PEOPLES BANCORP INC

of this Form 10-K. Peoples’ business could be adversely affected through events impacting third parties who perform significant operational services on behalf of Peoples. The third parties performing operational services for Peoples are subject to risks similar to those faced by Peoples relating to cybersecurity, breakdowns or failures of their own systems, or misconduct of their employees. Like many other community bank organizations, Peoples relies, in significant part, on a single vendor for the systems which allow Peoples to provide banking services to Peoples’ customers, with the systems being maintained on Peoples’ behalf by this single vendor. One or more of the third parties utilized by Peoples may experience a cybersecurity event or operational disruption and, if any such event or disruption does occur, it may not be adequately addressed, either operationally or financially, by such third party. Certain of these third parties may have limited indemnification obligations to Peoples in the event of a cybersecurity event or operational disruption, or may not have the financial capacity to satisfy their indemnification obligations. Financial or operational difficulties of a third-party provider could also impair Peoples’ operations if those difficulties interfere with such third party’s ability to serve Peoples.