8-K/A: SouthState Corporation Amends 8-K Filing to Provide Update on Cybersecurity Incident

SouthState Corporation has amended its previous 8-K filing to provide additional details regarding a cybersecurity incident that occurred on February 6, 2024.

Summary

• SouthState Corporation filed an amendment to its original 8-K report to provide further information about a cybersecurity incident.
• The incident was detected on February 6, 2024, at SouthState Bank, N.A.
• Upon detection, SouthState initiated its incident response protocols and engaged a cybersecurity firm to assist with the investigation.
• SouthState has notified banking regulators and law enforcement about the incident.
• The company has contained the impact of the cybersecurity incident.
• SouthState will send notification letters to individuals whose personal information may have been compromised.
• While the incident had a significant impact on some business processes, it has not had a material impact on SouthState's overall financial condition or results of operations.
• SouthState believes the incident is not reasonably likely to have a material impact on its financial condition or results of operations.

Sentiment

Score: 7

Explanation: The document is cautiously optimistic, highlighting the containment of the incident and the lack of material financial impact, but also acknowledging the potential risks and uncertainties. The sentiment is positive but tempered by the nature of the event.

Positives

• SouthState has successfully contained the impact of the cybersecurity incident.
• The incident has not had a material impact on the company's financial condition or results of operations.
• SouthState has taken swift action by initiating incident response protocols, engaging a cybersecurity firm, and notifying regulators and law enforcement.

Negatives

• The cybersecurity incident had a significant impact on certain of SouthState's business processes.
• Personal information of some individuals may have been compromised, requiring notification letters.

Risks

• The ongoing assessment of the impacts of the cybersecurity incident could reveal further issues.
• The incident could potentially impact SouthState's customers, business, operations, and financial results.
• There are uncertainties and assumptions that are difficult to predict regarding the timing, extent, likelihood, and degree of occurrence of potential impacts.

Future Outlook

SouthState is continuing to assess the impacts of the cybersecurity incident and does not undertake any obligation to update or otherwise revise any forward-looking statements, except as required by federal securities laws.

Management Comments

• SouthState initiated its incident response and business continuity protocols upon detection of the cybersecurity incident.
• SouthState has been conducting an investigation into the cybersecurity incident.
• SouthState has contained the impact of the cybersecurity incident.
• SouthState has determined that the incident is not reasonably likely to have a material impact on its financial conditions or results of operations.

Industry Context

Cybersecurity incidents are a growing concern in the financial services industry, and this event highlights the importance of robust security measures and incident response plans. Many financial institutions are facing similar threats and are investing heavily in cybersecurity.

Comparison to Industry Standards

• Many financial institutions have experienced similar cybersecurity incidents, including Capital One in 2019 and Equifax in 2017, which resulted in significant financial and reputational damage.
• SouthState's response, including engaging a cybersecurity firm and notifying regulators, aligns with industry best practices for handling such incidents.
• The fact that SouthState has contained the incident and does not expect a material financial impact is a positive outcome compared to some other cases in the industry.

Stakeholder Impact

• Shareholders may be concerned about the potential financial and reputational impact of the cybersecurity incident.
• Customers whose personal information may have been compromised will be notified.
• Employees may be affected by the disruption to business processes.

Next Steps

• SouthState will continue to assess the impacts of the cybersecurity incident.
• SouthState will mail notification letters to individuals whose personal information may have been involved.

Key Dates

Keywords

cybersecurity, incident, data breach, financial services, banking, SouthState, security, regulation