SouthState Corp

On February 9, 2024, the Company disclosed that it detected what was determined to be a cybersecurity incident on February 6, 2024 (the “Cyber Incident”). The Bank notified banking regulators and law enforcement and, based on its investigation and findings, notified individuals whose personal information may have been compromised in the Cyber Incident. Further, the Bank has taken other actions, such as offering credit monitoring services. While the Company is unable to estimate the total cost of any remediation that may be required, as of June 30, 2024, the Company has not incurred material litigation costs as a result of the Cyber Incident.

On April 3, 2024, a putative class action lawsuit (the “Original Suit”) was filed against the Bank purportedly on behalf of a class consisting of those persons impacted by the Cyber Incident. While the Original Suit was voluntarily dismissed, as of the date of this Quarterly Report on Form 10-Q, three putative class action lawsuits are pending. For more information about the Original Suit and other litigations filed in connection with the Cyber Incident, please refer to Note 13 — Commitments and Contingent Liabilities, in the Notes to Condensed Consolidated Financial Statements included in Item 1 of Part I of this Quarterly Report on Form 10-Q.

Other than the Cyber Incident Suits (as defined in Note 13 — Commitments and Contingent Liabilities), as of June 30, 2024, and the date of this Quarterly Report on Form 10-Q, we believe that we are not party to, nor is any of our property the subject of, any pending material legal proceeding other than those that may occur in the ordinary course of our business.