NORWOOD FINANCIAL CORP

.

On February 20, 2024, the Company was notified of a Complaint (the “Complaint”) entitled Ian Werkmeister vs. Wayne Bank, filed on February 12, 2024 in the United States District Court for the Middle District of Pennsylvania seeking class action status. The Plaintiff is seeking monetary recovery and other relief on behalf of themselves and one or more putative classes of other individuals similarly situated. The Complaint arises out of a widely reported data security incident involving MOVEit, a file sharing software used globally by government agencies, enterprise corporations, and financial institutions. In October of 2023, Wayne Bank was notified by its third-party information service provider of a cyber-incident that involved unauthorized access to Wayne Bank customer information in one of the vendor’s file transfer applications. The incident involved vulnerabilities discovered in MOVEit Transfer, a file transfer software used by the Bank’s vendor to support services provided by the vendor to Wayne Bank and its related institutions. MOVEit is a commonly used secure Managed File Transfer software, which supports file transfer activities used by thousands of organizations around the world, including government agencies and major financial firms. The vulnerability discovered in MOVEit did not involve any of Wayne Bank’s internal systems and did not impact the Bank’s ability to service its customers.

In December 2023, in accordance with applicable laws and regulations, the Bank began notifying its affected customers of the cyber incident and arranged for its affected customers to receive free identity monitoring service for two years. The identity monitoring services included credit monitoring, fraud consultation, and identity theft restoration.

The Company believes it has meritorious defenses to the claims asserted in the Complaint and intends to vigorously defend itself against such Complaint. While we continue to measure the impact of this cyber-incident, including certain remediation expenses and other potential liabilities, we do not currently believe this incident will have a material adverse effect on our business, operations, or financial results.

Other than the foregoing, neither the Company nor its subsidiaries are involved in any other pending legal proceedings, other than routine legal matters occurring in the ordinary course of business, which in the aggregate involve amounts which are believed by management to be immaterial to the consolidated financial condition or results of operations of the Company.