BlackRock is dependent on the effectiveness of the information and cybersecurity policies, procedures and capabilities it maintains to protect its computer and telecommunications systems and the data that resides on or is transmitted through them, including data provided by third parties that is significant to portions of BlackRock's business and products. An information security incident or disruption, such as a cyber-attack including social engineering, deepfakes, phishing scams, business email compromise, malware, denial-of-service or ransomware attacks, or failures to control access to sensitive systems, could materially interrupt business operations or cause disclosure or modification of sensitive or confidential client or competitive information. Moreover, developments in BlackRock’s use of process automation and artificial intelligence (“AI”), as well as the use of remote access by employees and mobile and cloud technologies, heighten these and other operational risks, as certain aspects of the security of such technologies may be complex, unpredictable or beyond BlackRock’s control. BlackRock’s growing exposure to the public Internet, as well as reliance on mobile or cloud technology or any failure by mobile technology and cloud service providers to adequately safeguard their systems and prevent cyber-attacks, could disrupt BlackRock’s operations and result in misappropriation, corruption or loss of personal, confidential or proprietary information or third-party data. In addition, there is a risk that encryption and other protective measures may be circumvented, particularly to the extent that new computing technologies including quantum computing increase the speed and computing power available.
The financial services industry has been the subject of cyber-attacks involving the dissemination, theft and destruction of corporate information or other assets, as a result of failure to follow procedures by employees or contractors or as a result of actions by third parties, including nation state actors, terrorist organizations, cyber criminals and hacktivists. BlackRock has been and continues to be the target of cyber-attacks, as well as the co-opting of its brand and fraudulent impersonations of the Company and members of management. It continues to monitor and develop its systems to protect its technology infrastructure and data from misappropriation or corruption, as the failure to do so could disrupt BlackRock’s operations and cause financial losses. Advances in technology, including generative AI, and use of such technology by malicious actors heighten these risks. Although BlackRock has implemented policies and controls, and takes protective measures involving significant expense, to help prevent and address potential data breaches, inadvertent disclosures, increasingly sophisticated cyber-attacks and cyber-related fraud, there can be no assurance that any of these measures proves fully effective. In addition, given the evolving nature of cyber threat actors and the increasing sophistication of cyber-attack methodology, a successful cyber-attack may persist for an extended period of time before being detected, and it may take a considerable amount of time for an investigation to be completed and the severity and potential impact to be known. Moreover, due to the complexity and interconnectedness of BlackRock’s systems, the process of upgrading or patching the Company’s protective measures could itself create a risk of security issues or system disruptions for the Company, as well as for clients who rely upon, or have exposure to, BlackRock’s systems.
In addition, due to BlackRock’s interconnectivity with third-party vendors, advisors, central agents, exchanges, clearing houses and other financial institutions, BlackRock or any such third-party may be adversely affected if any of them (or their service providers) is subject to a successful cyber-attack or other information security event, including those arising due to the use of mobile technology or a third-party cloud environment. BlackRock also routinely transmits and receives personal, confidential or proprietary information by email and other electronic means. The Company collaborates with clients, vendors and other third parties to develop secure transmission capabilities and protect against cyber-attacks. However, BlackRock or such third parties may not have all appropriate controls in place to protect the confidentiality of such information.
Any information security incident or cyber-attack against BlackRock or third parties with whom it is connected, including any interception, mishandling or misuse of personal, confidential or proprietary information or failure to disclose or communicate a cybersecurity incident appropriately, could result in material financial loss, loss of competitive position, regulatory fines and/or sanctions, breach of client contracts, reputational harm or legal liability, which, in turn, may cause BlackRock’s AUM, revenue and earnings to decline. In addition, BlackRock’s cybersecurity insurance may not cover all losses and damages from such events and BlackRock’s ability to maintain or obtain sufficient insurance coverage in the future may be limited.