial, geopolitical, social, economic and other environmental conditions change. Further, the impact of social inflation continues to be significant and the trajectory of its future impact remains uncertain. Any imposition of significant tariffs by the U.S., as well as any related retaliatory tariffs, may result in considerable increases in certain costs that would increase the cost of claims. In addition, passage of reviver statutes that extend, or eliminate, the statute of limitations for the reporting of claims, including statutes passed in certain states with respect to sexual molestation and sexual abuse, increase the uncertainty of the frequency of claims, and the impact of social inflation has, and may continue to, increase the severity of these claims. These issues, have had, and may continue to have, a negative effect on our business, results of operations and financial condition by either extending coverage beyond the original underwriting intent or by increasing the number or size of claims, resulting in further increases in our reserves. The effects of unforeseen emerging or potential claim and coverage issues are extremely difficult to predict and may be material.

Current wording

We are subject to the uncertain effects of emerging and potential claims and coverage issues that arise as industry practices and legal, judicial, social, economic, geopolitical and other environmental conditions change. The impact of social inflation continues to be significant, and the trajectory of its future impact remains uncertain. In addition, passage of reviver statutes that extend, or eliminate, the statute of limitations for the reporting of claims, including statutes passed in certain states with respect to sexual molestation and sexual abuse, increase the uncertainty of the frequency of claims, and the impact of social inflation has, and may continue to, increase the severity of these claims. Further, broader economic and geopolitical conditions, including the imposition of significant tariffs by the U.S., as well as any related retaliatory tariffs, may result in considerable increases in certain costs that would increase loss costs. These issues have had, and may continue to have, a negative effect on our business, results of operations and financial condition by either extending coverage beyond the original underwriting intent or by increasing the number or size of claims, resulting in further increases in our reserves. The effects of unforeseen emerging or potential claim and coverage issues are extremely difficult to predict and may be material.

Previous wording

Our future policy benefit reserves for long-term care policies are based on our best estimate actuarial assumptions, which are assessed quarterly and updated at least annually. Key actuarial assumptions include morbidity, persistency, anticipated future premium rate increases and expenses. The adequacy of the reserves is contingent upon actual experience and our future expectations related to these key assumptions. If actual or expected future experience differs from these assumptions, the reserves may not be adequate, requiring us to increase reserves. The required increase in reserves is recorded as a charge against our earnings in the period in which reserves are determined to be insufficient. These charges have been and in the future could be substantial. The reserves are discounted using upper-medium grade fixed income instrument yields as of each reporting date. Discount rates are subject to interest rate and market volatility. See the Life & Group Policyholder Reserves portion of Reserves - Estimates and Uncertainties section of MD&A in Item 7 for more information.

Current wording

Our future policy benefit reserves for long-term care policies are based on our best estimate actuarial assumptions, which are assessed quarterly and updated at least annually. Key actuarial assumptions include morbidity, persistency, premium rate actions and expenses. The adequacy of the reserves is contingent upon actual experience and our future expectations related to these key assumptions. If actual or expected future experience differs from these assumptions, the reserves may not be adequate, requiring us to increase reserves. The required increase in reserves is recorded as a charge against our earnings in the period in which reserves are determined to be insufficient. These charges have been and in the future could be substantial. The reserves are discounted using upper-medium grade fixed income instrument yields as of each reporting date. Discount rates are subject to interest rate and market volatility. See the Life & Group Policyholder Reserves portion of Reserves - Estimates and Uncertainties section of MD&A in Item 7 for more information.

Previous wording

A prolonged period during which investment returns remain at low levels could result in shortfalls in investment income on assets supporting our obligations under long-term care policies. This risk may be more significant for our long-term care products when the long potential duration of the policy obligations exceeds the duration of the supporting investment assets. In addition, we may not receive regulatory approval for the level of premium rate increases we request. Any adverse deviation between the level of future premium rate increases approved and the level included in our reserving assumptions may require an increase to our reserves.

Current wording

A prolonged period during which investment returns remain at low levels could result in shortfalls in investment income on assets supporting our obligations under long-term care policies. This risk may be more significant for our long-term care products when the long potential duration of the policy obligations exceeds the duration of the supporting investment assets. In addition, we may not receive regulatory approval for the level of premium rate increases we request. Any adverse deviation between the level of premium rate actions approved and the level included in our reserving assumptions may require an increase to our reserves. Further, and as noted in the previous risk factor, the increasingly adverse impact of social inflation, particularly with respect to legal activity and judicial decisions, may impact our long-term care portfolio and reserves.

Previous wording

Catastrophe losses are an inevitable part of our business. Various events can cause catastrophe losses. These events can be natural or man-made, and may include hurricanes, tornadoes, windstorms, earthquakes, hail, severe winter weather, droughts, fires, floods, riots, strikes, civil unrest, cyber-attacks, pandemics and acts of terrorism. The frequency and severity of these catastrophe events are inherently unpredictable. Exposure to cyber risk is increasing systematically due to greater digital dependence, which increases the potential for, and the potential losses due to, a catastrophic cyber event. Catastrophic cyber-attack scenarios are not bound by time or geographic limitations and cyber-related catastrophic perils don’t have well-established definitions or fundamental physical properties. In addition, longer-term natural catastrophe trends may be changing and new types of catastrophe losses may be developing due to climate change, its associated extreme weather events linked to rising temperatures and its effects on global weather patterns, greenhouse gases, sea, land and air temperatures, sea levels, rain, drought, hail and snow. Climate studies by government agencies, academic institutions, catastrophe modeling organizations and other groups indicate that climate change may be altering the frequency and/or severity of catastrophic weather events, such as hurricanes, tornadoes, windstorms, earthquakes, hail, severe winter weather, droughts, fires and floods.

Current wording

Catastrophe losses are an inevitable part of our business. Various events can cause catastrophe losses. These events can be natural or man-made, and may include hurricanes, tornadoes, windstorms, earthquakes, hail, severe winter weather, droughts, fires, floods, riots, strikes, civil unrest, cyber-attacks, pandemics and acts of terrorism. The frequency and severity of these catastrophe events are inherently unpredictable. Exposure to cyber risk is increasing systematically due to greater digital dependence, which increases the potential for, and the potential losses due to, a catastrophic cyber event. Catastrophic cyber-attack scenarios are not bound by time or geographic limitations and cyber-related catastrophic perils don’t have well-established definitions or fundamental physical properties. In addition, longer-term natural catastrophe trends may be changing and new types of, and heightened, catastrophe losses may be developing due to climate change, its associated extreme weather events linked to rising temperatures and its effects on global weather patterns, greenhouse gases, sea, land and air temperatures, sea levels, rain, drought, hail and snow. Climate studies by government agencies, academic institutions, catastrophe modeling organizations and other groups indicate that climate change may be altering the frequency and/or severity of catastrophic weather events, such as hurricanes, tornadoes, windstorms, earthquakes, hail, severe winter weather, droughts, fires and floods.

Previous wording

The extent of our losses from catastrophes is a function of the total amount of our insured exposures in the affected areas, the frequency and severity of the events themselves, the level of our reinsurance coverage, reinsurance reinstatement premiums and state residual market assessments, if any. It can take a long time for the ultimate cost of any catastrophe losses to us to be finally determined, as a multitude of factors contribute to such costs, including evaluation of general liability and pollution exposures, infrastructure disruption, business interruption and reinsurance collectibility. Further, significant catastrophic events or a series of catastrophic events have the potential to impose financial stress on the reinsurance industry, which could impact our ability to collect amounts owed to us by reinsurers, thereby resulting in higher net incurred losses.

Current wording

The extent of our losses from catastrophes is a function of the total amount of our insured exposures in the affected areas, the frequency and severity of the events themselves, the level of our reinsurance coverage, reinsurance reinstatement premiums and state residual market assessments, if any. It can take a long time for the ultimate cost of any catastrophe losses to us to be finally determined, as a multitude of factors contribute to such costs, including evaluation of general liability and pollution exposures, infrastructure disruption, business interruption and reinsurance collectability. Further, significant catastrophic events or a series of catastrophic events have the potential to impose financial stress on the reinsurance industry, which could impact our ability to collect amounts owed to us by reinsurers, thereby resulting in higher net incurred losses.

Previous wording

Our property and casualty insurance subsidiaries have exposures related to A&EP claims. Our experience has been that establishing claim and claim adjustment expense reserves for casualty coverages relating to A&EP claims is subject to uncertainties that are greater than those presented by more traditional property and casualty claims. Additionally, traditional actuarial methods and techniques employed to estimate the ultimate cost of claims for more traditional property and casualty exposures are less precise in estimating claim and claim adjustment expense reserves for A&EP. As a result, estimating the ultimate cost of both reported and unreported A&EP claims is subject to a higher degree of variability. On August 31, 2010, we completed a retroactive reinsurance transaction under which substantially all of our legacy A&EP liabilities were ceded to National Indemnity Company (NICO), a subsidiary of Berkshire Hathaway Inc., subject to an aggregate limit of $4 billion (Loss Portfolio Transfer). The cumulative amount ceded under the Loss Portfolio Transfer as of December 31, 2024 was $3.7 billion. If the other parties to the Loss Portfolio Transfer do not fully perform their obligations, net losses incurred on A&EP claims covered by the Loss Portfolio Transfer exceed the aggregate limit of $4 billion, or we determine we have exposures to A&EP claims not covered by the Loss Portfolio Transfer, we may need to increase our recorded net reserves which would result in a charge against our earnings. These charges could be substantial. Additionally, if the A&EP claims exceed the limit of the Loss Portfolio Transfer, we will need to assess whether to purchase additional limit or to reassume claim handling responsibility for A&EP claims from an affiliate of NICO. Any additional reinsurance premium or future claim handling costs would also reduce our earnings.

Current wording

Our property and casualty insurance subsidiaries have exposures related to A&EP claims. Our experience has been that establishing claim and claim adjustment expense reserves for casualty coverages relating to A&EP claims is subject to uncertainties that are greater than those presented by more traditional property and casualty claims. Additionally, traditional actuarial methods and techniques employed to estimate the ultimate cost of claims for more traditional property and casualty exposures are less precise in estimating claim and claim adjustment expense reserves for A&EP. As a result, estimating the ultimate cost of both reported and unreported A&EP claims is subject to a higher degree of variability. On August 31, 2010, we completed a retroactive reinsurance transaction under which substantially all of our legacy A&EP liabilities were ceded to National Indemnity Company (NICO), a subsidiary of Berkshire Hathaway Inc., subject to an aggregate limit of $4 billion (Loss Portfolio Transfer). The cumulative amount ceded under the Loss Portfolio Transfer as of December 31, 2025 was $3.9 billion. If the other parties to the Loss Portfolio Transfer do not fully perform their obligations, net losses incurred on A&EP claims covered by the Loss Portfolio Transfer exceed the aggregate limit of $4 billion, or we determine we have exposures to A&EP claims not covered by the Loss Portfolio Transfer, we may need to increase our recorded net reserves which would result in a charge against our earnings. These charges could be substantial. Additionally, if the A&EP claims exceed the limit of the Loss Portfolio Transfer, we will need to assess whether to purchase additional limit or to reassume claim handling responsibility for A&EP claims from an affiliate of NICO. Any additional reinsurance premium or future claim handling costs would also reduce our earnings.

Previous wording

We are exposed to, and may face adverse developments related to, mass tort claims that could arise from, among other things, our insureds’ sale or use of potentially harmful products or substances, changes to the social and legal environment, such as those related to abuse reviver statutes, issues related to altered interpretation of coverage and other new and emerging claim theories.

Current wording

We are exposed to, and may face adverse developments related to, mass tort claims that could arise from, among other things, our insureds’ sale or use of potentially harmful products or substances, claims of sexual abuse and molestation against our insureds and changes to the social and legal environment, such as those related to abuse reviver statutes, issues related to altered interpretation of coverage and other new and emerging claim theories.

Previous wording

We face potential exposure to various types of existing, new and emerging mass tort claims, including those related to exposure to potentially harmful products or substances, such as glyphosate, lead paint, per- and polyfluoroalkyl substances (PFAS) and opioids, sexual abuse and molestation claims, claims arising from changes that expand the right to sue, remove limitations on recovery, extend the statutes of limitations or otherwise repeal or weaken tort reforms, such as those related to abuse reviver statutes, including New York reviver statutes; and claims related to new and emerging theories of liability, such as those related to global warming and climate change. Evolving judicial interpretations and new legislation regarding the application of various tort theories and defenses, including application of various theories of joint and several liability, as well as the application of insurance coverage to these claims, give rise to new and potentially more severe claim activity. For example, we have recorded, and may continue to record, increases in our mass tort reserves, driven substantially by abuse reviver statutes that have resulted in increased claims. Similar and continuing mass tort claim activity, including activity based on changing judicial interpretations and recent and proposed legislation, could have a material adverse effect on our business, results of operations and financial condition.

Current wording

We face potential exposure to various types of existing, new and emerging mass tort claims, including those related to exposure to potentially harmful products or substances, such as glyphosate, lead paint, per- and polyfluoroalkyl substances (PFAS) and opioids, sexual abuse and molestation claims, claims arising from changes that expand the right to sue, remove limitations on recovery, extend the statutes of limitations or otherwise repeal or weaken tort reforms, such as those related to abuse reviver statutes; and claims related to new and emerging theories of liability, such as those related to global warming and climate change. Evolving judicial interpretations, increased participation by plaintiff's lawyers in insurance claims, rising litigation activity, higher monetary verdicts, abusive litigation practices, the growth of third-party litigation financing and new legislation regarding the application of various tort theories and defenses, including application of various theories of joint and several liability, as well as the application of insurance coverage to these claims, give rise to new and potentially more severe claim activity. For example, we have recorded, and may continue to record, increases in our mass tort reserves, driven substantially by abuse reviver statutes that have resulted in increased claims. Similar and continuing mass tort claim activity, including activity based on changing judicial interpretations and recent and proposed legislation, could have a material adverse effect on our business, results of operations and financial condition.

Previous wording

Technological changes in the way insurance transactions are completed in the marketplace, and our ability to react effectively to such change, may present significant competitive risks. For example, more insurers are utilizing or may begin utilizing "big data" analytics or artificial intelligence to make underwriting or other decisions that impact product design and pricing. If such utilization is more effective than how we use our data and information, we will be at a competitive disadvantage. There can be no assurance that we will continue to compete effectively with our industry peers due to technological changes; accordingly, this may have a material adverse effect on our business, results of operations and financial condition.

Current wording

Technological changes in the way insurance transactions are completed in the marketplace, and our ability to react effectively to such change, may present significant competitive risks. For example, more insurers are utilizing or may begin utilizing "big data" analytics or artificial intelligence (AI) to make underwriting or other decisions that impact product design and pricing. If such utilization by our industry peers is more effective than how we use our data and information, including through our own use of AI, we will be at a competitive disadvantage. There can be no assurance that we will continue to compete effectively with our industry peers due to technological changes; accordingly, this may have a material adverse effect on our business, results of operations and financial condition.

Previous wording

In addition, agents and brokers, technology companies, or other third parties may create alternate distribution channels for commercial business that may adversely impact product differentiation and pricing. For example, they may create a digitally enabled distribution channel that may adversely impact our competitive position. Our efforts or the efforts of agents and brokers with respect to new products or alternate distribution channels, as well as changes in the way agents and brokers utilize greater levels of data and technology, including artificial intelligence, could adversely impact our business relationship with independent agents and brokers who currently market our products, resulting in a lower volume and/or profitability of business generated from these sources.

Current wording

In addition, agents and brokers, technology companies, or other third parties may create alternate distribution channels for commercial business that may adversely impact product differentiation and pricing. For example, they may create a digitally enabled distribution channel that may adversely impact our competitive position. Our efforts or the efforts of agents and brokers with respect to new products or alternate distribution channels, as well as changes in the way agents and brokers utilize greater levels of data and technology, including AI, could adversely impact our business relationship with independent agents and brokers who currently market our products, resulting in a lower volume and/or profitability of business generated from these sources.

Previous wording

Loews beneficially owned approximately 92% of our outstanding shares of common stock as of December 31, 2024, and is in a position to control actions that require the consent of stockholders, including the election of directors, amendment of our Restated Certificate of Incorporation and any merger or sale of substantially all of our assets. In addition, and as of January 1, 2025 three officers of Loews, including the CEO of Loews (who is also a director of Loews), along with one additional director of Loews (who is also the Chairman of the Board of Loews) and one director emeritus of Loews, serve on our Board of Directors. We have also entered into services agreements and a registration rights agreement with Loews, and we may in the future enter into other agreements with Loews. It is possible that potential conflicts of interest could arise in the future for our directors who are also officers and/or directors of Loews with respect to a number of areas relating to the past and ongoing relationships of Loews and us, including tax and insurance matters, financial commitments and sales of common stock pursuant to registration rights or otherwise.

Current wording

Loews beneficially owned approximately 92% of our outstanding shares of common stock as of December 31, 2025, and is in a position to control actions that require the consent of stockholders, including the election of directors, amendment of our Restated Certificate of Incorporation and any merger or sale of substantially all of our assets. In addition, as of January 1, 2026 three officers of Loews, including the CEO of Loews (who is also a director of Loews), along with one additional director of Loews (who is also the Chairman of the Board of Loews) and one director emeritus of Loews, serve on our Board of Directors. We have also entered into services agreements and a registration rights agreement with Loews, and we may in the future enter into other agreements with Loews. It is possible that potential conflicts of interest could arise in the future for our directors who are also officers and/or directors of Loews with respect to a number of areas relating to the past and ongoing relationships of Loews and us, including tax and insurance matters, financial commitments and sales of common stock pursuant to registration rights or otherwise.

Previous wording

Our investment portfolio is exposed to various risks, such as interest rate, credit spread, issuer default, equity prices and foreign currency, which are unpredictable. Financial markets are highly sensitive to changes in economic conditions, monetary policies, tax policies, interest rates, domestic and international geopolitical issues and many other factors. Any imposition of significant tariffs by the U.S., as well as any related retaliatory tariffs, may adversely impact the general economy and the financial markets, and adversely affect the valuation of our investments. Changes in financial markets, including fluctuations in interest rates, credit, equity prices and foreign currency prices, and many other factors beyond our control can adversely affect the value of our investments, the realization of investment income and the rate at which we discount certain liabilities. Our investment portfolio is also subject to increased valuation uncertainties when investment markets are illiquid. The valuation of investments is more subjective when markets are illiquid, thereby increasing the risk that the estimated fair value (i.e., the carrying amount) of the portion of our investment portfolio that is carried at fair value in our financial statements is not reflective of the prices at which actual transactions could occur.

Current wording

Our investment portfolio is exposed to various risks, such as interest rate, credit spread, issuer default, equity prices and foreign currency, which are unpredictable. Financial markets are highly sensitive to changes in economic conditions, monetary policies, tariff policies, tax policies, interest rates, domestic and international geopolitical issues and many other factors. Changes in financial markets, including fluctuations in interest rates, credit, equity prices and foreign currency prices, and many other factors beyond our control can adversely affect the value of our investments, the realization of investment income and the rate at which we discount certain liabilities. Our investment portfolio is also subject to increased valuation uncertainties when investment markets are illiquid. The valuation of investments is more subjective when markets are illiquid, thereby increasing the risk that the estimated fair value (i.e., the carrying amount) of the portion of our investment portfolio that is carried at fair value in our financial statements is not reflective of the prices at which actual transactions could occur.

Previous wording

Our, or our vendors', facilities and systems could become unavailable, inoperable, or otherwise impaired from a variety of causes, including natural events, such as hurricanes, tornadoes, windstorms, earthquakes, severe winter weather and fires, or other events, such as explosions, terrorist attacks, computer security breaches or cyber-attacks, riots, hazardous material releases, medical epidemics or pandemics, utility outages, interruptions of data processing and storage systems or unavailability of communications facilities or systems. An interruption in our system availability occurred in March 2021 as a result of a cybersecurity attack we sustained. Please refer to the immediately following risk factor for further information regarding this incident. Likewise, we could experience a significant failure, interruption or corruption of one or more of our or our vendors' information technology, telecommunications, or other systems for various reasons, including significant failures or interruptions that might occur as existing systems are replaced or upgraded. The shut-down or unavailability of one or more of our or our vendors’ systems or facilities for these or any other reasons could significantly impair our ability to perform critical business functions in a timely basis.

Current wording

Our, or our vendors', facilities and systems could become unavailable, inoperable, or otherwise impaired from a variety of causes, including natural events, such as hurricanes, tornadoes, windstorms, earthquakes, severe winter weather and fires, or other events, such as explosions, terrorist attacks, computer security breaches or cyber-attacks, riots, hazardous material releases, medical epidemics or pandemics, utility outages, interruptions of data processing and storage systems or unavailability of communications facilities or systems. Likewise, we could experience a significant failure, interruption or corruption of one or more of our or our vendors' information technology, telecommunications, or other systems for various reasons, including significant failures or interruptions that might occur as existing systems are replaced or upgraded. The shut-down or unavailability of one or more of our or our vendors’ systems or facilities for these or any other reasons could significantly impair our ability to perform critical business functions on a timely basis.

Previous wording

In addition, because our and our vendors' information technology and telecommunications systems interface with and depend on third-party systems, we could experience service denials if demand for such service exceeds capacity or a third-party system fails or experiences an interruption. If sustained or repeated, such events could result in a deterioration of our ability to perform necessary business functions.

Current wording

In addition, because our and our vendors' information technology, telecommunications and other systems interface with and depend on third-party systems, we could experience service denials if demand for such service exceeds capacity or a third-party system fails or experiences an interruption. If sustained or repeated, such events could result in a deterioration of our ability to perform necessary business functions.

Previous wording

A significant breach of our data security infrastructure may result from actions by our employees, vendors, third-party administrators, or unknown third parties or through cyber-attacks. The risk of a breach can exist whether software services are in our or third party administered data centers or are cloud-based software services. The sophistication of cybersecurity threats continues to escalate, and the measures we take to mitigate the risk of cyber incidents and to safeguard our systems and data may be insufficient. Further, the increasing use of artificial intelligence, both within our systems to achieve operational efficiencies and within threat actors’ attack strategies, may further expose our systems to the risk of cyber-attacks. Breaches have occurred, and may occur again, in our systems and in the systems of our vendors and third-party administrators, both current and former, in that past vendors and third-party administrators may still retain certain confidential and sensitive information in their systems. During the third quarter of 2024, we were notified of a data breach resulting from a ransomware attack that impacted a former vendor. This incident resulted in required breach notifications to our impacted long term care policyholders, with such notifications made by the subject vendor. In the same quarter, we were notified of a data breach resulting from a ransomware attack that impacted a current vendor. This incident resulted in required breach notifications to impacted individuals, which included insurance claimants and their representatives, with such notifications made by the subject vendor.

Current wording

A significant breach of our data security infrastructure may result from actions by our employees, vendors, third-party administrators, or unknown third parties or through cyber-attacks. The risk of a breach can exist whether software services are in our or third party administered data centers or are cloud-based software services. The sophistication of cybersecurity threats continues to escalate, and the measures we take to mitigate the risk of cyber incidents and to safeguard our systems and data may be insufficient. Further, the increasing use of AI within our systems and those of our vendors and third-party administrators to achieve operational efficiencies and within threat actors’ attack strategies, may further expose our systems or those of our vendors and third-party administrators to the risk of cyber-attacks. Breaches have occurred, and may occur again, in our systems and in the systems of our vendors and third-party administrators, both current and former, in that past vendors and third-party administrators may still retain certain confidential and sensitive information in their systems. During the fourth quarter of 2025, we were notified of a data breach impacting a vendor of a business associate of our current employee health insurance administrator. The breach was traced to compromised credentials leveraged by a threat actor, with the impacted vendor shutting down and rebuilding the affected environment upon discovery of the breach. Following a forensics analysis, it was determined that a substantial number of our employees (and dependents of employees) were impacted. We understand that the subject vendor will be providing required breach notifications to all impacted individuals.

Previous wording

Breaches could affect our data framework or cause a failure to protect the personal information of our customers, claimants or employees, or sensitive and confidential information regarding our business or policyholders and may result in operational impairments and financial losses, significant harm to our reputation and the loss of business with existing or potential customers. The breach of confidential information also could give rise to legal liability and regulatory action under data protection and privacy laws, as well as evolving regulation in this regard. While we do not believe such breaches that have occurred and resultant actions will have a material adverse effect on our business, these or similar incidents, or any other such breach of our or our vendors’ data security infrastructure could have a material adverse effect on our business, results of operations and financial condition.

Current wording

Breaches that affect our data security infrastructure or our vendors' facilities or systems, may cause a failure to protect the personal information of our customers, claimants or employees, or sensitive and confidential information regarding our business or policyholders and may result in operational impairments and financial losses, significant harm to our reputation and the loss of business with existing or potential customers. The breach of confidential information also could give rise to legal liability and regulatory action under data protection and privacy laws, as well as evolving regulation in this regard. While we do not believe breaches that have occurred and resultant actions will have a material adverse effect on our business, these or similar incidents, or any other breach of our or our vendors’ data security infrastructure could have a material adverse effect on our business, results of operations and financial condition.

Previous wording

Although we maintain cybersecurity insurance coverage insuring against costs resulting from cyber-attacks (including the March 2021 attack), we do not expect the amount available under our coverage policy to cover all losses from cyber-attacks. In addition, potential disputes with our insurers about the availability of insurance coverage could occur. Further, should we experience future cyber incidents, or should industry trends drive rate increases resulting from growth in volume and significance of cyber incidents broadly, we may incur higher costs for cybersecurity insurance coverage.

Current wording

Although we maintain cybersecurity insurance coverage insuring against costs resulting from cyber-attacks, we do not expect the amount available under our coverage policy to cover all potential losses from cyber-attacks. In addition, potential disputes with our insurers about the availability of insurance coverage could occur.

Previous wording

We may incur losses which arise from employees or third-party service providers engaging in intentional, negligent or inadvertent misconduct, fraud, errors and omissions, failure to comply with internal guidelines, including with respect to underwriting authority, or failure to comply with regulatory requirements. Our or our third-party service providers' controls may not be able to detect all possible circumstances of such noncompliant activity and the internal structures in place to prevent this activity may not be effective in all cases. Any losses relating to such non-compliant activity could materially adversely affect our business, results of operations and financial condition.

Current wording

We may incur losses which arise from employees or third-party service providers engaging in intentional, negligent or inadvertent misconduct, fraud, errors and omissions, failure to comply with internal guidelines, including with respect to underwriting authority, or failure to comply with regulatory requirements. Our or our third-party service providers' controls may not be able to detect all possible circumstances of such noncompliant activity and the internal structures in place to prevent this activity may not be effective in all cases. When new technologies, such as AI, are incorporated into our or our third-party service providers' processes, they may introduce additional complexity and present greater risk to the effectiveness of these controls. For example, generative AI systems may "hallucinate" producing inaccurate or misleading information, and model performance may degrade over time, leading to flawed recommendations. AI models may perpetuate or amplify biases present in underlying data, which could result in discriminatory or unfair outcomes in areas such as underwriting and claims. The potential for employees or third-party service providers, through intentional or inadvertent actions, to enable AI models to be trained on our data or our insureds' data introduces risks of unauthorized use or disclosure of sensitive information and erosion of data privacy. AI may also be used to perpetuate fraud, or to manipulate or evade monitoring and detection controls.

Previous wording

These rules and regulations relate to, among other things, the standards of solvency (including risk-based capital measures), government-supported backstops for certain catastrophic events (including terrorism), investment restrictions, accounting and reporting methodology, establishment of reserves and potential assessments of funds to settle covered claims against impaired, insolvent or failed private or quasi-governmental insurers. In addition, rules and regulations are being introduced, or are being considered, in the areas of artificial intelligence, information security and climate change, which may also affect our business. We also are subject to numerous regulations governing the protection of personal and confidential information of our customers and employees, including medical records, credit card data and financial information. These laws and regulations, including regulations related to cybersecurity protocols (which continue to evolve in breadth, sophistication and maturity in response to an ever-evolving threat landscape), are increasing in complexity and number, change frequently, sometimes conflict, and could expose us to significant monetary damages, regulatory enforcement actions, fines and/or criminal prosecution in one or more jurisdictions. Regulators at the federal, state and international level have adopted or may adopt new regulations related to, among other matters, climate change and greenhouse emissions, and could impose new regulations requiring disclosure of underwriting or investment in certain industry sectors.

Current wording

These rules and regulations relate to, among other things, the standards of solvency (including risk-based capital measures), government-supported backstops for certain catastrophic events (including terrorism), investment restrictions, accounting and reporting methodology, establishment of reserves and potential assessments of funds to settle covered claims against impaired, insolvent or failed private or quasi-governmental insurers. In addition, rules and regulations are being introduced, or are being considered, in the areas of AI, information security and climate change, which may also affect our business. We also are subject to numerous regulations governing the protection of personal and confidential information of our customers and employees, including medical records, credit card data and financial information. These laws and regulations, including regulations related to cybersecurity protocols (which continue to evolve in breadth, sophistication and maturity in response to an ever-evolving threat landscape), are increasing in complexity and number, change frequently, sometimes conflict, and could expose us to significant monetary damages, regulatory enforcement actions, fines and/or criminal prosecution in one or more jurisdictions. Regulators at the federal, state and international level have adopted or may adopt new regulations related to, among other matters, climate change and greenhouse emissions, and could impose new regulations requiring disclosure of underwriting or investment in certain industry sectors.