SouthState Corp

On February 9, 2024, the Company disclosed that it detected what was determined to be a cybersecurity incident on February 6, 2024 (the “Cyber Incident”). The Bank notified banking regulators and law enforcement and, based on its investigation and findings, notified individuals whose personal information may have been compromised in the Cyber Incident. Further, the Bank has taken other actions, such as offering credit monitoring services. While the Company is unable to estimate the total cost of any remediation that may be required, as of June 30, 2025, the Company had not incurred material costs as a result of the Cyber Incident.

On April 3, 2024, a putative class action lawsuit (the “Original Suit”) was filed against the Bank purportedly on behalf of a class consisting of those persons impacted by the Cyber Incident. While the Original Suit has been voluntarily dismissed, the same plaintiffs as well as additional plaintiffs initiated litigation that names the Bank as a defendant. These cases have been consolidated into one putative class action, which as of the date of this Quarterly Report on Form 10-Q, remains pending against the Bank in the Circuit Court for Polk County, Florida (the “Cyber Incident Suit”). For more information about the Original Suit and other litigations filed in connection with the Cyber Incident, please refer to Note 13 — Commitments and Contingent Liabilities, in the Notes to Consolidated Financial Statements included in Item 1 of Part I of this Quarterly Report on Form 10-Q.

Other than the Cyber Incident Suit (as defined in Note 13 — Commitments and Contingent Liabilities), as of June 30, 2025, and the date of this Quarterly Report on Form 10-Q, we believe that we are not party to, nor is any of our property the subject of, any pending material legal proceeding other than those that may occur in the ordinary course of our business.