Santander Holdings U.S.A.

Santander Holdings USA, Inc. (SHUSA) filed Item 1C of its 10-K disclosing its cybersecurity risk management and governance framework. The filing explicitly states that as of the time of filing, there are no known cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company's business, operations, or financial condition. No specific incidents, breaches, or material impacts are reported.

Santander Holdings USA Inc reported a data breach to the Indiana Attorney General. The breach occurred on 2024-04-17 and was reported on 2024-06-18. 6 Indiana residents were affected. 12,786 individuals affected in total.

Santander Holdings U.S.A., Inc. identified an external system breach that occurred between April 17, 2024, and May 9, 2024. The company discovered the breach on May 10, 2024. The incident affected 12 Maine residents. In response, Santander offered 24 months of identity protection and credit monitoring services through Experian and began notifying affected individuals on June 18, 2024.

Santander Holdings U.S.A. notified consumers that an unauthorized party accessed a third-party database between late April and early May 2024, compromising employee personal information including names, SSNs, and bank account details. Santander blocked access and offered two years of credit monitoring via Experian.