Unauthorized access to 3rd party-hosted database

Banco Santander S.A.

14 May 2024

 

Statement

Madrid, 14 May 2024 - We recently became aware of an unauthorized access to a Santander database hosted by a third-party provider. We immediately implemented measures to contain the incident, including blocking the compromised access to the database and establishing additional fraud prevention controls to protect affected customers.

Following an investigation, we have now confirmed that certain information relating to customers of Santander Chile, Spain and Uruguay, as well as all current and some former Santander employees of the group had been accessed. Customer data in all other Santander markets and businesses are not affected.

No transactional data, nor any credentials that would allow transactions to take place on accounts are contained in the database, including online banking details and passwords. The bank's operations and systems are not affected, so customers can continue to transact securely.

We apologise for the concern this will understandably cause and are proactively contacting affected customers and employees directly. We have also notified regulators and law enforcement and will continue to work closely with them.

Important information

Non-IFRS and alternative performance measures

This document contains financial information prepared according to International Financial Reporting Standards (IFRS) and taken from our consolidated financial statements, as well as alternative performance measures (APMs) as defined in the Guidelines on Alternative Performance Measures issued by the European Securities and Markets Authority (ESMA) on 5 October 2015, and other non-IFRS measures. The APMs and non-IFRS measures were calculated with information from Grupo Santander; however, they are neither defined or detailed in the applicable financial reporting framework nor audited or reviewed by our auditors. We use these APMs and non-IFRS measures when planning, monitoring and evaluating our performance. We consider them to be useful metrics for our management and investors to compare operating performance between periods. APMs we use are presented unless otherwise specified on a constant FX basis, which is computed by adjusting comparative period reported data for the effects of foreign currency translation differences, which distort period-on-period comparisons. Nonetheless, the APMs and non-IFRS measures are supplemental information; their purpose is not to substitute IFRS measures. Furthermore, companies in our industry and others may calculate or use APMs and non-IFRS measures differently, thus making them less useful for comparison purposes. APMs using ESG labels have not been calculated in accordance with the Taxonomy Regulation or with the indicators for principal adverse impact in SFDR. For further details on APMs and Non-IFRS Measures, including their definition or a reconciliation between any applicable management indicators and the financial data presented in the consolidated financial statements prepared under IFRS, please see the 2023 Annual Report on Form 20-F filed with the U.S. Securities and Exchange Commission (the SEC) on 21 February 2024 (https://www.santander.com/content/dam/santander-com/en/documentos/informacion-sobre-resultados-semestrales-y-anuales-suministrada-a-la-sec/2024/sec-2023-annual-20-f-2023-en.pdf), as well as the section "Alternative performance measures" of  Banco Santander, S.A. (Santander) Q1 2024 Financial Report, published on 30 April 2024 (https://www.santander.com/en/shareholders-and-investors/financial-and-economic-information#quarterly-results). Underlying measures, which are included in this document, are non-IFRS measures.

The businesses included in each of our geographic segments and the accounting principles under which their results are presented here may differ from the businesses included and local applicable accounting principles of our public subsidiaries in such geographies. Accordingly, the results of operations and trends shown for our geographic segments may differ materially from those of such subsidiaries.

Forward-looking statements

Santander hereby warns that this document contains "forward-looking statements" as per the meaning of the U.S. Private Securities Litigation Reform Act of 1995. Such statements can be understood through words and expressions like "expect", "project", "anticipate", "should", "intend", "probability", "risk", "VaR", "RoRAC", "RoRWA", "TNAV", "target", "goal", "objective", "estimate", "future", "commitment", "commit", "focus", "pledge" and similar expressions. They include (but are not limited to) statements on future business development, shareholder remuneration policy and NFI.

While these forward-looking statements represent our judgement and future expectations concerning our business developments and results may differ materially from those anticipated, expected, projected or assumed in forward-looking statements.

In particular, forward looking statements are based on current expectations and future estimates about Santander's and third-parties' operations and businesses and address matters that are uncertain to varying degrees and may change, including, but not limited to (a) expectations, targets, objectives, strategies and goals relating to environmental, social, safety and governance performance, including expectations regarding future execution of Santander's and third-parties' (including governments and other public actors) energy and climate strategies, and the underlying assumptions and estimated impacts on Santander's and third-parties' businesses related thereto; (b) Santander's and third-parties' approach, plans and expectations in relation to carbon use and targeted reductions of emissions, which may be affected by conflicting interests such as energy security; (c) changes in operations or investments under existing or future environmental laws and regulations; (d) changes in rules and regulations, regulatory requirements and internal policies, including those related to climate-related initiatives; (e) our own decisions and actions including those affecting or changing our practices, operations, priorities, strategies, policies or procedures; and (f) the uncertainty over the scope of actions that may be required by us, governments and others to achieve goals relating to climate, environmental and social matters, as well as the evolving nature of underlying science and industry and governmental standards and regulations.

In addition, the important factors described in this document and other risk factors, uncertainties or contingencies detailed in our most recent Form 20-F and subsequent 6-Ks filed with, or furnished to, the SEC, as well as other unknown or unpredictable factors, could affect our future development and results and could lead to outcomes materially different from what our forward-looking statements anticipate, expect, project or assume.

Forward-looking statements are therefore aspirational, should be regarded as indicative, preliminary and for illustrative purposes only, speak only as of the date of this document, are informed by the knowledge, information and views available on such date and are subject to change without notice. Santander is not required to update or revise any forward-looking statements, regardless of new information, future events or otherwise, except as required by applicable law. Santander does not accept any liability in connection with forward-looking statements except where such liability cannot be limited under overriding provisions of applicable law.

Not a securities offer

This document and the information it contains does not constitute an offer to sell nor the solicitation of an offer to buy any securities.

Past performance does not indicate future outcomes

Statements about historical performance or growth rates must not be construed as suggesting that future performance, share price or results (including earnings per share) will necessarily be the same or higher than in a previous period. Nothing in this document should be taken as a profit and loss forecast.

 

END