CNA Financial (CNA) Risk Analysis

Loews beneficially owned approximately 92% of our outstanding shares of common stock as of December 31, 2024, and is in a position to control actions that require the consent of stockholders, including the election of directors, amendment of our Restated Certificate of Incorporation and any merger or sale of substantially all of our assets. In addition, and as of January 1, 2025 three officers of Loews, including the CEO of Loews (who is also a director of Loews), along with one additional director of Loews (who is also the Chairman of the Board of Loews) and one director emeritus of Loews, serve on our Board of Directors. We have also entered into services agreements and a registration rights agreement with Loews, and we may in the future enter into other agreements with Loews. It is possible that potential conflicts of interest could arise in the future for our directors who are also officers and/or directors of Loews with respect to a number of areas relating to the past and ongoing relationships of Loews and us, including tax and insurance matters, financial commitments and sales of common stock pursuant to registration rights or otherwise.

Ratings are an important factor in establishing the competitive position of insurance companies. Our insurance company subsidiaries, as well as our public debt, are rated by rating agencies, including, A.M. Best Company (A.M. Best), Moody's Investors Service, Inc. (Moody's), Standard & Poor's (S&P) and Fitch Ratings, Inc. (Fitch). Ratings reflect the rating agency's opinions of an insurance company's or insurance holding company's financial strength, capital adequacy, enterprise risk management practices, operating performance, strategic position and ability to meet its obligations to policyholders and debt holders, and may also reflect opinions on other areas such as information security and climate risk. The rating agencies may take action to lower our ratings in the future as a result of any significant financial loss or changes in the methodology or criteria applied by the rating agencies. The severity of the impact on our business is dependent on the level of downgrade and, for certain products, which rating agency takes the rating action. Among the adverse effects in the event of such downgrades would be the inability to obtain a material volume of business from certain major insurance brokers, the inability to sell a material volume of our insurance products to certain markets and the required collateralization of certain future payment obligations or reserves. Further, if one or more of our corporate debt ratings were downgraded, we may find it more difficult to access the capital markets and we may incur higher borrowing costs. In addition, it is possible that a significant lowering of the corporate debt ratings of Loews by certain of the rating agencies could result in an adverse effect on our ratings, independent of any change in our circumstances. For further discussion of our ratings, see the Ratings subsection within the Liquidity and Capital Resources section of MD&A in Item 7.

We face potential exposure to various types of existing, new and emerging mass tort claims, including those related to exposure to potentially harmful products or substances, such as glyphosate, lead paint, per- and polyfluoroalkyl substances (PFAS) and opioids, sexual abuse and molestation claims, claims arising from changes that expand the right to sue, remove limitations on recovery, extend the statutes of limitations or otherwise repeal or weaken tort reforms, such as those related to abuse reviver statutes, including New York reviver statutes; and claims related to new and emerging theories of liability, such as those related to global warming and climate change. Evolving judicial interpretations and new legislation regarding the application of various tort theories and defenses, including application of various theories of joint and several liability, as well as the application of insurance coverage to these claims, give rise to new and potentially more severe claim activity. For example, we have recorded, and may continue to record, increases in our mass tort reserves, driven substantially by abuse reviver statutes that have resulted in increased claims. Similar and continuing mass tort claim activity, including activity based on changing judicial interpretations and recent and proposed legislation, could have a material adverse effect on our business, results of operations and financial condition.

Our property and casualty insurance subsidiaries have exposures related to A&EP claims. Our experience has been that establishing claim and claim adjustment expense reserves for casualty coverages relating to A&EP claims is subject to uncertainties that are greater than those presented by more traditional property and casualty claims. Additionally, traditional actuarial methods and techniques employed to estimate the ultimate cost of claims for more traditional property and casualty exposures are less precise in estimating claim and claim adjustment expense reserves for A&EP. As a result, estimating the ultimate cost of both reported and unreported A&EP claims is subject to a higher degree of variability. On August 31, 2010, we completed a retroactive reinsurance transaction under which substantially all of our legacy A&EP liabilities were ceded to National Indemnity Company (NICO), a subsidiary of Berkshire Hathaway Inc., subject to an aggregate limit of $4 billion (Loss Portfolio Transfer). The cumulative amount ceded under the Loss Portfolio Transfer as of December 31, 2024 was $3.7 billion. If the other parties to the Loss Portfolio Transfer do not fully perform their obligations, net losses incurred on A&EP claims covered by the Loss Portfolio Transfer exceed the aggregate limit of $4 billion, or we determine we have exposures to A&EP claims not covered by the Loss Portfolio Transfer, we may need to increase our recorded net reserves which would result in a charge against our earnings. These charges could be substantial. Additionally, if the A&EP claims exceed the limit of the Loss Portfolio Transfer, we will need to assess whether to purchase additional limit or to reassume claim handling responsibility for A&EP claims from an affiliate of NICO. Any additional reinsurance premium or future claim handling costs would also reduce our earnings.

Our investment portfolio is exposed to various risks, such as interest rate, credit spread, issuer default, equity prices and foreign currency, which are unpredictable. Financial markets are highly sensitive to changes in economic conditions, monetary policies, tax policies, interest rates, domestic and international geopolitical issues and many other factors. Any imposition of significant tariffs by the U.S., as well as any related retaliatory tariffs, may adversely impact the general economy and the financial markets, and adversely affect the valuation of our investments. Changes in financial markets, including fluctuations in interest rates, credit, equity prices and foreign currency prices, and many other factors beyond our control can adversely affect the value of our investments, the realization of investment income and the rate at which we discount certain liabilities. Our investment portfolio is also subject to increased valuation uncertainties when investment markets are illiquid. The valuation of investments is more subjective when markets are illiquid, thereby increasing the risk that the estimated fair value (i.e., the carrying amount) of the portion of our investment portfolio that is carried at fair value in our financial statements is not reflective of the prices at which actual transactions could occur. We have significant holdings in fixed maturity investments that are sensitive to changes in interest rates. A decline in interest rates may reduce the returns earned on new fixed maturity investments, thereby reducing our net investment income, while an increase in interest rates may reduce the value of our existing fixed maturity investments, which could increase our net unrealized losses or reduce our net unrealized gains included in Accumulated other comprehensive income (AOCI). The value of our fixed maturity investments is also subject to risk that certain investments may default or become impaired due to deterioration in the financial condition of issuers of the investments we hold or in the underlying collateral of the security. In addition, we invest a portion of our assets in limited partnerships and common stock which are subject to greater market volatility than our fixed maturity investments. Limited partnership investments generally provide a lower level of liquidity than fixed maturity or equity investments, which may also limit our ability to withdraw funds from these investments. The timing and amount of income or losses on such investments is inherently variable and can contribute to volatility in reported earnings. Further, we hold a portfolio of commercial mortgage loans. We are subject to risk related to the recoverability of loan balances, which is influenced by declines in the estimated cash flows from underlying property leases, fair value of collateral, refinancing risk and the creditworthiness of tenants of credit tenant loan properties, where lease payments directly service the loan. Any changes in actual or expected collections would result in a charge to earnings. As a result of these factors, we may not earn an adequate return on our investments, may be required to write down the value of our investments and may incur losses on the disposition of our investments all of which could materially adversely affect our business, results of operations and financial condition.

A significant breach of our data security infrastructure may result from actions by our employees, vendors, third-party administrators, or unknown third parties or through cyber-attacks. The risk of a breach can exist whether software services are in our or third party administered data centers or are cloud-based software services. The sophistication of cybersecurity threats continues to escalate, and the measures we take to mitigate the risk of cyber incidents and to safeguard our systems and data may be insufficient. Further, the increasing use of artificial intelligence, both within our systems to achieve operational efficiencies and within threat actors' attack strategies, may further expose our systems to the risk of cyber-attacks. Breaches have occurred, and may occur again, in our systems and in the systems of our vendors and third-party administrators, both current and former, in that past vendors and third-party administrators may still retain certain confidential and sensitive information in their systems. During the third quarter of 2024, we were notified of a data breach resulting from a ransomware attack that impacted a former vendor. This incident resulted in required breach notifications to our impacted long term care policyholders, with such notifications made by the subject vendor. In the same quarter, we were notified of a data breach resulting from a ransomware attack that impacted a current vendor. This incident resulted in required breach notifications to impacted individuals, which included insurance claimants and their representatives, with such notifications made by the subject vendor. Breaches could affect our data framework or cause a failure to protect the personal information of our customers, claimants or employees, or sensitive and confidential information regarding our business or policyholders and may result in operational impairments and financial losses, significant harm to our reputation and the loss of business with existing or potential customers. The breach of confidential information also could give rise to legal liability and regulatory action under data protection and privacy laws, as well as evolving regulation in this regard. While we do not believe such breaches that have occurred and resultant actions will have a material adverse effect on our business, these or similar incidents, or any other such breach of our or our vendors' data security infrastructure could have a material adverse effect on our business, results of operations and financial condition. As previously disclosed, we sustained a sophisticated cybersecurity attack in March 2021 involving ransomware that caused a network disruption and impacted certain of our systems. Our investigation into the incident revealed that an unauthorized third party copied some personal information relating to certain current and former employees, contract workers and their dependents and certain other persons, including some policyholders. Although we currently have no indication that the impacted data has been misused, or that CNA or its policyholder data was specifically targeted by the unauthorized third party, we may be subject to subsequent investigations, claims or actions in addition to other costs, fines, penalties, or other obligations related to impacted data, whether or not such data is misused. In addition, the misuse, or perceived misuse, of sensitive or confidential information regarding our business or policyholders could cause harm to our reputation and result in the loss of business with existing or potential customers, which could adversely impact our business, results of operations and financial condition. Although we maintain cybersecurity insurance coverage insuring against costs resulting from cyber-attacks (including the March 2021 attack), we do not expect the amount available under our coverage policy to cover all losses from cyber-attacks. In addition, potential disputes with our insurers about the availability of insurance coverage could occur. Further, should we experience future cyber incidents, or should industry trends drive rate increases resulting from growth in volume and significance of cyber incidents broadly, we may incur higher costs for cybersecurity insurance coverage. The risks relating to future breaches in our, or our vendors', data security infrastructure or systems, including in connection with cyber incidents, could have a material adverse effect on our business, results of operations or financial condition or may result in significant operational impairments and financial losses, as well as significant harm to our reputation.

Technological changes in the way insurance transactions are completed in the marketplace, and our ability to react effectively to such change, may present significant competitive risks. For example, more insurers are utilizing or may begin utilizing "big data" analytics or artificial intelligence to make underwriting or other decisions that impact product design and pricing. If such utilization is more effective than how we use our data and information, we will be at a competitive disadvantage. There can be no assurance that we will continue to compete effectively with our industry peers due to technological changes; accordingly, this may have a material adverse effect on our business, results of operations and financial condition. In addition, agents and brokers, technology companies, or other third parties may create alternate distribution channels for commercial business that may adversely impact product differentiation and pricing. For example, they may create a digitally enabled distribution channel that may adversely impact our competitive position. Our efforts or the efforts of agents and brokers with respect to new products or alternate distribution channels, as well as changes in the way agents and brokers utilize greater levels of data and technology, including artificial intelligence, could adversely impact our business relationship with independent agents and brokers who currently market our products, resulting in a lower volume and/or profitability of business generated from these sources.