Item 1A. Risk Factors.

| --- | --- |

Our business and the businesses of our subsidiaries face many risks and uncertainties. These risks and uncertainties could lead to events or circumstances that have a material adverse effect on our business, results of operations, cash flows, financial condition or equity and/or the business, results of operations, cash flows, financial condition, or equity of one or more of our subsidiaries. Our Annual Report on Form 10-K for the year ended December 31, 2020 and our Quarterly Reports on Form 10-Q for the quarters ended March 31, 2021 and June 30, 2021 include detailed discussions of certain risk factors facing the company. Except as described below, there have been no material changes to the risk factors previously disclosed in Part I, Item 1A, Risk Factors of our Annual Report on Form 10-K for the year ended December 31, 2020 and Part II, Item 1A. Risk Factors of our Quarterly Reports on Form 10-Q for the quarters ended March 31, 2021 and June 30, 2021.

Risks Related to Us and Our Subsidiary, CNA Financial Corporation (“CNA”)

Any significant interruption in the operation of CNA’s business functions, facilities and systems or its vendors’ facilities and systems could result in a materially adverse effect on its operations.

CNA’s business is highly dependent upon its ability to perform, in an efficient and uninterrupted manner, through its employees or vendor relationships, necessary business functions, such as internet support and 24-hour call centers, processing new and renewal business, processing and paying claims and other obligations and issuing financial statements.

CNA’s, or its vendors’, facilities and systems could become unavailable, inoperable, or otherwise impaired from a variety of causes, including natural events, such as hurricanes, tornadoes, windstorms, earthquakes, severe winter weather and fires, or other events, such as explosions, terrorist attacks, computer security breaches or cyber attacks, riots, hazardous material releases, medical epidemics or pandemics, utility outages, interruptions of CNA’s data processing and storage systems or the systems of third-party vendors, or unavailability of communications facilities. An interruption of CNA’s system availability occurred in March of 2021 as a result of a cybersecurity attack sustained by CNA. Please refer to the immediately following risk factor for further information regarding this incident. Likewise, CNA could experience a significant failure, interruption or corruption of one or more of its vendors’ information technology, telecommunications, or other systems for various reasons, including significant failures or interruptions that might occur as existing systems are replaced or upgraded. The shut-down or unavailability of one or more of CNA’s or its vendors’ systems or facilities for these and other reasons could significantly impair CNA’s ability to perform critical business functions on a timely basis.

In addition, because CNA’s information technology and telecommunications systems interface with and depend on third-party systems, CNA could experience service denials if demand for such service exceeds capacity or a third-party system fails or experiences an interruption. If sustained or repeated, such events could result in a deterioration of CNA’s ability to write and process new and renewal business, provide customer service, pay claims in a timely manner, or perform other necessary business functions, including the ability to issue financial statements in a timely manner.

The foregoing risks could also expose CNA to monetary and reputational damages. Potential exposures resulting from the March 2021 cybersecurity attack, described in the immediately following risk factor, as well as any future incidents may include substantially increased compliance costs, as well as increased costs relating to investments in computer system and security-related upgrades, with those costs potentially not recoverable under relevant insurance coverage. CNA anticipates making continued investments to improve its security and infrastructure. These expenses are not recoverable under relevant insurance coverage. If CNA’s business continuity plans or system security do not sufficiently address these risks, they could have a material adverse effect on CNA’s business, results of operations and financial condition.

Index

Based on the information currently known, CNA does not believe that the March 2021 cybersecurity attack will have a material impact on its business, results of operations or financial condition, but no assurances can be given as it continues to assess the full impact from the incident, including costs, expenses and insurance coverage. CNA may also be subject to future incidents that could have a material adverse effect on its business, results of operations or financial condition or may result in operational impairments and financial losses, as well as significant harm to its reputation.

Any significant breach in CNA’s data security infrastructure or its vendors’ facilities and systems could disrupt business, cause financial losses and damage its reputation, and insurance coverage may not be available for claims related to a breach.

A significant breach of CNA’s data security infrastructure may result from actions by its employees, vendors, third-party administrators, or unknown third parties or through cyber attacks. The risk of a breach can exist whether software services are in CNA’s data centers or CNA uses cloud-based software services. Breaches have occurred, and may occur again, in CNA’s systems and in the systems of its vendors and third party administrators.

Such a breach could affect CNA’s data framework or cause a failure to protect the personal information of its customers, claimants or employees, or sensitive and confidential information regarding its business and may result in operational impairments and financial losses, as well as significant harm to its reputation. The breach of confidential information also could give rise to legal liability and regulatory action under data protection and privacy laws, as well as evolving regulation in this regard. During the third quarter of 2021, CNA was notified of a breach of certain systems of a third party administrator, which resulted in breach notifications sent by such administrator to potentially impacted persons, including a limited number of CNA claimants. While CNA does not believe such notifications and resultant actions will have a material adverse effect on its business, this or similar incidents, or any other such breach of CNA’s or its vendors’ data security infrastructure could have a material adverse effect on its business, results of operations and financial condition.

CNA sustained a sophisticated cybersecurity attack in March of 2021 involving ransomware that caused a network disruption and impacted certain of its systems. Upon detection, CNA undertook steps to address the incident, including engaging a team of third-party forensic experts and notifying law enforcement and key regulators. CNA restored network systems and resumed normal operations. CNA is continuing to assess all actions that it will take to improve its existing systems.

CNA’s investigation revealed that an unauthorized third party copied some personal information relating to certain current and former employees, contractor workers and their dependents and certain other persons, including some policyholders. In July of 2021, CNA provided notifications to the impacted individuals and to regulators, in accordance with applicable law. Although CNA currently has no indication that the impacted data has been misused, or that CNA or its policyholder data was specifically targeted by the unauthorized third party, it may be subject to subsequent investigations, claims or actions in addition to other costs, fines, penalties, or other obligations related to impacted data, whether or not such data is misused. In addition, the misuse, or perceived misuse, of sensitive or confidential information regarding its business or policyholders could cause harm to CNA’s reputation and result in the loss of business with existing or potential customers, which could adversely impact its business, results of operations and financial condition.

Although CNA maintains cybersecurity insurance coverage insuring against costs resulting from cyber attacks (including the March 2021 attack), CNA does not expect that the amount available under its coverage and/or its coverage policy to cover all losses. Costs and expenses incurred and likely to be incurred by CNA in connection with the March 2021 attack include both direct and indirect costs and not all may be covered by its insurance coverage. In addition, potential disputes with its insurers about the availability of insurance coverage for claims relating to the March 2021 attack or any future incident could occur. Further, both as a result of the March 2021 attack and industry trends generally, CNA will incur higher costs for the replenishment of its current policy through the end of the term, as well as future cybersecurity insurance coverage beyond the current term.

Based on the information currently known, CNA does not believe that the March 2021 cybersecurity attack will have a material impact on its business, results of operations or financial condition, but no assurances can be given as it continues to assess the full impact from the incident, including costs, expenses and insurance coverage. CNA may also be subject to future incidents that could have a material adverse effect on its business, results of operations or financial condition or may result in operational impairments and financial losses, as well as significant harm to CNA’s reputation.

Index

Risks Related to Us and Our Subsidiaries Generally

Failures or interruptions in or breaches to our or our subsidiaries’ computer systems or those of our third party vendors could materially and adversely affect our or our subsidiaries’ operations.

We and our subsidiaries are dependent upon information technologies, computer systems and networks, including those maintained by us and our subsidiaries and those maintained and provided to us and our subsidiaries by third parties (for example, “software-as-a-service” and cloud solutions), to conduct operations and are reliant on technology to help increase efficiency in our and their businesses. We and our subsidiaries are dependent upon operational and financial computer systems to process the data necessary to conduct almost all aspects of our and their businesses. Any failure of our or our subsidiaries’ computer systems, or those of our or their customers, vendors or others with whom we and they do business, could materially disrupt business operations.

Computer, telecommunications and other business facilities and systems could become unavailable or impaired from a variety of causes, including cyber attacks or other cyber incidents, storms and other natural disasters, terrorist attacks, fires, utility outages, theft, design defects, human error or complications encountered as existing systems are replaced or upgraded. Cyber attacks and other cyber incidents are occurring more frequently, are constantly evolving in nature, are becoming more sophisticated and are being carried out by groups and individuals with a wide range of expertise and motives. The U.S. government has issued public warnings that indicate energy assets may be specific targets of cyber attacks, which can have catastrophic consequences, and hotel chains, among other consumer-facing businesses, have been subject to various cyber attacks targeting payment card and other sensitive consumer information. Cyber attacks and cyber incidents take many forms, including cyber extortion, denial of service, social engineering, introduction of viruses or malware, exploiting vulnerabilities in hardware, software or other infrastructure, hacking, website defacement, theft of passwords and other credentials, unauthorized use of computing resources for digital currency mining and business email compromise. CNA was recently subjected to a cybersecurity incident. In addition, one of CNA’s vendors also recently experienced a cybersecurity incident. For additional information about these incidents see “Risks Related to Us and Our Subsidiary, CNA Financial Corporation” above under this Part II, Item 1A.

As with other large companies, we and our subsidiaries and our and their third party vendors have experienced cyber attacks and other cyber incidents and expect this to continue. If we and our subsidiaries and our and their third party vendors do not allocate and effectively manage the resources necessary to continue to build and maintain our and their information technology security infrastructure, or if we or our subsidiaries or our or our subsidiaries’ vendors fail to timely identify or appropriately respond to cyber attacks or other cyber incidents, then this may disrupt our and our subsidiaries’ operations, cause significant damage to our or their assets and surrounding areas, cause loss of life or serious bodily injury, impact our or their data framework or cause a failure to protect personal information of customers or employees.

The foregoing risks relating to disruption of service, interruption of operations and data loss could impact our and our subsidiaries’ ability to timely perform critical business functions, resulting in disruption or deterioration in our and our subsidiaries’ operations and business and expose us and our subsidiaries to significant financial losses and monetary and reputational damages. In addition, potential exposures include substantially increased compliance costs and required computer system upgrades and security related investments. The breach of confidential information also could give rise to legal liability and regulatory action under data protection and privacy laws and regulations, both in the U.S. and foreign jurisdictions.

Index

Item 2. Unregistered Sales of Equity Securities and Use of Proceeds. | --- | --- |

Items 2 (a) and (b) are inapplicable.

(c) STOCK REPURCHASES

Index