Cyber attacks and IT security risk

“Table of Contents Risks Related to Our Business * The Company employs information including operational technology systems to support its business and to collect, store, and/or use proprietary and confidential information, including ongoing phased implementation of an enterprise resource planning (ERP) system as part of its business transformation on a worldwide basis over the next several years. Network disruptions, security and data breaches, cyberattacks, and other cybersecurity incidents involving the Company’s information technology systems, networks and infrastructure could: disrupt or interfere with the Company’s operations; result in the compromise and misappropriation of proprietary and confidential information belonging to the Company or its customers, suppliers, and employees; and expose the Company to numerous expenses, liabilities, and other negative consequences, any or all of which could have a material adverse effect on the Company’s business, reputation, and results of operations.”

Annual report 2025A · The company itself

“Noncompliance with any privacy laws or any security breach involving the misappropriation, loss, theft or other unauthorized disclosure of sensitive or confidential customer information, whether by the Company or by one of its third parties, could have a material adverse effect on the Company's business, reputation, brand and results of operations, including: material fines and penalties; compensatory, special, punitive and statutory damages; consent orders regarding the Company's privacy and security practices; adverse actions against the Company's licenses to do business; and injunctive relief.”

Annual report 2025A · The company itself

“In addition, despite the security measures the Company has in place to ensure compliance with applicable laws and rules, the Company's facilities and systems, and those of the Company's third-party providers and participants in its distribution channels may be vulnerable to security breaches, acts of vandalism or theft, computer viruses, misplaced or lost data, programming and/or human errors or other similar events.”

Annual report 2025A · The company itself

“We and the third parties with whom we work are subject to a variety of evolving threats, including, but not limited to, physical break-ins; disruptions due to power outages or catastrophic events, such as fires, floods, hurricanes, and earthquakes; breaches of our secure network by an unauthorized party (including those caused by supply chain breaches); software vulnerabilities or bugs; malware (including as a result of advanced persistent threat intrusions); malicious code (such as computer viruses and worms); attachments to emails; denial-of-service attacks; credential stuffing; credential harvesting; employee error, theft, or misuse; social engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks); ransomware attacks; server malfunctions; software or hardware failures; loss of data or other information technology assets; adware; telecommunications failures; attacks enhanced or facilitated by AI; or other similar threats.”

Annual report 2025A · The company itself

“In particular, severe ransomware attacks are becoming increasingly prevalent and can lead to significant interruptions in our operations and properties; loss of confidential, proprietary, and sensitive data; reputational harm; loss of income; and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Ransomware and similar attacks that adversely impact the operations of our properties could adversely impact our tenants’ ability to access and use our properties and services, disrupt their operations, or result in an adverse impact to their business.”

Annual report 2025A · The company itself

“Remote work has increased risks to our information technology systems and confidential, proprietary, and sensitive data as more of our employees utilize network connections, computers, and devices outside our premises or network, including working at home, while in transit, and in public locations.”

Annual report 2025A · The company itself

“Additionally, applicable data privacy and security obligations may require us to notify relevant stakeholders, including affected individuals, customers, regulators, and investors of security incidents or to implement other requirements, such as providing credit monitoring. Such disclosures and compliance with such requirements are costly, and the disclosure or the failure to comply with such disclosure requirements could lead to adverse consequences.”

Annual report 2025A · The company itself

“If we (or a third party with whom we work) experience a security incident or are perceived to have experienced a security incident, we may experience material adverse consequences, such as government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive data (including personal information); litigation (including class claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; diversion of management attention; interruptions in our operations (including availability of data); financial loss; and other similar harms. Security incidents and attendant material consequences may prevent or cause customers to stop using our services, deter new customers from using our products/services, and negatively impact our ability to grow and operate our business.”

Annual report 2025A · The company itself

“In addition, our reliance on third parties introduces new cybersecurity risks and vulnerabilities, including supply chain attacks, and other threats to our business operations. We rely on third parties and technologies to operate critical business systems to process confidential, proprietary, and sensitive data in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, employee emails, and other functions. We also rely on third parties to provide other products, services, or otherwise to operate our business. Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place.”

Annual report 2025A · The company itself

“Disruption to IT systems, such as severe breaches of data security, may occur across the global value chain, where well-functioning IT systems and infrastructure are critical for the company’s ability to operate effectively.”

Annual report 2025A · The company itself

“ALK has an IT and cybersecurity strategy in place to prevent intruders from causing damage to systems or gaining access to critical data and systems. ALK continuously invests in upgrading IT security. Awareness campaigns, access controls, intrusion detection, prevention systems, and IT disaster recovery plans have all been implemented.”

Annual report 2025A · The company itself

“The failure of cyber or other information security controls, could result in a loss or disclosure of confidential information, damage to our reputation, additional costs and impair our ability to conduct business effectively We use technology algorithms, machine based learning, artificial intelligence and data to perform necessary business functions. There are threats that could impact our ability to protect our data and systems; if the threats materialize, they could impact: •Confidentiality — protecting our data from disclosure to unauthorized parties •Integrity — ensuring data is not changed accidentally or without authorization and is accurate •Availability — ensuring our data and systems are accessible to meet business needs We collect, use, store or transmit a large amount of confidential, proprietary and other information (including personal information of customers, claimants and employees) in connection with the operation of our business.”

Annual report 2025A · The company itself

“The availability of our products and services and fulfillment of our customer contracts depend on the continuing operation of our information technology and communications systems. Our systems are vulnerable to damage, interference, or interruption from modifications or upgrades, terrorist attacks, state-sponsored attacks, natural disasters or pandemics, geopolitical tensions or armed conflicts, export controls and sanctions, tariffs and non-tariff trade barriers, the effects of climate change, power and transmission availability challenges, utility outages, telecommunications failures, computer viruses, software bugs, cyber attacks, supply-chain attacks, computer denial of service attacks, phishing schemes, or other attempts to harm or access our systems.”

Annual report 2025A · The company itself

“From time-to-time, we and our service providers, suppliers and trade customers experience attempts to infiltrate and interrupt information systems. We have not experienced an information security breach within the past three years, and to date, we have not experienced any interruptions of information systems as a result of infiltration attempts. However, because technology is increasingly complex and cyber-attacks are increasingly sophisticated and more frequent, there can be no assurance that such incidents will not cause interruptions that could have a material adverse effect on us in the future.”

Annual report 2025A · The company itself

“Outsourcing certain business functions pursuant to the Initiative may increase our exposure to risks such as data breaches, which could compromise sensitive information. Implementation of new technology and systems deployment may increase our risk of data security incidents, internal control failures and regulatory noncompliance.”

Annual report 2025A · The company itself

“Our operating companies face risks inherent in reliance on a few significant manufacturing facilities and a small number of key suppliers, distributors and distribution chain service providers. A natural or man-made disaster, cybersecurity incident, global pandemic, labor disruption or other disruption that affects the manufacturing operations of any of our operating companies, the operations of any key supplier, distributor or distribution chain service provider of any of our operating companies or any other disruption in the supply or distribution of goods or services (including a key supplier’s inability to comply with government regulations, lack of available workers or unwillingness to supply goods or services to a tobacco company) could adversely impact operations.”

Annual report 2025A · The company itself

“Significant Disruption at Key Manufacturing Facility — A significant disruption at one of our key manufacturing facilities could adversely affect our business operations and financial results. Our diversification of facilities for product manufacturing and current or future insurance coverage for our facilities, including business interruption insurance, may not be sufficient to protect our business in the event of a significant disruption at one of our key manufacturing facilities. Significant disruptions due to accidents, labor issues, weather conditions, power outages, cyberattacks or otherwise, could negatively impact our business, financial condition, or results of operations, or cash flows.”

Annual report 2026A · The company itself

“Information Technology and Cybersecurity Risks Cybersecurity Risk — The disruption of our operations or risk of loss of our sensitive business information could negatively impact our financial condition and results of operations. Increased cyber-attacks, including computer viruses, ransomware, unauthorized access attempts, phishing, hacking, and other types of attacks pose a risk to the security and availability of our information technology systems, including those provided by third parties. Artificial intelligence ("AI") technologies have also enabled threat actors to identify vulnerabilities at an accelerated pace, which increases the scale and sophistication of threats and which may intensify these cybersecurity risks.”

Annual report 2026A · The company itself

“However, our 18 safeguards may not always be able to prevent a cyber-attack from impacting our systems and we may not be able to successfully and timely execute our business recovery protocol, which could have a material impact on our business, financial condition, results of operations, or cash flows. Further, as cybersecurity threats continue to evolve, we may be required to make significant investments to modify or enhance our systems to improve our ability to respond and recover.”

Annual report 2026A · The company itself

“In addition, our customers, suppliers, and third-party service providers are susceptible to cyber-attacks and disruption to their information technology systems, which could result in reduced demand for our products or limit our ability to supply our products.”

Annual report 2026A · The company itself

“Information system damages, disruptions, shutdowns, or compromises could result in production downtimes and operational disruptions, transaction errors, loss of customers and business opportunities, violation of privacy laws and legal liability, regulatory fines, penalties or intervention, negative publicity resulting in reputational damage, reimbursement or compensatory payments, and other costs, any of which could have an adverse effect on our business, financial condition, results of operations, or cash flows, which effect may be material and result in a competitive disadvantage.”

Annual report 2026A · The company itself

“Our operations are subject to acts of sabotage, terrorism, cyber attacks, and other disruptive acts. Like other electric and natural gas utilities, our energy centers, fuel storage facilities, transmission and distribution facilities, and enterprise information systems may be affected by malicious acts, terrorist activities and other intentionally disruptive acts, including physical and cyber attacks, which could disrupt our ability to produce or distribute our energy products or subject us to significant liability.”

Annual report 2025A · The company itself

“Also, remote working arrangements could increase our data security risks, including loss of data related to sensitive customer, employee, financial, and operating system information, through insider or outsider actions.”

Annual report 2025A · The company itself

“A security breach of AEP’s physical assets or information systems, or those of AEP’s competitors, vendors, business partners and interconnected entities (including RTOs) could materially impact AEP by, among other things, impairing the availability of electricity transmitted and distributed by AEP and/or the reliability of generation, transmission and distribution systems, damaging grid infrastructure, interrupting critical business functions, impairing the availability of vendor services and materials that AEP relies on to maintain its operations, or by leading to the theft or inappropriate release of certain types of information, including critical infrastructure information, system data and architecture, sensitive customer, vendor, or employee data, or other confidential data.”

Annual report 2025A · The company itself

“Events such as hurricanes, windstorms, hailstorms, flooding, earthquakes, landslides, wildfires, solar storms, earth sinking, tsunamis, war or other military action, acts of terrorism, explosions and fires, cyberattacks, product defects, pandemics, mass torts, civil unrest and other catastrophes have adversely affected our business in the past and could do so in the future.”

Annual report 2025A · The company itself

“Catastrophic events, and legislative or regulatory responses thereto, have in the past and could in the future result in losses in any business in which we operate, and could expose us to: •widespread claim costs associated with property, casualty, general liability, bodily injury, workers’ compensation, accident and health, travel, business interruption and cyber claims, among others; •loss resulting from a decline in the value of our invested assets; •loss resulting from actual policy experience that is adverse compared to the assumptions made in product pricing, which could adversely affect underwriting profitability; •revenue loss due to decline in customer base; •declines in value and/or losses with respect to companies and other entities whose securities we hold and counterparties we transact business with and have credit exposure to, including reinsurers; •significant disruptions to our physical infrastructure, systems and operations; and •widespread loss or corruption of personal or sensitive business data.”

Annual report 2025A · The company itself

“Some of these technology systems also rely upon third-party systems and services, which themselves may rely on the systems and services of other third parties. Problems caused by, or occurring in relation to, our third-party providers’ systems and services, including those resulting from breakdowns or other disruptions in information technology services provided by our third-party providers and the other third parties on which they rely, our inability to acquire third-party services on commercially acceptable terms, failure of a third-party provider to perform as anticipated or in compliance with applicable laws or regulations, inability of a third-party provider to provide the required volumes of services or our third-party providers experiencing cyberattacks or data breaches, could materially and adversely affect our business, results of operations, financial condition and liquidity.”

Annual report 2025A · The company itself

“Like other global companies, the systems and networks we maintain and third-party systems and networks we or our vendors use are currently, and may in the future continue to be, subject to or targets of unauthorized or fraudulent access, including physical or electronic break-ins or unauthorized tampering, as well as cybersecurity threats such as “denial of service” attacks, phishing, automated attacks, and other disruptive attacks, including ransomware. Cyber threats are constantly evolving and the techniques used in these attacks evolve rapidly, including the use of emerging technologies, such as advancing forms of artificial intelligence and quantum computing by nation state threat actors and criminal organizations. The new cyber risks introduced by these changes in technology, such as deepfake schemes, require us to devote significant attention to identification, assessment and analysis of the risks and implementation of corresponding preventative measures. Additionally, the frequency and sophistication of such threats continue to increase and often become further heightened in connection with geopolitical tensions.”

Annual report 2025A · The company itself

“Our cybersecurity measures, including information security and technology policies and standards, administrative, technical and physical controls and other actions by us or contracted third-parties designed to be preventative, may not provide fully effective protection from threats to our data, systems and networks, including malware and computer virus attacks, ransomware, unauthorized access, business e-mail compromise, misuse, denial-of-service attacks, system failures and other disruptions.”

Annual report 2025A · The company itself

“We routinely transmit, receive and store personal, confidential and proprietary information by secured email and other electronic means. We have been, and in the future may be, unable to keep such information confidential and secure, especially with clients, vendors, service providers, counterparties and other third parties who may not have or use appropriate controls to protect personal, confidential or proprietary information. Failure to secure or appropriately handle personally identifiable information or confidential or proprietary information has caused and could in the future cause a loss of data or compromised data integrity.”

Annual report 2025A · The company itself

“We are exposed to the risk that employee fraud or misconduct could occur despite extensive training for employees and fraud monitoring. Instances of fraud, illegal acts, errors, failure to document transactions properly or to obtain proper internal authorization, misuse of customer or proprietary/confidential information, or failure to comply with regulatory requirements or our internal policies may result in losses and/or reputational damage.”

Annual report 2025A · The company itself

“As owners and operators of critical infrastructure, we face a heightened risk of physical attack and cyber attacks from internal or external sources, including nation-state cyber actors. Our water and wastewater systems have been, and may in the future be, vulnerable to disability or failures as a result of physical or cyber attacks, acts of war or terrorism, vandalism and other causes. Our operational and information technology systems are also vulnerable to unauthorized external or internal access, due to hacking, viruses, social engineering attacks, acts of violence, war or terrorism, and other causes.”

Annual report 2025A · The company itself

“Risks Related to Cyber, Artificial Intelligence, Intellectual Property, Legal and Regulatory Our computer systems and networks are subject to attempted security breaches and other cyber incidents and a significant disruption in, or breach in security of, our information technology systems or certain products could materially and adversely affect our business or reputation. We rely on information technology systems throughout our company to keep financial records and customer data, process orders, manage inventory, coordinate shipments to customers, maintain confidential and proprietary information, assist in semiconductor engineering and other technical activities and operate other critical functions such as internet connectivity, network communications and email.”

Annual report 2025A · The company itself

“Our security measures or those of our third-party service providers or strategic partners may not detect or prevent security breaches, cyberattacks, defects, bugs or errors. Further, geopolitical tensions and conflicts have escalated the volume and sophistication of cyberattacks. Because the tactics and techniques used by threat actors to obtain unauthorized access to or sabotage systems change frequently and, in some cases, are not recognized until they are launched or even later, we may be unable to anticipate these techniques or to implement adequate preventative measures in advance, and security breaches may remain undetected for an extended period of time.”

Annual report 2025A · The company itself

“Our use of AI may also increase vulnerability to cybersecurity risks, including through unauthorized use or misuse of AI tools and bad inputs or logic or the introduction of malicious code incorporated into AI generated code. AI and machine learning also may be used for certain cybersecurity attacks, improving or expanding the existing capabilities of threat actors in manners we cannot predict at this time, resulting in greater risks of security incidents and breaches.”

Annual report 2025A · The company itself

“Our information technology systems and those of our third-party service providers and strategic partners may also be susceptible to damage, disruptions or shutdowns due to power outages, hardware failures, telecommunication failures, user errors, catastrophes or other unforeseen events. A prolonged disruption in the information technology systems that involve our internal communications or our interactions with customers or suppliers could result in the loss of sales and customers and significant incremental costs, which could adversely affect our business.”

Annual report 2025A · The company itself

“Our operations are dependent upon our ability to protect our personnel, offices, and technology infrastructure against damage from business continuity events that could have a significant disruptive effect on our operations. Should we experience a local or regional disaster or other business continuity problem, such as a security or cyber incident or attack, a natural disaster, climate event, terrorist attack, pandemic, power loss, telecommunications failure, or other natural or human-caused disaster, our continued success will depend, in part, on the availability of our personnel and office facilities, and the proper functioning of computer systems, telecommunications, and other related systems and operations.”

Annual report 2025A · The company itself

“An interruption in or 22 the cessation of service by any service provider as a result of systems failures, cybersecurity or data privacy incidents (including, but not limited to, ransomware), capacity constraints, financial difficulties, or for any other reason could disrupt our operations, impact our ability to offer certain products and services, and result in contractual or regulatory penalties, liability claims from clients, or employees, damage to our reputation, and harm to our business.”

Annual report 2025A · The company itself

“Any significant system or network disruption due to a breach in the security of our information technology systems could have a negative impact on our reputation, operations, sales, and operating results. We rely on the efficient, uninterrupted, and secure operation of complex information technology systems and networks, some of which are within the Company and some of which are outsourced to third parties. All information technology systems are potentially vulnerable to damage or interruption from a variety of sources, including but not limited to cyber-attacks, malicious or destructive code, ransomware, social engineering attacks, generative artificial intelligence and deepfake attacks, denial of service attacks, data and security breaches, and unauthorized access or improper actions by third parties with whom 23 we engage, insiders or employees.”

Annual report 2025A · The company itself

“We are at risk of attack by a growing list of adversaries through new and increasingly sophisticated methods of attack, including methods that take advantage of remote work scenarios and evolving geopolitical risks. Because the techniques used to obtain unauthorized access or sabotage systems change frequently , we may be unable to anticipate these techniques, implement and maintain adequate preventative measures, or detect respond, and if required, disclose to third parties quickly enough in the event of an incident or attack.”

Annual report 2025A · The company itself

“We regularly experience social engineering attempts, and increasingly sophisticated attempted attacks to our systems and networks, certain of which have been successful and have resulted in unauthorized access to our systems and data. Aon has from time to time experienced cybersecurity incidents, such as malicious or destructive code, unauthorized parties gaining access to our information technology systems, ransomware incidents, data loss via malicious and non-malicious methods, and similar incidents, which to date have not had a material impact on our business.”

Annual report 2025A · The company itself

“Aon has from time-to-time experienced and may experience in the future problems with the information technology systems of vendors, including breakdowns or other disruptions in communication services provided by a vendor, failure of a vendor to handle current or higher volumes, difficulties in the migration of services or data to third parties or the cloud hosted by third parties, cyber-attacks, and security breaches, any of which could adversely affect our ability to deliver products and services to customers and otherwise conduct business.”

Annual report 2025A · The company itself

“We have implemented various measures to manage our risks related to system and network security and disruptions, but a security breach or a significant or extended disruption in the functioning of our information technology systems could damage our reputation, cause us to lose clients, adversely impact our operations, sales, and operating results, and require us to incur significant expense (in connection with incident response, remediation efforts, or otherwise) and divert resources to address and remediate or otherwise resolve such issues. Additionally, in order to maintain the level of security, service, and reliability that our clients require, we may be required to make significant additional investments in our information technology systems.”

Annual report 2025A · The company itself

“Additionally, we are a global and acquisitive organization and we therefore may not adequately identify weaknesses in certain of our information systems, including those of targets we acquire, which could expose us to unexpected liabilities and fines or make our own systems more vulnerable to attack. These types of incidents affecting us, our clients, insurance carriers, vendors, or other third-parties could result in intellectual property or other confidential information being lost or stolen, including client or employee personal information or company data.”

Annual report 2025A · The company itself

“In addition, the Company’s and its suppliers’ operations, retail stores and facilities are subject to the risk of interruption by fire, power shortages, nuclear power plant accidents and other industrial accidents, terrorist attacks and other hostile acts, ransomware and other cybersecurity attacks, labor disputes, public health issues and other events beyond the Company’s control. Such events can make it difficult or impossible for the Company to manufacture and deliver products to its customers, create delays and inefficiencies in the Company’s supply and manufacturing chain, result in slowdowns and outages to the Company’s service offerings, increase the Company’s costs, and negatively impact consumer spending and demand in affected areas.”

Annual report 2025A · The company itself

“The Company and its global supply chain are dependent on complex information technology systems and are exposed to information technology system failures or network disruptions caused by natural disasters, accidents, power disruptions, telecommunications failures, acts of terrorism or war, computer viruses, physical or electronic break-ins, ransomware or other cybersecurity incidents, or other events or disruptions.”

Annual report 2025A · The company itself

“Losses or unauthorized access to or releases of confidential information, including personal information, could subject the Company to significant reputational, financial, legal and operational consequences. The Company’s business requires it to use and store confidential information, including personal and sensitive health and financial information with respect to the Company’s customers and employees.”

Annual report 2025A · The company itself

“The Company’s business also requires it to share confidential information with suppliers and other third parties. The Company relies on global suppliers that are also exposed to ransomware and other malicious attacks that can disrupt business operations.”

Annual report 2025A · The company itself

“Although malicious attacks perpetrated to gain access to confidential information, including personal information, affect many companies across various industries, the Company is at a relatively greater risk of being targeted because of its high profile and the value of the confidential information it creates, owns, manages, stores and processes.”

Annual report 2025A · The company itself

“Like all companies, our information technology systems and the systems of third parties that we do business with are vulnerable to data breaches, interruptions or failures due to events that may be beyond our control, including, but not limited to, natural disasters, power outages, theft, terrorist attacks, computer viruses, hackers, employee or vendor error or misconduct, malicious actors, errors in usage or deepfake or social engineering or schemes, phishing attacks, other external hazards and general technology failures.”

Annual report 2025A · The company itself

“We could be materially impacted by a cyber attack, data breach, ransomware, phishing, social engineering or other cybersecurity incident resulting in loss of business data, personal data and other confidential or secret information, a disruption in our business operations, regulatory or other legal action, and fines.”

Annual report 2025A · The company itself

“We, or third parties on which we rely, could experience cybersecurity incidents relating to our information systems, or our products, services, or data, which could disrupt our operations or our ability to provide services, cause vulnerabilities or perceived vulnerabilities in our product, compromise intellectual property or other sensitive data, harm our reputation, damage customer or other relationships, delay our ability to recognize revenue, lead to significant costs, legal proceedings, legal liability, or enforcement actions, or otherwise negatively impact our business. We, like all technology companies, depend upon information technology systems to conduct virtually all business operations, ranging from internal operations and product development activities to marketing and sales efforts and communications with customers and business partners. We could experience disruptions, cybersecurity breaches, and other cybersecurity incidents relating to our information systems, or our products, services, or data.”

Annual report 2025A · The company itself

“We have outsourced some business functions to third parties, including our manufacturers, logistics providers, and cloud service providers. We also rely upon distributors, resellers and system integrators to sell our products.”

Annual report 2025A · The company itself

“We, or third parties on which we rely, could experience disruptions, cybersecurity breaches, and other cybersecurity incidents with many different types of causes, including phishing schemes and other social engineering methods, fraud and other malfeasance, denial of service attacks, vulnerabilities or defects in design or manufacture, unintended technical errors, misconfigurations, “bugs,” viruses, ransomware and other malware, mishandling of data or other mistakes by employees or other insiders, and attacks by insiders or external parties. Sophisticated, or even unsophisticated, persons or organizations may attempt to compromise our systems, or third party systems on which we rely, and access, use, destroy, impair, or obtain confidential, personal, or otherwise sensitive or proprietary information and could compromise our systems, products, services and networks, or those of third parties on which we rely.”

Annual report 2025A · The company itself

“We may experience cybersecurity incidents that we do not detect, or that we do not detect for extended periods of time. The techniques used to carry out attacks are constantly evolving, and it may be more difficult to detect attacks involving techniques that we are not aware of or have not anticipated.”

Annual report 2025A · The company itself

“If we experience a cybersecurity incident, or if any of the above events occur, or are perceived to have occurred, we could be subject to significant claims for liability from our customers and others and regulatory investigations and actions from governmental agencies, and we could be required to expend significant capital and other resources to remediate and otherwise address any incident, including to notify individuals, entities, or regulatory bodies. In addition, our ability to protect our intellectual property rights could be compromised and our reputation and competitive position could be significantly harmed.”

Annual report 2025A · The company itself

“We could incur significant costs to upgrade our systems and measures in an effort to prevent network and system disruptions and other cybersecurity incidents. Even the perception of inadequate security may damage our reputation and negatively impact our ability to win new customers and retain existing customers.”

Annual report 2025A · The company itself

“The process of integrating information systems of businesses we acquire is complex and exposes us to additional risk as we might not adequately identify weaknesses in the targets’ information systems or information handling, privacy and security policies and protocols, which could expose us to unexpected liabilities or make our own systems and data more vulnerable to employee or insider error, malfeasance or cybersecurity incidents. These risks may be exacerbated in connection with the integration of AssuredPartners.”

Annual report 2025A · The company itself

“Any future, material cybersecurity or data incident, may cause us to experience unauthorized access, exfiltration, manipulation, corruption, loss or disclosure of our proprietary, client, employee, or other data, reputational harm, the inability to render services due to system outages or other business disruptions, loss of clients and revenue, regulatory action and scrutiny, sanctions or other statutory penalties, litigation, liability for failure to safeguard clients’ information, increases in cybersecurity costs or financial losses. Any of the foregoing may be exacerbated by a delay or failure to detect a cybersecurity incident or the full extent of such incident. In addition, disclosure or media reports of actual or perceived security vulnerabilities to our systems or those of our third-party service providers, even if no breach has been attempted or occurred, could lead to reputational harm, loss of customers and revenue, or increased regulatory actions oversight and scrutiny.”

Annual report 2025A · The company itself

“During a cybersecurity incident, we might have to take our systems offline, which could interfere with services to our clients or damage our reputation. While we endeavor to design and implement technologies, controls, policies and procedures to identify such incidents as quickly as possible, any response could take substantial time, and there may be extensive delays before we obtain full and reliable information. During such time we would not necessarily know the extent of the harm or how best to remediate it, and certain errors or actions could be repeated or compounded before they are discovered and remediated, all of which may further increase the costs and consequences of such incident.”

Annual report 2025A · The company itself

“With respect to our commercial arrangements with third-party vendors, we have processes designed to require third party IT outsourcing, offsite storage and other vendors to agree to maintain certain standards with respect to their storage, protection and transfer of confidential, personal and proprietary information. However, we have limited control over their security, privacy and data governance practices so there can be no assurance that we can prevent, mitigate, or remediate a potential failure of those standards and we remain at risk of a cyber or data incident due to the intentional or unintentional non-compliance by a vendor’s employee or agent, the breakdown of a vendor’s processes, or a cybersecurity incident involving vendor’s information systems. We cannot ensure that any provisions in our agreements with these vendors would be enforceable or adequate or would otherwise protect us from any liability in connection with these incidents.”

Annual report 2025A · The company itself

“If we experience a business continuity event, such as an earthquake, hurricane, flood, terrorist incident, military conflict, pandemic, security breach, cybersecurity incident, power loss, telecommunications outage or other systems failure, or other disaster, our ability to continue operations will depend on an effective business continuity and disaster recovery plan, including the safety and continued availability of our personnel, including key executives, vendors and other third parties, and the proper functioning of our telecommunications and other systems and operations, including our device care centers and other facilities. An extended period of such conditions may strain our business continuity and disaster recovery plan, introduce additional operational risk, including cybersecurity and fraud risks, negatively impact employee morale, result in negative publicity, reputational harm and the loss of profitability and clients.”

Annual report 2025A · The company itself

“We rely on the uninterrupted and secure operation of our technology systems, including information technology systems and operational technology systems, and those of our vendors to operate our business and securely process, transmit and store electronic information. This electronic information includes confidential and other sensitive information, including personal data, that we receive from our customers, vendors and other third parties. Our technology systems and safety control systems and those of our vendors and other third parties with whom we share sensitive information are vulnerable to, and in some cases have been subject to, damage or interruption from a variety of external threats, including cybersecurity incidents, such as advanced ransomware, credential compromises, vulnerability exploitation including zero-day exploits, distributed denial of service attacks, hardware misconfigurations, phishing and advanced social engineering, which have been increasing in frequency and complexity.”

Annual report 2025A · The company itself

“Our technology systems must be continually patched, hardened and upgraded to protect against vulnerabilities, including zero-day threats, and cyber attackers have, and may continue to, exploit these vulnerabilities before they have been addressed. Due to the large number and age of the systems and platforms that we operate and the increased frequency with which vendors issue security patches to their products, as well as the need to test patches and, in some cases coordinate with clients and vendors, before they can be deployed, we are at risk that we cannot deploy these patches to remediate these vulnerabilities in a timely and effective manner.”

Annual report 2025A · The company itself

“From time to time, we have experienced cybersecurity incidents involving a vendor or other third party, which resulted in a breakdown of such third party’s data protection measures or access to our infrastructure through the third party. To the extent that a vendor or third party suffers a cybersecurity incident that compromises their operations, our data and our customers’ data could be compromised or we may experience significant service interruption.”

Annual report 2025A · The company itself

“For instance, we may not adequately identify weaknesses in an acquired entity’s technology systems, either before or after the acquisition, which could affect the value we are able to derive from the acquisition, expose us to unexpected liabilities or make our own systems more vulnerable to a cybersecurity incident. We may be unable to integrate the systems of the businesses we acquire into our environment in a timely manner, which could further increase these risks until such integration takes place.”

Annual report 2025A · The company itself

“Like many companies, we are subject to regular phishing email and social media engineering campaigns directed at our employees that have become more sophisticated, highly personalized and ultimately more successful, partly through the use of AI, and can result in significant financial and data losses.”

Annual report 2025A · The company itself

“Improper access to or disclosure of sensitive client or Company information, which has occurred from time to time, could harm our reputation and subject us to litigation and significant liability under our contracts, as well as under existing or future laws, rules and regulations.”

Annual report 2025A · The company itself

“Risks from Cybersecurity Threats While we have not experienced a cybersecurity incident that resulted in a material adverse effect on our business, operations, financial condition or results of operations, there can be no guarantee that we will not experience such an incident in the future.”

Annual report 2025A · The company itself

“We are dependent on vendors and other third parties to maintain reliable and secure network systems that provide adequate speed and data capacity. For example, we utilize third-party cloud service providers in connection with certain key aspects of our business and operations, and any disruption of, or interference with, our use of such cloud services could have a material adverse impact on our business and operations.”

Annual report 2025A · The company itself

“Supply chain difficulties may result in product shortages which could lead to lost product sales and materially affect our reputation and results of operations. • Establishment of new manufacturing facilities, creating capacity and technical capability to support new product launches. • Contingency plans, including dual sourcing, multiple suppliers and close monitoring and maintenance of stock levels. • Business continuity and resilience initiatives, disaster and data recovery, and emergency response plans. • Quality management systems. Failure in information technology or cybersecurity Significant disruption to our IT systems, including cybersecurity breaches, or failure to comply with applicable laws or regulations could harm our reputation and materially affect our financial condition or results of operations. • Penetration testing and targeted remediation. • Data and application access hardening.”

Annual report 2025A · The company itself

“Cyberattacks have caused, and may in the future cause, equipment or network failures, copying or loss of information, including sensitive personal information of customers or employees or proprietary information, as well as disruptions to our or our customers’, suppliers’ or vendors’ operations, which have and in the future could result in significant expenses, potential investigations and legal liability, a loss of current or future customers and reputational damage.”

Annual report 2025A · The company itself

“Cyberattacks against us and our suppliers and vendors have occurred in the past, including from highly sophisticated, state-sponsored actors as noted above, and will continue to occur in the future and are increasing in frequency, scope and potential harm over time. For example, in July 2024, we disclosed a cybersecurity incident on Item 1.05 of Form 8-K relating to the copying of mobile customer call data.”

Annual report 2025A · The company itself

“These existing risks are compounded given the shift in recent years to work-from-home arrangements for a large population of employees and contractors, as well as employees and contractors of our third-party technology providers and vendors, and the risks could also be elevated in connection with the ongoing wars between Ukraine and Russia and conflicts in the Middle East as we and our third-party technology providers and vendors are vulnerable to a heightened risk of cyberattacks from or affiliated with nation-state actors, including retaliatory attacks from Russian actors against U.S.-based companies.”

Annual report 2026A · The company itself

“There have been and may continue to be significant supply chain attacks, and we cannot guarantee that our or our such third parties’ systems have not been breached or otherwise compromised or that they do not contain exploitable defects, bugs, or vulnerabilities that could result in an incident, breach, or other disruption to, our or these third parties’ systems. Any security breach or incident involving such third parties could compromise the integrity or availability of, or result in the theft or unauthorized use, modification, or other processing of, our and our customers’ data.”

Annual report 2026A · The company itself

“Like all information technology systems, ours are susceptible to a number of risks including, but not limited to, damage or interruptions resulting from obsolescence, natural disasters, power failures, human error, viruses, social engineering, phishing, ransomware or other malicious attacks and cybersecurity events.”

Annual report 2025A · The company itself

“Our information technology and infrastructure are vulnerable to attacks by threat actors or system compromises due to employee error, malfeasance or other disruptions, and the threat landscape remains challenging with our digital business transformation, remote or hybrid employees, the increasing use of artificial intelligence (“AI”), and interconnected supply chains expanding the risk of attack. Threat actors are increasingly leveraging AI for cyberattacks, and our increasing use of AI carries risks related to data security, privacy events, and potential algorithmic bias.”

Annual report 2025A · The company itself

“Our IT systems and infrastructure, as well as those of various third parties on which we rely, have experienced, and are likely to continue to experience, a variety of cyberattacks, including, but not limited to, unauthorized access, malicious code execution and/or phishing attacks, which could be further exacerbated by rapid technology evolution, including increased adoption of AI and geopolitical events.”

Annual report 2025A · The company itself

“Non-compliance by third-party vendors, manufacturers, or service providers (especially those involved in data processing) can expose us to liability indirectly. Cybersecurity incidents, system failures, or breaches involving our own infrastructure or that of our partners may trigger regulatory scrutiny, financial penalties, business interruption, reputational harm, loss of competitive advantage and customer trust, as well as privacy litigation and civil lawsuits with damages.”

Annual report 2025A · The company itself

“The financial services industry has been the subject of cyber-attacks involving the dissemination, theft and destruction of corporate information or other assets, as a result of failure to follow procedures by employees or contractors or as a result of actions by third parties, including nation state actors, terrorist organizations, cyber criminals and hacktivists. BlackRock has been and continues to be the target of cyber-attacks, as well as the co-opting of its brand and fraudulent impersonations of the Company and members of management.”

Annual report 2025A · The company itself

“Any information security incident or cyber-attack against BlackRock or third parties with whom it is connected, including any interception, mishandling or misuse of personal, confidential or proprietary information or failure to disclose or communicate a cybersecurity incident appropriately, could result in material financial loss, loss of competitive position, regulatory fines and/or sanctions, breach of client contracts, reputational harm or legal liability, which, in turn, may cause BlackRock’s AUM, revenue and earnings to decline.”

Annual report 2025A · The company itself

“We face various cybersecurity threats, including attempts to gain unauthorized access to our systems and networks, denial-of-service attacks, threats to our information technology infrastructure, ransomware and phishing attacks, and attempts to gain unauthorized access to our company-, customer- and employee-sensitive information. These threats come from a variety of actors, some of which are highly organized and sophisticated, such as nation-state actors and criminal enterprises.”

Annual report 2025A · The company itself

“A cyber-related attack or security breach, whether experienced directly or through our supply chain or third party-service providers, could, among other serious consequences, result in loss of intellectual property; allow unauthorized access to or cause the publication of various categories of sensitive, proprietary or customer data; cause disruption or degradation of our business operations; compromise our products or services; and/or result in reputational harm.”

Annual report 2025A · The company itself

“In addition, third parties have and may continue to attempt to hack into our products to obtain data relating to patients, or alter the intended functionality of our medical devices, or disrupt performance of our products, or access our proprietary information and the technology from third party vendors that we rely upon may have defects or vulnerabilities which, in turn, create vulnerabilities or disruptions in our system. Cyber-attacks continue to evolve in complexity and scope, and inherently may be difficult to detect.”

Annual report 2025A · The company itself

“In the event of a disaster, our disaster recovery and business continuity plans may fail, which could result in the loss of client data and adversely interrupt operations. Our operations are dependent on our ability to protect our infrastructure against damage from catastrophe, natural disaster, or severe weather, as well as events resulting from unauthorized security breach, power loss, telecommunications failure, terrorist attack, pandemic, or other events that could have a significant disruptive effect on our operations.”

Annual report 2026A · The company itself

“Any slowdown or failure of our computer or communications systems could impact our ability to provide services to our clients and support our internal operations and could subject us to liability for losses suffered by our clients or their customers. Our services depend on our ability to store, retrieve, process, and manage significant databases, and to receive and process transactions and investor communications through a variety of electronic systems.”

Annual report 2026A · The company itself

“In addition, we may not be able to prevent cybersecurity attacks on our systems. Moreover, because we have outsourced our data center operations and use third-party cloud services providers for storage of certain data, the operation, performance and security functions of the data center and the cloud system involve factors beyond our control, and we cannot guarantee that our third-party providers will be able to provide their services at a satisfactory level.”

Annual report 2026A · The company itself

“A CYBERSECURITY ATTACK, OR ANY OTHER INTERRUPTION IN INFORMATION TECHNOLOGY AND/OR DATA SECURITY THAT MAY IMPACT OUR OPERATIONS OR THE OPERATIONS OF THIRD PARTIES THAT SUPPORT US, COULD ADVERSELY AFFECT OUR BUSINESS, FINANCIAL CONDITION AND REPUTATION. We rely on information technology and third-party vendors to provide effective and efficient service to our customers, process claims, and timely and accurately report information to carriers, which often involves secure processing of confidential, sensitive, proprietary and other types of information.”

Annual report 2025A · The company itself

“Cybersecurity breaches of any of the systems we rely on may result from circumvention of security systems, denial-of-service attacks or other cyber-attacks, software bugs, malicious or destructive code, hacking, social engineering attacks (including “phishing” attacks, business email compromise and digital or telephonic impersonation), computer viruses, ransomware, malware, employee or insider error or threats, malfeasance, social engineering, physical breaches or other actions, any of which could expose us to unauthorized access, exfiltration, manipulation, corruption, loss or 13 disclosure of proprietary, customer, employee or other data, the inability to render services due to system outages or other business disruptions, regulatory action and scrutiny, monetary and reputational damages and significant increases in compliance costs.”

Annual report 2025A · The company itself

“Our information technology systems, devices, storage, and applications, as well as those maintained by third-party providers, are vulnerable to damage, disruptions, and shutdowns due to cyberattacks, ransomware, malware, phishing, denial of service attacks, and other unauthorized access attempts. These incidents have occurred in the past and may happen again, potentially causing material service outages, inappropriate access, or other significant business interruptions.”

Annual report 2025A · The company itself

“Cyberattacks that compromise the confidentiality, integrity or availability of our or our third-party providers' information technology systems or confidential information could materially harm our reputation, business, financial condition and results of operations. We rely on hardware, software, digital infrastructure and computing networks for both internal and customer-facing operations that are critical to our business (collectively, “IT Systems”).”

Annual report 2025A · The company itself

“We face numerous, evolving cybersecurity risks that threaten the confidentiality, integrity and availability of our IT Systems, Confidential Information, products and services, including from diverse threat actors, such as state-sponsored organizations, opportunistic hackers and malicious insiders, as well as through diverse attack vectors, such as social engineering (including phishing), malware (including ransomware) and denial-of-service attacks, and due to human or technological error, such as misconfigurations, “bugs” or other vulnerabilities in software or hardware. Additionally, advances in technology, an increased level of sophistication and expertise of hackers, widespread access to generative AI, and new discoveries in the field of cryptography increase the risk of significant compromises or breaches of our IT Systems or security measures implemented to protect our systems.”

Annual report 2025A · The company itself

“We and certain of our third-party service providers have experienced cyberattacks and other security incidents in the past and will continue to experience varying degrees of attacks and incidents in the future. Any such incidents could compromise our or our providers' IT Systems, which could cause system disruptions or slowdowns and lead to the Confidential Information stored on our or third-party systems being accessed, publicly disclosed, lost or stolen.”

Annual report 2025A · The company itself

“Cyberattacks are expected to accelerate on a global basis in frequency and magnitude as threat actors are becoming increasingly sophisticated in using techniques and tools – including AI – that circumvent security controls, evade detection and remove forensic evidence. Techniques used to obtain unauthorized access or to sabotage information systems change frequently and include zero-day software vulnerabilities that are unknown until exploited by threat actors.”

Annual report 2025A · The company itself

“Furthermore, state-supported and geopolitical-related cyberattacks against companies such as ours may increase due to geopolitical conditions.”

Annual report 2025A · The company itself

“A cyberattack on our IT Systems or IT Systems of one of our third-party providers or customers could result in material adverse impacts due to any or all of the following: compromise to our Cadence Cloud portfolio, which includes both our managed and customer-managed environments, and our data centers and those of our customers and end users; corruption or stealing of Confidential Information such as proprietary information related to our (or our customers') business, products, services and infrastructure or Personal Information; manipulation or stealing of financial data and assets; and/or disruption of our systems and services and those of our customers and others. As a result, we could be exposed to a risk of loss or misuse of Confidential Information, loss of financial assets, business interruption, regulatory investigations, litigation and other liabilities and costs.”

Annual report 2025A · The company itself

“Because we make extensive use of third-party suppliers and service providers, such as cloud services that support our internal and customer-facing operations, successful cyberattacks that disrupt or result in unauthorized access to third party providers’ IT Systems, including those that store our Confidential Information, can materially impact our operations and financial results. Moreover, hardware, software or applications we develop or procure from third parties or through open source solutions may contain defects in design or manufacture or other vulnerabilities and are susceptible to compromise. In addition, we have acquired and continue to acquire companies with less sophisticated security measures, and it takes time to align their security practices to meet our information security policies, procedures and controls, which exposes us to increased cybersecurity and other integration risks.”

Annual report 2025A · The company itself

“An actual or perceived breach of IT Systems or Confidential Information managed by us or a vendor could significantly impact our business through diminished market perception of the effectiveness of our security measures, legal or regulatory actions, substantial fines, penalties and required changes to our business practices, damage to our reputation or our business, loss of existing customers and our ability to obtain new customers (including government customers), significant restoration, remediation and compliance costs, and cause harm to our financial condition. Any or all of the foregoing could materially adversely affect our business, financial condition and results of operations.”

Annual report 2025A · The company itself

“Furthermore, our operations are dependent upon the connectivity of our operations throughout the world. Activities that interfere with our international connectivity or operations, such as cyber hacking, computer system viruses, natural disasters, public health emergencies, civil unrest or terrorism, could significantly harm our business operations.”

Annual report 2025A · The company itself

“A cyber-attack or other security incident on us or third parties (including their supply chains) with which we conduct business, including an incident that results in the theft, loss, manipulation or misuse of information (including personal information), or the disabling of systems and access to information critical to business operations, may result in increased costs, reductions in revenue, reputational damage, legal exposure and business disruptions.”

Annual report 2025A · The company itself

“The financial services industry, including Capital One, is particularly at risk because of the increased use of and reliance on digital banking products and other digital services, including mobile banking products, such as mobile payments, and other internet- and cloud-based products and applications, and the development of additional remote connectivity solutions, which increase cybersecurity risks and exposure.”

Annual report 2025A · The company itself

“For example, on July 29, 2019, we announced that on March 22 and 23, 2019 an outside individual gained unauthorized access to our systems (the “2019 Cybersecurity Incident”). This individual obtained certain types of personal information relating to people who had applied for our credit card products and to our credit card customers. While the 2019 Cybersecurity Incident has been remediated, it resulted in fines, litigation, consent orders, settlements, government investigations and other regulatory enforcement inquiries.”

Annual report 2025A · The company itself

“In addition, our customers access our products and services using personal devices that are necessarily external to our security control systems. There has also been a significant proliferation of consumer information available on the internet resulting from breaches of third-party entities, including personal information, log-in credentials and authentication data. These third-party breach events could create a threat for our customers if their Capital One log-in credentials are the same as or similar to the credentials that have been compromised on other internet sites. This threat could include the risk of unauthorized account access, data loss and fraud.”

Annual report 2025A · The company itself

“The use of AI, “bots” or other automation software can increase the velocity and efficacy of these types of attacks and such use by companies has resulted in, and may continue to result in, cyber-attacks and other security incidents that implicate the sensitive and confidential information, including personal information, of AI users.”

Annual report 2025A · The company itself

“As our employees and contractors are operating under our hybrid work model, our remote interaction with employees, service providers, partners and other third parties on systems, networks and environments over which we have less control (such as through employees’ personal devices) increases our cybersecurity risk exposure.”

Annual report 2025A · The company itself

“The methods and techniques employed by malicious actors continue to develop and evolve rapidly, including from emerging technologies, such as AI and quantum computing, are increasingly sophisticated and often are not fully recognized or understood until after they have occurred, and some techniques could occur and enable persistent access for an extended period of time before being detected and remediated, if at all. We and our service providers and other third parties with which we interact may be unable to anticipate or identify certain attack methods or techniques in order to implement effective preventative or detective measures or mitigate or remediate the damages caused in a timely manner.”

Annual report 2025A · The company itself

“We may also be unable to hire, develop and retain talent that keeps pace with the rapidly changing cyber threat landscape, and which are capable of preventing, detecting, mitigating or remediating these risks. Although we seek to maintain a robust suite of authentication and layered information security controls, any one or combination of these controls could fail to prevent, detect, mitigate, remediate or recover from these risks in a timely manner.”

Annual report 2025A · The company itself

“An actual, suspected, threatened or alleged disruption or breach, including as a result of a cyber-attack, or media (including social media) reports of alleged or perceived security vulnerabilities or incidents at Capital One or at our service providers, could result in significant legal and financial exposure, regulatory intervention, litigation, enforcement actions, remediation costs, card reissuance, inability to timely pay our debts (and consequently limit our access to future funding), operational disruptions, supervisory liability, damage to our reputation or loss of confidence in the security of our systems, products and services that could adversely affect our business.”

Annual report 2025A · The company itself

“Furthermore, the Transaction exposes us to additional cybersecurity risks, which we expect to continue until the integration of Discover is completed. These risks include the possibility of previously undetected cybersecurity threats in Discover's operations, systems and networks, as well as risks related to the cybersecurity posture of Discover and its third-party service providers. The materialization of such risks could lead to the degradation or disruption of our operations and services; unauthorized access; breach of confidentiality; and misuse or modification of systems, networks and data.”

Annual report 2025A · The company itself

“If any of our employees, contractors, third-party service providers or other third parties with which we do business use any third-party AI solutions in connection with our business, it may lead to the inadvertent or unauthorized disclosure or incorporation of our sensitive and confidential information, including personal information, into third-party systems or publicly available or third-party training sets, which may impact our ability to realize the benefit of our intellectual property or other proprietary rights in such information.”

Annual report 2025A · The company itself

“Risks of external fraud exceeding our expectations due to larger, more sophisticated, or more frequent fraud attacks, failure to detect and respond to such attacks and/or the reduced capability to recover losses from those incidents. This could result in increased fraud loss, operational cost, customer dissatisfaction, reputational damage and/or constrained revenue growth for us.”

Annual report 2025A · The company itself

“Our risk of fraud continues to increase as third parties that handle confidential consumer information suffer security breaches, we expand our digital banking business and we introduce new products and features (including our acquisition of the Global Payment Network).”

Annual report 2025A · The company itself

“Credit and debit card fraud, identity theft and electronic-transaction related crimes are prevalent, and perpetrators are growing ever more sophisticated.”

Annual report 2025A · The company itself

“Additionally, consumer activists and regulators have sought to expand financial institutions’ responsibility to hold customers harmless for transactions that they authorized on their accounts that are the result of scams. Emerging generative AI capabilities, such as synthetic video, images and identity documents may introduce new risks, in the form of identity fraud and scams.”

Annual report 2025A · The company itself

“In addition, we continue to incur increased costs with respect to preventing, detecting, investigating, mitigating, remediating and recovering from cybersecurity risks, as well as any related attempted fraud. In order to address ongoing and future risks, we must expend significant resources to support protective security measures, investigate and remediate any vulnerabilities of our information systems and infrastructure and invest in new technology designed to mitigate security risks.”

Annual report 2025A · The company itself

“We have insurance against some cyber risks and attacks; nonetheless, our insurance coverage may not be sufficient to offset the impact of a material loss event (including if our insurer denies coverage as to any particular claim in the future), and such insurance may increase in cost or cease to be available on commercially reasonable terms, or at all, in the future. In addition, in the case of any cyber-attack or other security incident, information or security breach or technology failure arising from third-party systems impacting us, any third-party indemnification may not be applicable or sufficient to address the impact of such incidents.”

Annual report 2025A · The company itself

“Our results of operations could be adversely affected if our or a service provider's business processes, information systems, critical facilities, or distribution networks are disrupted (including disruption of access), are damaged or fail, whether due to physical disruptions, such as extreme weather events, including wildfires, hurricanes, extreme temperatures, or other natural disasters, pandemics (as they were by the COVID-19 pandemic), supply chain disruptions, or power outages, systems updates, or due to cybersecurity incidents, ransomware, or other actions of third parties, including labor strikes or shortages, political unrest, and terrorist attacks.”

Annual report 2026A · The company itself

“Our business and results of operations could be adversely affected if we experience a material cyber-attack or other systems breach. Cybersecurity incidents and attacks resulting in unauthorized access to our systems and those of third parties we use in our business could have a material impact on our business operations as a result of loss or misuse of our information, including personal data and sensitive data, and disruption to normal business operations.”

Annual report 2026A · The company itself

“However, companies in the healthcare industry are increasingly targeted for cyberattacks. The risk and efficacy of cyberattacks increases from time to time due to a variety of internal and external factors, including the use by threat actors of sophisticated and rapidly evolving techniques, such as adversarial artificial intelligence and social engineering attempts.”

Annual report 2026A · The company itself

“Additionally, our MSO businesses are subject to cybersecurity-related risks which are, while similar in many respects, incremental to the cybersecurity risks experienced by our legacy businesses.”

Annual report 2026A · The company itself

“Additionally, cyber threats and the techniques used in cyberattacks change, develop and evolve rapidly, including from emerging technologies, such as advanced forms of artificial intelligence (“AI”) and quantum computing. Our hybrid work environment, usage of mobile, AI and cloud-based technologies, and ongoing divestitures and wind downs may increase our risk for a cybersecurity incident.”

Annual report 2025A · The company itself

“Collectively, these safeguards and measures or those of our third-party providers, including any cloud-based technologies, may prove inadequate to prevent the attendant risk posed by cybersecurity incidents, subjecting us to contractual restrictions, liability and damages, loss of business, penalties, unfavorable publicity, increased scrutiny by our regulators, and may materially impact our business, financial condition, and operating results.”

Annual report 2025A · The company itself

“Misconduct by our TPHs, members, participants or others could harm us. We run the risk that our TPHs, members, participants, other persons who use our markets or our products, other persons for whom we clear transactions, our employees or those with which we have business relationships may engage in fraud, market or product manipulation, or other misconduct, which could result in regulatory and legal sanctions and penalties and serious harm to our reputation, especially because we are the parent company of SROs and other markets.”

Annual report 2025A · The company itself

“Our ability to conduct our global business may be materially adversely affected by disruptions to these systems or our infrastructure. Our information technology and communications systems are vulnerable to damage or disruption from fire, power loss, telecommunications failure, system malfunctions, computer viruses, cyberattacks, natural disasters such as hurricanes, earthquakes and floods, acts of war or terrorism, employee errors or malfeasance, or other events which are beyond our control.”

Annual report 2025A · The company itself

“Cyberattacks and malware pose growing threats to many companies, and we, as well as our third-party service providers, have been a target and may continue to be a target of such threats, which could expose us to liability, reputational harm and significant remediation costs and cause material harm to our business and financial results.”

Annual report 2025A · The company itself

“Failure to protect and maintain the security of our information and technology networks, including personal information and other client information, intellectual property and proprietary business information could materially adversely affect us. Security breaches and other disruptions of our information and technology networks, as well as that of third-party vendors, could compromise our information and intellectual property and expose us to liability, reputational harm and significant remediation costs, which could cause material harm to our business and financial results.”

Annual report 2025A · The company itself

“We are also subject to an increasing number of reporting obligations in respect of material cybersecurity incidents. These reporting requirements have been proposed or implemented by a number of regulators in different jurisdictions, may vary in their scope and application, and could contain conflicting requirements.”

Annual report 2025A · The company itself

“A significant actual or potential theft, loss, corruption, exposure, fraudulent use or misuse of client, employee or other personal information or proprietary business data, whether by third parties or as a result of employee malfeasance or otherwise, perceived or actual non-compliance with our contractual or other legal obligations regarding such data or intellectual property or a violation of our privacy and security policies with respect to such data could result in significant remediation and other costs, fines, litigation or regulatory actions against us.”

Annual report 2025A · The company itself

“IT system Risker kopplade till IT-system uppstår framför allt till följd av CellaVisions ökande digitalisering av affärsprocesser, allt strängare krav på informationssäkerhet och ett växande hot från cyberattacker. CellaVision har identifierat tre huvudsakliga riskområden: • Driftsäkerhet – tillgänglighet till IT system och data • Datasäkerhet – risk för förlust av data • Skydd mot intrång – från medarbetare och externa parter CellaVision arbetar proaktivt med IT-säkerhet för att uppfylla de krav som ställs av partners och myndigheter, både nu och i framtiden.”

Annual report 2024A · The company itself

“A failure in or breach of our operational or security systems, networks or infrastructure, or those of third-party vendors with which we do business, including as a result of cyber-attacks and other data security incidents, could have a material adverse effect on our business.”

Annual report 2025A · The company itself

“We are subject to cyber and physical security risks related to our information technology systems, operational technology, network infrastructure and other technology and facilities used to conduct almost all of our businesses. The operation of our electric transmission, distribution and generation systems is dependent on the physical interconnection of our facilities, as well as communications among the various components of our systems and the systems of supply chain stakeholders (such as vendors, contractors and suppliers). Further, certain of the various internal systems we use to conduct our businesses are highly integrated.”

Annual report 2025A · The company itself

“All states have data breach notification laws that would require us to inform individuals and regulators in the event of a breach that could impact personal information of our customers. In the event of an information security breach, such rules may require consumer and government agency notification and may result in regulatory enforcement actions with the potential of monetary forfeitures.”

Annual report 2025A · The company itself

“Network or information system shutdowns or other service disruptions caused by events such as computer hacking, phishing, dissemination of computer viruses, worms and other destructive or disruptive software, malicious cyber activities by nation-state threat actors, “cyber attacks” such as ransomware, process breakdowns, denial of service attacks and other malicious activity pose increasing risks. Both unsuccessful and successful “cyber attacks” on companies have continued to increase in frequency, scope and potential harm in recent years, and the increasing use of AI may intensify these cybersecurity risks.”

Annual report 2025A · The company itself

“We process, store, and transmit large amounts of data, including the personal information of our customers. Ongoing increases in the potential for misuse of personal information, the public’s awareness of the importance of safeguarding personal information, and the volume of legislation that has been adopted or is being considered regarding the protection, privacy and security of personal information have resulted in increases to our information-related risks. We could be exposed to significant costs if such risks were to materialize, and such events could damage our reputation, credibility and business and have a negative impact on our revenue.”

Annual report 2025A · The company itself

“Threats include a wide variety of perpetrators aiming for political, personal or financial gain, utilizing a broad set of tactics including ransomware, advanced malware, DDoS, account takeover, phishing/SMSing, sabatoge and social engineering, among others.”

Annual report 2025A · The company itself

“The IT/OT systems of the Company, its customers, business partners, suppliers, and third-party providers have been, and will continue to be, subject to cyber-threats, including malware, ransomware, unauthorized access and other attacks. The Company experienced a cyberattack in August 2023 and may continue to experience an increase in the number of such attacks, which may result in unauthorized access to or disclosure of information and increased response and remediation costs.”

Annual report 2025A · The company itself

“Our role in the global marketplace places us at greater risk than other public companies for a cyber attack and other cyber-security risks. Our technology, our customers, our people and our third-party service providers are vulnerable to cyber-security threats, which could result in wrongful use of our data or our customers’ data or cause interruptions in our operations, our customers' operations, or our third-party service providers' operations, which could cause us to lose customers and trading volume and result in substantial liabilities.”

Annual report 2025A · The company itself

“Our technology, our customers, our people and our third-party service providers are vulnerable to targeted attacks, such as "phishing" attacks, unauthorized access, fraud, business email compromise, computer viruses, denial of service attacks, terrorism, "ransomware" attacks, attacks created through artificial intelligence, firewall or encryption failures or other security or operational risks. Criminal groups, political activist groups and nation-state actors have targeted the financial services industry in general, including as a result of armed conflicts, and our role in the global marketplace places us at significant risk for a cyber attack and other information security threats.”

Annual report 2025A · The company itself

“Our usage of mobile, web, and cloud technologies, such as those pursuant to our partnership with Google Cloud, may increase our risk of a cyber attack.”

Annual report 2025A · The company itself

“Any security attack or breach could result in system failures and delays, malfunctions in our operations, loss of customers or lower trading volume, loss of competitive position, damage to our reputation, disruption of our business, legal liability or regulatory fines and significant costs, which in turn may cause our revenues and earnings to decline and could have a material impact on our financial condition or results of operations.”

Annual report 2025A · The company itself

“If we experience system failures or capacity constraints, our ability to conduct our operations and execute our business strategy could be materially harmed, and we could be subject to significant costs and liabilities. Our business is highly dependent on our ability to process, execute and monitor, in an efficient and uninterrupted manner, a large number of transactions, which occur at high volumes and frequencies across multiple systems and our ability to access key business data, financial information, order processing and invoicing.”

Annual report 2025A · The company itself

“On November 27, 2025, our largest data center owned and operated by CyrusOne experienced a critical cooling failure caused by human error. In response to the critical cooling failure, we made the decision to temporarily halt our markets. Our markets opened the following day on a delayed basis.”

Annual report 2025A · The company itself

“As part of our global information security (GIS) and privacy programs, we employ resources to prevent, detect and respond to cyber attacks and security risks that could impact our people, processes and technology infrastructure, including rapid response to zero-day vulnerabilities.”

Annual report 2025A · The company itself

“•We depend on highly complex manufacturing processes that require strategic materials, components, and products from limited sources of supply. •Increases in commodity prices and diminished availability of rare earth minerals and noble gases may adversely affect our results of operations and financial condition. •We purchase a significant amount of the materials and components used in our products from a limited number of suppliers. •Cybersecurity attacks and incidents and other vulnerabilities could subject us to costly damages, claims and expenses, harm to our reputation or competitive position, or disrupt our operations and business. •We may be adversely impacted by any of the multiple uncertainties and outcomes associated with the use and evolution of AI. •Natural disasters or other global or regional catastrophic events could disrupt our operations, give rise to substantial environmental hazards, and adversely affect our results.”

Annual report 2026A · The company itself

“If we are unsuccessful in establishing or maintaining strategic relationships with these third parties or if these third parties fail to deliver certain operational services, our business, operating results, and financial condition could be adversely affected; •Interest rate fluctuations could negatively impact us; 5 Table of Contents •Adverse economic conditions could adversely affect our business; •The future development and growth of crypto is subject to a variety of factors that are difficult to predict and evaluate.”

Annual report 2025A · The company itself

“Although we maintain insurance coverage, it may be insufficient to protect us against all losses and costs stemming from security breaches, cyberattacks, and other types of unlawful activity, or any resulting disruptions or data theft and loss from such events. Outages and disruptions of our platform, including any caused by cyberattacks, may harm our reputation, business, operating results, and financial condition.”

Annual report 2025A · The company itself

“These third parties may be subject to financial, legal, regulatory, and labor issues, cybersecurity incidents, data theft or loss, break-ins, computer viruses or vulnerabilities in their code, denial-of-service attacks, sabotage, acts of vandalism, loss, disruption, or instability of third-party financial institution relationships, privacy breaches, service terminations, disruptions, interruptions, and other misconduct. They are also vulnerable to damage or interruption from human error, power loss, telecommunications failures, fires, floods, earthquakes, hurricanes, tornadoes, pandemics and similar events.”

Annual report 2025A · The company itself

“Our systems, the systems of our third-party service providers and partners, and certain crypto asset and blockchain networks have experienced from time to time, and may experience in the future service interruptions or degradation because of hardware and software defects or malfunctions, distributed 40 Table of Contents denial-of-service and other cyberattacks, insider threats, break-ins, sabotage, human error, vandalism, earthquakes, hurricanes, floods, fires, and other natural disasters, power losses, disruptions in telecommunications services, fraud, military or political conflicts, terrorist attacks, computer viruses or other malware, or other events.”

Annual report 2025A · The company itself

“However, it is nevertheless possible that hackers, employees or service providers acting contrary to our policies, or others could circumvent these measures to improperly access our systems or documents, or the systems or documents of our business partners, agents, or service providers, and improperly access, obtain, or misuse customer crypto assets and funds. The methods used to obtain unauthorized access, disable, or degrade service or sabotage systems are also constantly changing and evolving and may be difficult to anticipate or detect for long periods of time.”

Annual report 2025A · The company itself

“The theft, loss, or destruction of private keys required to access any crypto assets held in custody for our own account or for our customers may be irreversible. If we are unable to access our private keys or if we experience a hack or other data loss relating to our ability to access any crypto assets, it could cause regulatory scrutiny, reputational harm, and other losses.”

Annual report 2025A · The company itself

“We are exposed to transaction losses due to chargebacks, refunds, or returns as a result of fraud or uncollectability that could adversely affect our business, operating results, and financial condition. Certain of our products and services are paid for by electronic transfers from bank accounts, which exposes us to risks associated with returns and insufficient funds. Furthermore, some of our products and services are paid for by credit and debit cards through payment processors, which exposes us to risks associated with chargebacks and refunds.”

Annual report 2025A · The company itself

“Table of Contents Our platform may be exploited to facilitate illegal activity such as fraud, money laundering, gambling, tax evasion, and scams. If our platform is used to further such illegal activities, our business, operating results, and financial condition could be adversely affected.”

Annual report 2025A · The company itself

“While we believe that our risk management and compliance framework is designed to detect significant illicit activities conducted by our potential or existing customers, we cannot ensure that we will be able to detect all illegal activity on our platform. Base Chain (formerly Base), an open source permissionless L2 protocol built on the Ethereum blockchain developed by us, has been in the past, and may in the future, be a target for scam tokens or other illegal activity.”

Annual report 2025A · The company itself

“Since smart contracts typically cannot be stopped or reversed, vulnerabilities in their programming and design can have damaging effects. For instance, in April 2018, a batch overflow bug was found in many Ethereum-based ERC20-compatible smart contract tokens that allowed hackers to create a large number of smart contract tokens, causing multiple crypto asset platforms worldwide to shut down ERC20-compatible token trading. Similarly, in March 2020, a design flaw in the MakerDAO smart contract caused forced liquidations of crypto assets at significantly discounted prices, resulting in millions of dollars of losses to users who had deposited crypto assets into the smart contract.”

Annual report 2025A · The company itself

“Although we have a broad array of information and operational security measures in place, our IT/OT Systems, including those of third-party service providers with whom we have contracted, including cloud-based software providers and manufacturing logistics providers, have been, and will likely continue to be, subject to computer viruses or other malicious codes, unauthorized access attempts, phishing and other cyberattacks. Cyberattacks and other cyber incidents are occurring more frequently, are constantly evolving in nature, are becoming more sophisticated and are being made by different threat actors including groups, individuals and nation states with a wide range of expertise and motives.”

Annual report 2025A · The company itself

“We cannot guarantee that our security efforts will prevent breaches or breakdowns of our or our third-party service providers’ IT/OT Systems because the techniques used in these attacks change frequently and may be difficult to detect for periods of time. In addition, although we have policies and procedures in place to ensure that all personal information collected by us or our third-party service providers is securely maintained, data leakages due to human error or intentional or unintentional conduct by our employees or third parties have occurred and likely will occur again.”

Annual report 2025A · The company itself

“Many groups on a worldwide basis have experienced increases in electronic security breaches, cyberattacks, and other hacking activities such as phishing attacks, denial of service, malware, ransomware, and cyber extortion, and there is the possibility of retaliatory cyberattacks, including by state-sponsored organizations. As with all large IT systems, we have been a target of cyberattackers and other hacking activities and our systems could be penetrated by increasingly sophisticated external or internal threat actors (including through the use of existing and emerging technologies, such as AI) intent on extracting confidential or proprietary information, corrupting our information, disrupting our business processes, engaging in the unauthorized use of strategic information about us or our employees, Customers, or consumers, or demanding monetary payment.”

Annual report 2026A · The company itself

“Such attacks are increasing in their frequency, levels of persistence, levels of sophistication and intensity, and are being conducted by sophisticated and organized groups and individuals with a wide range of motives and expertise, especially given increased vulnerability of corporate information technology systems as distributed work environments have become prevalent. In addition to unauthorized access to or acquisition of personal data, confidential information, intellectual property or other sensitive information, such attacks could include the deployment of harmful malware and ransomware, and may use a variety of methods, including denial-of-service attacks, social engineering and other means, to attain such unauthorized access or acquisition or otherwise affect service reliability and threaten the confidentiality, integrity and availability of information.”

Annual report 2025A · The company itself

“Our operations rely on the secure processing, transmission, and storage of confidential, proprietary and other information in our computer systems and networks. Our customers and other parties in the payments value chain rely on our digital technologies, computer and email systems, software, and networks to conduct their operations. In addition, to access our products and services, our customers increasingly use personal smartphones, tablet PCs, and other mobile devices that may be beyond our control. Information technology system disruptions, cyber-attacks, ransomware attacks, or other cyber security incidents could materially and adversely affect our reputation, operating results, or financial condition by, among other things, making our auction platform inoperable for a period of time, damaging our reputation with buyers, sellers, and insurance companies as a result of the unauthorized disclosure of confidential information (including account data information), or resulting in governmental investigations, litigation, liability, fines, or penalties against us.”

Annual report 2025A · The company itself

“Information technology dependency and cybersecurity vulnerabilities could lead to reduced revenue, liability claims, competitive or reputational harm, and result in material adverse effects on our operations and financial results The Company is dependent on information technology systems and infrastructure (“IT systems”) owned and operated by the Company or managed by third-party service providers, suppliers and contract manufacturers. IT systems enable us to conduct, monitor and/or protect our business, operations, systems, data and other assets.”

Annual report 2025A · The company itself

“Our IT systems, and those of our providers, may be vulnerable to compromise or disruption due to human error or malfeasance, outdated applications, computer viruses or malware (e.g., ransomware), natural disasters, unauthorized access, cyber-attacks and other similar incidents and disruptions. Inadequate account security or organizational security practices may also result in unauthorized access.”

Annual report 2025A · The company itself

“Risks related to information technology and security We are dependent on the efficient and uninterrupted operation of interconnected computer systems, telecommunications, data centers and call centers, including technology and network systems managed by multiple third parties, which could result in our inability to prevent disruptions in our services. Our ability to provide reliable service to customers, cardholders and other network participants depends upon uninterrupted operation of our data centers and call centers as well as third-party labor and services providers.”

Annual report 2025A · The company itself

“We may experience cybersecurity incidents, software defects, system errors, outages and development delays, which could damage customer relationships, decrease our profitability and expose us to liability. Our business depends heavily on the reliability, availability and security of proprietary and third-party processing systems and cloud infrastructure.”

Annual report 2025A · The company itself

“New or expanded disclosure or notification obligations could increase our compliance costs and exposure to enforcement or litigation following an incident. We may not be able to adequately protect our systems or the data we collect from continually evolving cybersecurity and data-protection risks, which could subject us to liability and damage our reputation.”

Annual report 2025A · The company itself

“In addition, the risk of cyber-attacks has increased in connection with the military and geopolitical conflicts around the world, including between Russia and Ukraine and within the Middle East. In light of those and other geopolitical events, nation-state actors or their supporters may launch retaliatory cyber-attacks and may attempt to cause supply chain and other third-party service provider disruptions, or take other geopolitically motivated retaliatory actions that may disrupt our business operations, result in data compromise, or both.”

Annual report 2025A · The company itself

“Criminals are using increasingly sophisticated methods to engage in illegal activities involving financial products, such as skimming and counterfeiting payment cards, account takeovers and identity theft. A single significant incident of fraud, or increases in the overall level of fraud, involving our cards and other products and services, could result in reputational damage to us, which could reduce the use and acceptance of our cards and other payment solutions and services or lead to greater regulation that would increase our compliance costs.”

Annual report 2025A · The company itself

“Business and/or supply chain disruptions may also be caused by security breaches, which could include, for example, ransomware attacks and attacks on information technology and infrastructure by hackers, viruses, breaches due to employee error or actions or other disruptions. Corteva and/or its suppliers may fail to effectively prevent, detect and recover from these or other security breaches and, as a consequence, such breaches could result in misuse of Corteva’s assets, business disruptions, loss of property including trade secrets and confidential business information, legal claims or proceedings, reporting errors, processing inefficiencies, negative media attention, loss of sales and interference with regulatory and data privacy compliance.”

Annual report 2025A · The company itself

“Despite these precautions, Corteva’s intellectual property is vulnerable to infringement, misappropriation and other unauthorized access, including through employee or licensee error or actions, theft and cybersecurity incidents, and other security breaches.”

Annual report 2025A · The company itself

“Cyberattacks and security vulnerabilities could result in material harm to our reputation, business, and financial condition. Our business relies on IT Systems and involves the generation, collection, storage, processing, and transmission of Confidential Information, including personal information and proprietary business information, by us and by third-party providers we rely on.”

Annual report 2025A · The company itself

“Numerous and evolving cybersecurity risks, including from diverse threat actors, such as state-sponsored organizations, opportunistic hackers and hacktivists, as well as through diverse attack vectors, such as advanced cyberattacks, phishing, social engineering schemes, malware (including ransomware), malfeasance by insiders, human or technological error, and as a result of bugs, misconfigurations, or exploited vulnerabilities in software or hardware, could threaten the confidentiality, availability, and integrity of Confidential Information and our IT systems.”

Annual report 2025A · The company itself

“In the past three years, we have not experienced a material cybersecurity incident, but any actual or perceived cybersecurity incidents or breaches of our security could result in any or all of the following, among other things, any of which could adversely affect our business and results of operations: •Interruption of our operations; •Unavailability of our systems or services; •Unauthorized or improper disclosures of data; •Unauthorized or improper payments; •Harm to our reputation and brands; •Data breach notification requirements, regulatory scrutiny, enforcement actions, legal proceedings and claims, (including class action lawsuits), and other legal and financial exposure; •Remediation, system restoration, incident response, and compliance costs; •Loss of customer confidence in, or decreased use of, our products and services; •Diversion of the attention of management from the operation of our business; and •Contractual penalties or other payments as a result of third-party losses or claims.”

Annual report 2025A · The company itself

“In addition, significant cyberattacks or data security breaches affecting companies that we acquire and/or that provide us services (including data center and cloud computing providers) could materially impact our business.”

Annual report 2025A · The company itself

“The payment methods that we offer also subject us to potential fraud and theft by criminals, who are becoming increasingly sophisticated, seeking to obtain unauthorized access to or exploit weaknesses that may exist in the payment systems. If we fail to comply with applicable rules or requirements for the payment methods we accept, or if payment-related data are compromised due to a breach of data, we may be liable for significant costs incurred by payment card issuing banks and other third parties or subject to fines and higher transaction fees, or our ability to accept or facilitate certain types of payments may be impaired.”

Annual report 2025A · The company itself

“Because we make extensive use of third-party service providers, such as cloud and SaaS services, significant cyberattacks that disrupt or result in unauthorized access to third-party IT Systems could materially impact our operations and financial results.”

Annual report 2025A · The company itself

“Given the high volume of transactions we process, it is important that we build strong resiliency to lessen disruption from events such as power outages, computer and telecommunications failures, viruses, internal or external security breaches and other cybersecurity incidents, errors by employees, extreme weather, and catastrophic events. Any debilitating failure of our critical IT systems, data centers and backup systems would require significant investments in resources to restore services and may cause serious impairment in our business operations, including loss of business services, increased cost of moving merchandise and failure to provide service to our members.”

Annual report 2025A · The company itself

“This could adversely affect our competitiveness, results of operations and financial condition and, critically in light of our business model, loss of member confidence.”

Annual report 2025A · The company itself

“However, we have faced attempted cyber-attacks and are likely to face future cyber-attacks, including malware or ransomware attacks, or suffer other human or technological errors that have a material impact. Breaches, significant IT interruptions or errors could disrupt production software, permit manipulation of financial data, and could lead to corruption or theft of sensitive data that we collect and retain about our customers, suppliers, employees, and business performance.”

Annual report 2025A · The company itself

“We rely on specialist third-parties to provide many of our information and operational technology systems, and vulnerabilities within such third-party systems could have a material negative effect on us. The third-parties on whom we rely may themselves be affected by cybersecurity breaches or failures, which could lead to operational disruption or other negative consequences that could adversely impact our own business and financial condition.”

Annual report 2025A · The company itself

“•Our sales cycles can be long and unpredictable, and our sales efforts require considerable time and expense. •We face intense competition and could lose market share to our competitors, which could adversely affect our business, financial condition, and results of operations. •If our solutions fail or are perceived to fail to detect or prevent incidents or have or are perceived to have defects, errors, or vulnerabilities, our brand and reputation would be harmed, which would adversely affect our business and results of operations. •As a cybersecurity provider, we have been, and expect to continue to be, a target of cyberattacks.”

Annual report 2026A · The company itself

“If our or our service providers’ internal networks, systems, or data are or are perceived to have been compromised, our reputation may be damaged and our financial results may be negatively affected.”

Annual report 2026A · The company itself

“Because we host customer data on our cloud platform, which in some cases may contain personally-identifiable information or potentially confidential information, a security compromise, or an accidental or intentional misconfiguration or malfunction of our platform or third-party platforms, could result in personally-identifiable 27 Table of Contents information and other customer data being accessible such as to attackers or to other customers.”

Annual report 2026A · The company itself

“We and our vendors have experienced and continue to experience cyberattacks. We can provide no assurance that we or our vendors will be able to detect, prevent or contain the effects of such attacks or other information security (including cybersecurity) risks or threats in the future. We and our vendors have experienced diverse cyberattacks and expect to continue to experience cyberattacks going forward.”

Annual report 2025A · The company itself

“A compromise of our information security controls or of those third parties with whom we interact, which results in business disruption or confidential information being accessed, obtained, damaged, or used by unauthorized or improper persons, could harm our reputation and expose us to regulatory actions and claims from customers and clients, financial institutions, payment card associations and other persons, any of which could adversely affect our businesses, operating results and financial condition.”

Annual report 2025A · The company itself

“The sale of proprietary products subjects us to unique risks including potential product liability risks, mandatory or voluntary product recalls, potential supply chain and distribution chain disruptions for raw materials and finished products, our ability to successfully protect our intellectual property rights and the rights of applicable third parties, and other risks generally encountered by entities that source, market and sell private-label products. We also face similar risks for the other products we sell in our retail operations, including supply chain and distribution chain disruption risk.”

Annual report 2025A · The company itself

“Ransomware attacks, including those from organized criminal threat actors, nation-states and nation-state supported actors, are prevalent and can lead to significant interruptions, delays, or outages in our operations, loss of data (including customer data), loss of income, significant extra expenses to restore data or systems, reputational loss and the diversion of funds.”

Annual report 2025A · The company itself

“The incident adversely impacted our billing and revenue collection cycles, our ability to accept new patients and our ability to perform certain business functions and, as a result, we continue to incur expenses and experience lost revenue as a result of the incident.”

Annual report 2025A · The company itself

“Any security breach involving the misappropriation, loss or other unauthorized disclosure or use of confidential information, including, among others, PHI, PII, financial data, competitively sensitive information, trade secrets or other proprietary data, whether by us or a third party, could have a material adverse effect on our business, results of operations, financial condition, and cash flows and could materially harm our reputation.”

Annual report 2025A · The company itself

“As malicious cyber activity escalates, including activity that originates outside of the U.S., and as we continue with certain remote work arrangements and a broadened technology footprint, the risks we face relating to the transmission, storage and processing of data within our network and our use of service providers outside of our network have intensified.”

Annual report 2025A · The company itself

“Our business, profitability and growth prospects could suffer if we face negative publicity or we pay damages or defense costs in connection with a claim that is outside the scope or limits of coverage of any applicable insurance coverage, including, without limitation, claims related to adverse patient events, cybersecurity incidents, contractual disputes, antitrust and competition laws and regulations, government and internal investigations, professional and general liability and directors' and officers' duties.”

Annual report 2025A · The company itself

“Security incidents, including cyber-attacks, could disrupt our operations and result in the compromise of networks, systems, and assets, and the breach or loss of proprietary, personal, or confidential information of our company or of our workforce, customers, partners, or third parties. We routinely receive, collect, manage, store, transmit, and process large amounts of proprietary information and confidential data, including personally identifiable and other sensitive information, relating to our operations, products, partners, vendors, and customers.”

Annual report 2026A · The company itself

“We face numerous sophisticated and evolving cyber threats of significant scale, volume, severity, and complexity, including threats specifically designed for or directly targeted at us, making it increasingly difficult to defend against security incidents successfully or to implement adequate preventative measures. Our cybersecurity program may not always successfully manage or mitigate the effects of these risks.”

Annual report 2026A · The company itself

“Despite our cybersecurity governance and investment in controls and security measures, threat actors, including nation states and state-sponsored organizations, pose a significant risk of penetrating or bypassing our security defenses, including by utilizing insider threat tactics, deploying AI tools against our defenses, breaching our information technology systems, and misappropriating or compromising confidential and proprietary information of our company, partners, vendors, or customers, causing system disruptions and shutdowns, introducing ransomware, malware, or vulnerabilities into our products, systems, and networks or those of our customers, partners or vendors, or accessing systems and networks of our customers, partners or vendors through connectivity to or credentials taken from our network.”

Annual report 2026A · The company itself

“We anticipate that our systems, networks, and employees will continue to be targeted by criminal and other threat actors with increasing frequency and potential harm. We expect attacks by nation state actors and their agents to intensify during periods of geopolitical conflict.”

Annual report 2026A · The company itself

“We depend on our information technology and manufacturing infrastructure to achieve our business objectives. Natural disasters, manufacturing failures, telecommunications system failures, or defective or improperly installed new or upgraded business management systems could lead to disruptions in this infrastructure.”

Annual report 2026A · The company itself

“Breaches or lapses in the security of the technology systems we use and rely on could compromise the data stored within them and consequently disrupt our operations, damage our reputation and expose us to liability, any or all of which could have a material adverse effect on our business.”

Annual report 2025A · The company itself

“We expect unauthorized parties to continue attempting to gain access to our systems or information, or those of our business partners and third-party service providers, including through fraud or other means of deception, or introduction of malicious code, such as malware and ransomware. If successful, these actions could cause harm to our computer systems or compromise data stored on our computer networks or those of our business partners and third-party service providers, potentially causing us to incur remedial, legal and other costs, which could be material.”

Annual report 2025A · The company itself

“Threat actors are also increasingly leveraging advanced technologies, including the use of AI and automated tools, to enhance the scale, speed and effectiveness of cyberattacks.”

Annual report 2025A · The company itself

“We are also subject to evolving global privacy and security regulatory obligations and an increasing customer focus on privacy issues and data security in the United States and abroad, as well as to geopolitical risks associated with international data transfer.”

Annual report 2025A · The company itself

“While we have initiatives and disaster recovery plans in place to prevent or mitigate disruptions, we have experienced a significant disruption in the past, such as the global outage caused by a faulty update by cybersecurity vendor CrowdStrike in July 2024 that resulted in global information technology outages of Windows-based systems and significantly affected our information technology systems, disrupting our operations.”

Annual report 2025A · The company itself

“•Cybersecurity risks and cyber incidents could result in the compromise of confidential data or critical data systems and give rise to potential harm to customers, remediation and other expenses, expose us to liability under HIPAA, consumer protection laws, or other common law theories, subject us to litigation and federal and state governmental inquiries, damage our reputation, and otherwise be disruptive to our business and operations. •We conduct business in a heavily regulated industry and if we fail to comply with applicable laws and government regulations, we could become subject to penalties, be excluded from participation in government programs, and/or be required to make significant changes to our operations. •Managed care trends and consolidation in the health care industry could have an adverse effect on our revenues and results of operations.”

Annual report 2025A · The company itself

“Cybersecurity risks and cyber incidents could result in the compromise of confidential data or critical data systems and give rise to potential harm to customers, remediation and other expenses, expose us to liability under HIPAA, consumer protection laws, or other common law theories, subject us to litigation and federal and state governmental inquiries, damage our reputation, and otherwise be disruptive to our business and operations. There are numerous and evolving risks to our cybersecurity and privacy from cyber threat actors. These cyber threat actors, whether internal of external to Dexcom, are becoming more frequent, sophisticated and coordinated in their attempts to access data, including, without limitation, malicious software; data privacy breaches by employees, insiders or others with authorized access; cyber or phishing-attacks; ransomware; attempts to gain unauthorized access to our data and systems; vendor breaches or supply chain attacks; and other electronic security breaches.”

Annual report 2025A · The company itself

“We are and may continue to be subject to cybersecurity incidents that bypass our security measures. Such incidents may impact the integrity, availability or privacy of personal health information or other data subject to privacy laws or disrupt our information systems, devices or business, including our ability to deliver services to our customers.”

Annual report 2025A · The company itself

“Our information technology systems, some of which are managed by third parties, may be susceptible to damage, disruptions or shutdowns due to computer viruses, denial-of-service attacks, phishing attacks, ransomware or other malware, attacks by computer hackers (including nation states or state-sponsored organizations), failures during the process of upgrading or replacing software, databases or components thereof, power outages, hardware failures, telecommunication failures, user errors, natural disasters, terrorist attacks, the outbreak of wars or other armed conflicts, or catastrophic events.”

Annual report 2025A · The company itself

“These same features may also increase cybersecurity risks and the risks of unauthorized access and use by third parties. As such, a cyberattack which intrudes, disrupts, or corrupts our devices, products, and services, or related devices, products, and services could impact the quality-of-care patients receive or the confidentiality of patient information.”

Annual report 2025A · The company itself

“Resterande obligationsskuld om 286,2 MSEK, har omklassificerats från långfristig till kortfristig skuld, då den förfaller i maj 2025. • Aurdel utsattes för ett IT-intrång den 26 september, vilket medförde en negativ resultateffekt på ca 4,3 MSEK från minskad försäljning och kostnader för externa ITsäkerhetskonsulter.”

Annual report 2024A · The company itself

“Aurdel utsattes i slutet av september 2024 för en hackerattack som lyckligtvis enbart satte stopp för verksamheten under sex dagar. Även om det innebar lite tappad försäljning så har det fört med sig en förbättrad förberedelse och skydd mot attacker i framtiden genom de säkerhetsuppdateringar som då genomfördes.”

Annual report 2024A · The company itself

“While we have implemented procedures and technology intended to protect such information and require appropriate controls of our vendors, external attackers could compromise such controls and result in unauthorized disclosure of such information, as attacks are becoming increasingly sophisticated, may include attacks on our third-party business partners, and do not always or immediately produce detectable indicators of compromise. Moreover, inadvertent or malicious internal personnel actions could result in a defeat of security measures and a compromise of our or our third-party vendors’ information systems.”

Annual report 2026A · The company itself

“Such systems are subject to damage or interruption from power surges and outages, facility damage, physical theft, computer and telecommunications failures, inadequate or ineffective redundancy, malicious code (including malware, ransomware, or similar), successful attacks (e.g., account compromise; phishing; denial of service; and application, network or system vulnerability exploitation), software upgrade failures or code defects, natural disasters and human error. Due to the political tensions involving China, the conflict between Russia and Ukraine and the conflict in the Middle East, there is an increased likelihood that escalation of tensions could result in cyberattacks that could either directly or indirectly impact our operations.”

Annual report 2026A · The company itself

“This may be as the result of deliberate breach in the security of these systems or platforms by bad actors, including through malicious software, ransomware and other cyberattacks, which may originate from state actors and may increase during times of international tensions.”

Annual report 2026A · The company itself

“The potential unauthorized access to our systems could disrupt operations or lead to the theft of data which may violate privacy laws and could damage our business reputation, subject us to negative publicity, litigation and costs, and adversely affect our results of operations or financial condition. Many of our information technology systems, such as those we use for our point-of-sale, web and mobile platforms, including online and mobile payment systems, and for administrative functions, including human resources, payroll, benefits, accounting, and internal and external communications, contain personal, financial, health-related or other confidential information that is entrusted to us by our customers and associates as well as proprietary and other confidential information related to our business and suppliers.”

Annual report 2026A · The company itself

“Although we have processes and procedures in place designed to manage and mitigate cybersecurity risk, our business is still subject to certain risks. We depend on our own and third party information systems, including cloud-based systems and managed service providers, to store, process and protect our information and support our business activities.”

Annual report 2025A · The company itself

“The disruption of our global supply chain for any reason, including for issues such as public health crises, health epidemics or global pandemics, labor disputes, loss of single source or limited source supplier, inability to procure sufficient raw materials, quality control issues, ethical sourcing issues, discontinuity or disruption in our internal information and data systems or those of our suppliers, cybersecurity incidents including but not limited to ransomware attacks, misuse of artificial intelligence and machine learning technologies, a supplier's financial distress, natural disasters, looting, vandalism or acts of war or terrorism, trade sanctions, tariffs or other external factors over which we have no control, could interrupt product supply and, if not effectively managed and remedied, have a material adverse impact on our business operations, financial condition and results of operations.”

Annual report 2025A · The company itself

“Geopolitical tensions or conflicts, such as Russia’s invasion of Ukraine, may further heighten the risk of cybersecurity attacks. While we have continually matured our security program and capabilities and have had no material incidents to date, cyber threats continue to evolve, such as with the use of artificial intelligence, resulting in sophisticated new attack methods that are increasingly automated, targeted, and difficult to defend against, and there can be no assurance that our efforts will prevent cybersecurity attacks or breaches in our systems or in the systems of strategic vendors, including cloud providers, that could cause reputational damage, business disruption or legal and regulatory costs; could result in third-party claims; could result in compromise or misappropriation of our intellectual property, trade secrets or sensitive information; or could otherwise materially adversely affect our business, including our business strategy, results of operations, or financial condition.”

Annual report 2025A · The company itself

“Our facilities and systems, and those of our third-party service providers, including our business associates, are regularly the target of, and may be vulnerable to, cyber-attacks, security breaches, acts of vandalism, computer viruses, misplaced or lost data, programming and/or human errors, negligent or wrongful conduct by associates or others with permitted access to our systems and information, or other threats or catastrophic events.”

Annual report 2025A · The company itself

“We cannot ensure that we or our third-party service providers will be able to identify, prevent or contain the effects of cyber-attacks or other cybersecurity risks that bypass our or their security measures or disrupt our or their information technology systems or business. Hardware, software or applications we develop or procure from third parties may contain defects in design, manufacturer defects or other problems that could unexpectedly compromise information security.”

Annual report 2025A · The company itself

“Terrorist attacks and sabotage, physical attacks, cyber attacks, system failures, data breaches or other disruptions of Entergy’s and its subsidiaries’ or their suppliers’ infrastructure or technology systems, including disruptions affecting other third parties ultimately connected to Entergy and its subsidiaries or their suppliers through the transmission grid, may adversely affect Entergy’s business and results of operations. As an operator of critical infrastructure, Entergy and its subsidiaries face a heightened risk of physical attacks or acts or threats of terrorism, cyber attacks, including ransomware and phishing attacks, business email compromises, viruses, malicious code, and data breaches, whether as a direct or indirect act against one of Entergy’s generation, transmission or distribution facilities, operations centers, infrastructure, or information technology systems used to manage, monitor, and transport power to customers and perform day-to-day business functions as well as against the systems of critical suppliers and contractors or other third parties interconnected through the grid.”

Annual report 2025A · The company itself

“Given the fraught geopolitical landscape and rapid technological advancements of existing and emerging threats, including threats fueled by artificial intelligence, Entergy’s technology systems remain inherently vulnerable despite implementations and enhancements of the multiple layers of security and controls.”

Annual report 2025A · The company itself

“We are regularly involved in claims, suits, government investigations, enforcement actions and regulatory proceedings arising from the ordinary course of our business, including actions with respect to consumer protection and data protection, including purported class action lawsuits.”

Annual report 2025A · The company itself

“If we experience additional significant compromises of our security measures, including from incidents that we fail to detect for a period of time, sensitive data may be accessed, stolen, disclosed, altered or lost. Any such access, disclosure, alteration or other loss of information could subject us to significant litigation, regulatory fines or penalties, any of which could have a material adverse effect on our cash flows, competitive position, financial condition or results of operations.”

Annual report 2025A · The company itself

“Risks Related to our Operations •Any failure of our physical infrastructure or negative impact on our ability to meet our obligations to our customers, or damage to customer infrastructure within our IBX data centers, could lead to significant costs and disruptions that could reduce our revenue and harm our business reputation and financial condition. •We experienced cybersecurity incidents in the past and may be vulnerable to future security breaches, which could disrupt our operations and have a material adverse effect on our business, results of operation and financial condition. •We are currently making significant investments in our back-office information technology systems and processes.”

Annual report 2025A · The company itself

“Problems at one or more of our IBX data centers or corporate offices, whether or not within our control, could result in service interruptions or significant infrastructure or equipment damage. These could result from numerous factors, including but not limited to: •human error; •equipment failure; •physical, electronic and cybersecurity breaches; •fire, earthquake, hurricane, flood, tornado and other natural disasters; •extreme temperatures; •water damage; •fiber failures, subsea cable damage and other network damage/interruptions; •software updates; •power loss; •terrorist acts; •sabotage and vandalism; •insider threat; •global pandemics; •inability of our operations employees to access our IBX data centers for any reason; and •failure of business partners who provide our resale products.”

Annual report 2025A · The company itself

“We experienced cybersecurity incidents in the past and may be vulnerable to future security breaches, which could disrupt our operations and have a material adverse effect on our business, results of operation and financial condition. Despite our efforts to protect against cyber-attacks, we are not fully insulated from such threats. We have experienced cybersecurity attacks and security incidents to varying degrees, and in some cases threat actors have gained unauthorized access to our systems and data.”

Annual report 2025A · The company itself

“If we experience difficulties with technology, data or network security, including those that could result from cyber attacks, third-party relationships or cloud-based relationships, our ability to conduct our business could be adversely impacted.”

Annual report 2025A · The company itself

“Our systems regularly face cyber threats, which can create significant risks such as destruction of systems or data, denial or interruption of service, disruption of transaction execution, loss or exposure of customer data, theft or exposure of our intellectual property, theft of funds or disruption of other important business functions.”

Annual report 2025A · The company itself

“Even with appropriate governance and controls, the use of artificial intelligence may increase our exposure to cyber threats.”

Annual report 2025A · The company itself

“Our interactions with, and reliance upon, third parties, including our independent agents, expose us to increased risk related to data security, service disruptions or effectiveness of our control system, particularly as we increase our reliance on cloud-based computing and software-as-a-service from third parties to operate our business.”

Annual report 2025A · The company itself

“In addition, we are subject to numerous federal and state laws relating to the privacy and security of nonpublic personal information and other sensitive information of our customers, employees and others. The improper access, disclosure, misuse or mishandling of such information could result in legal liability, regulatory action and reputational damage.”

Annual report 2025A · The company itself

“The number, complexity, and sophistication of cyber threats continue to increase over time.”

Annual report 2025A · The company itself

“If events occurred causing interruption of our operations, facilities, systems or business functions, it could have a material adverse effect on our operations and financial results. We have established business continuity and disaster recovery plans to provide for the continuation of core business operations in the event that normal business operations could not be performed due to catastrophic or other events, including pandemics and cyber attacks.”

Annual report 2025A · The company itself

“Any material failure, inadequacy, interruption or breach of the Company’s privacy or information systems, or those of our vendors or other third parties, could materially adversely affect the Company’s business, financial condition and results of operations. We rely on information technology hardware, software, networks and systems (collectively, “IT Systems”), some of which are provided by vendors, to process, transmit and store personal information, tenant and lease data, and other electronic information (collectively, “Confidential Information”), and to manage or support a variety of business processes, including financial transactions and records.”

Annual report 2025A · The company itself

“Potential other consequences include exposure to litigation, including government enforcement actions, private litigation (including class actions), fines or criminal penalties, negative reputational impacts that cause us to lose existing or future customers, and/or significant incident response, system restoration or remediation and future compliance costs, and potential exposure to a risk of loss including loss related to the fact that agreements with such vendors, or such vendors’ financial condition, may not allow the Company to recover all costs related to a cybersecurity incident for which they alone or they and the Company should be jointly responsible for, which could result in a material adverse effect on the Company’s business, financial condition and results of operations.”

Annual report 2025A · The company itself

“Additionally, remote and hybrid working arrangements at our company (and at many third-party providers) also increase cybersecurity risks due to the challenges associated with managing remote computing assets and security vulnerabilities that are present in many non-corporate and home networks. We may be unable to comprehensively apply patches or confirm that measures are in place to mitigate all such vulnerabilities, or that patches will be applied before vulnerabilities are exploited by a threat actor.”

Annual report 2025A · The company itself

“Finally, in the future, the Company may expend additional resources to continue to enhance the Company’s cybersecurity measures to investigate and remediate any cybersecurity vulnerabilities and/or to further ensure compliance with privacy and cybersecurity laws.”

Annual report 2025A · The company itself

“Cyber Incident On October 15, 2025, we disclosed a security incident in which a threat actor maintained long-term, persistent access to F5 systems, and exfiltrated certain files, referred to as the "Cyber Incident." For further information about the Cyber Incident, see "Risk Factors" included in Item 1A of Part I of this Annual Report on Form 10-K, and "Management’s Discussion and Analysis of Financial Condition and Results of Operations - Cyber Incident" included in Item 7 of Part II of this Annual Report on Form 10-K.”

Annual report 2025A · The company itself

“Further, we could face litigation in connection with the Cyber Incident.”

Annual report 2025A · The company itself

“Interruptions in the proper functioning of information systems or the inability to maintain or upgrade our information systems, or convert to alternate systems in a timely and efficient manner, could disrupt operations, cause unanticipated increases in costs and/or decreases in sales, and result in less efficient operations. The proper functioning of our information systems is critical to many aspects of our business and we could be adversely affected if we experience a disruption or data loss relating to our information systems and are unable to recover in a timely manner.”

Annual report 2025A · The company itself

“Cybersecurity incidents, or violations of data privacy laws and regulations, could cause us to experience certain operational interruptions, incur substantial additional costs, become subject to legal or regulatory proceedings, or suffer damage to our reputation in the marketplace. The nature of our business requires us to receive, retain, and transmit certain personally identifying information that our customers provide to purchase products or services, register on our websites, or otherwise communicate and interact with us.”

Annual report 2025A · The company itself

“A significant data breach or other disruption to our technology infrastructure could disrupt our operations and result in the loss of critical sensitive or confidential information, adversely affecting our reputation, business, or results of operations.”

Annual report 2026A · The company itself

“We are subject to risks imposed by data breaches and operational disruptions, both random and targeted, including through cyberattack or cyber-intrusion, ransomware attack, malware attack, or denial-of-service attack by computer hackers, foreign governments and state-sponsored actors, cyber terrorists and hacktivists, cyber criminals, malicious employees or other insiders of Federal Express or third-party service providers, and other groups and individuals. Data breaches and other technological disruptions of companies and governments continue to increase as the number, intensity, and sophistication of attempted attacks and intrusions from around the world have increased and we, our customers, and third parties increasingly store and transmit data by means of connected information technology systems.”

Annual report 2026A · The company itself

“The rapid evolution and increased sophistication, availability, and use of emerging technologies such as AI technologies and machine learning by us, our customers, suppliers, business partners, third-party providers, and bad actors may increase the likelihood of the occurrence of data breaches and operational disruptions.”

Annual report 2026A · The company itself

“From time to time we experience disruptions to our complex, global technology infrastructure, including our computer systems and websites. Such events could result in the loss of confidential business or customer information; require substantial repairs or replacements, resulting in significant costs; and lead to the temporary or permanent transfer by customers of some or all of their business to our competitors.”

Annual report 2026A · The company itself

“Given the age, size, and complexity of our network environment, operational technology, and computer systems, patches for certain vulnerabilities may not exist and, even where patches or other risk-mitigating activities are available, the development of patches or execution of risk-mitigating actions may not occur before an underlying vulnerability is exploited and results in the disruption of our operations or compromise of our information systems or data. A significant number of our employees as well as customers and others with whom we do business continue to work remotely or in hybrid models, which may heighten these risks.”

Annual report 2026A · The company itself

“We also depend on and interact with the technology and systems of third parties for a variety of reasons, including AI-enabled technologies, encryption and authentication technology, employee email, and other communication technologies, cloud services, delivery services, back-office support, and other functions. Certain third parties host, process, or have access to information we maintain about our company, customers, employees, and vendors and/or operate systems that are critical to our business operations and services. Like us, these third parties are subject to risks imposed by data breaches, cyberattacks, and other events or actions that could damage, disrupt, or close their networks or systems.”

Annual report 2026A · The company itself

“Increasingly sophisticated cyber-attacks, ransomware, and other security breaches—whether targeting us or third parties with whom we do business—could disrupt operations, compromise confidential information, and result in significant financial, legal, and reputational harm. Cybersecurity threats, including those that exploit advances in technologies such as artificial intelligence, continue to grow in frequency and sophistication, and the security controls we implement may not fully prevent or detect all such threats or incidents. Emerging artificial intelligence technologies may be used to develop new hacking tools, obscure malicious activities, exploit vulnerabilities, and increase the difficulty of detecting threats. Despite ongoing investments in cybersecurity, we cannot guarantee prevention or timely detection of all threats, which continue to evolve and may be amplified by interconnected systems.”

Annual report 2025A · The company itself

“A successful attack or breach could lead to service interruptions, regulatory penalties, litigation, remediation costs, and loss of customer trust. Any such cyber incident could result in significant lost revenue, the inability to conduct critical business functions and serve customers for a significant period of time, the loss of confidential, sensitive and proprietary information, including but not limited to personal information of our customers, employees, suppliers, vendors and other third parties, the use of significant management resources, legal claims or proceedings, regulatory penalties, significant remediation costs, increased regulation, increased capital costs, increased insurance costs, increased protection costs for enhanced cybersecurity systems or personnel, and/or damage to our reputation, all of which could materially adversely affect our business, results of operations, financial condition and reputation.”

Annual report 2025A · The company itself

“Also, FirstEnergy, or its vendors and service providers, may be at an increased risk of a cyber-attack and/or data security breach due to the nature of its business. Any such cyber incident could result in significant lost revenue, the inability to conduct critical business functions and serve customers for a significant period of time, the use of significant management resources, legal claims or proceedings, regulatory penalties, significant remediation costs, increased regulation, increased capital costs, increased protection costs for enhanced cyber security systems or personnel, damage to FirstEnergy's reputation and/or the rendering of its internal controls ineffective, all of which could materially adversely affect FirstEnergy's business, results of operations, financial condition and reputation.”

Annual report 2025A · The company itself

“Operational information systems, security systems, products, and services could be affected by cybersecurity incidents, ransomware attacks, and other disruptions and impact Ford, Ford Credit, their suppliers, and dealers. We rely on information technology networks and information systems, including in-vehicle systems and mobile devices, some of which are managed by suppliers, some of which are provided by third-party service providers, and some of which ultimately rely on other services provided to these third parties by unaffiliated service providers, to process, transmit, and store electronic information that is important to the operation of our business, our vehicles, and the services we offer.”

Annual report 2025A · The company itself

“Table of Contents •If our internal enterprise IT networks, our operational networks, our research and development networks, our back-end labs and cloud stacks hosted in our data centers or PoPs, colocation vendors or public cloud providers are compromised, public perception of our products and services may be harmed, our customers may be breached and harmed, we may become subject to liability, and our business, operating results and stock price may be adversely impacted. •We have incurred indebtedness and may incur other debt in the future, which may adversely affect our financial condition and future financial results. •We generate a majority of billings, revenue and cash flow from sales outside of the United States, which may expose us to risks associated with international operations and may adversely affect our business, financial condition and results of operations.”

Annual report 2025A · The company itself

“Additionally, if our channel partners experience issues such as cyberattacks or other operational disruptions, it could negatively impact our ability to receive orders from them and, among other things, may adversely affect our billings and revenue.”

Annual report 2025A · The company itself

“If we are unable to maintain an effective supply chain security risk management and products security program or we inadvertently release a product or an update to a product with a defect in it, then the security and integrity of our products and the updates to those products that our customers receive could be exploited by third parties or insiders, or our solutions or updates thereto could cause an unintended disruption to our customers’ operations.”

Annual report 2025A · The company itself

“Despite our efforts and processes to prevent breaches of our internal networks, systems and websites, whether in our owned data centers, cloud providers or colocations, we are still vulnerable to computer viruses, break-ins, phishing attacks, ransomware attacks, attempts to overload our servers with denial-of-service, vulnerabilities in vendor hardware and software that we leverage, advanced persistent threats from sophisticated actors and other cyberattacks and similar disruptions from unauthorized access to our internal networks, systems or websites, whether in our owned data centers, cloud providers or colocations.”

Annual report 2025A · The company itself

“For example, from time to time, we have discovered that unauthorized parties have targeted us using sophisticated techniques, including by stealing technical data and attempting to steal private encryption keys, in an effort to both impersonate our products and threat intelligence update services and possibly attempt other attack methodologies. Using these techniques, these unauthorized parties have tried, and may in the future try, to gain access to certain of our and our customers’ systems.”

Annual report 2025A · The company itself

“Failure to establish adequate controls and risk management policies, or the circumvention of controls and policies, could have an adverse effect on our global operations, reputation and financial position. Although we have adopted risk management, operational and financial controls and compliance policies, procedures and programs that are subject to regular review and update, we cannot ensure that these measures will enable us effectively to identify and manage internal and external risks including those related to fraudulent activity and dishonesty.”

Annual report 2025A · The company itself

“We may be adversely affected if any of our third-party providers is subject to a successful cyber or security attack. Due to our interconnectivity with and dependency upon third-party providers, including, for example, advisors, central agents, exchanges, clearing organizations, other financial institutions, and other service providers supporting our business and technology needs, we may be adversely affected if any of them is subject to a successful cyber attack or other privacy or information security event or disruption.”

Annual report 2025A · The company itself

“Any significant limitation, failure or security breach of our information and cybersecurity infrastructure, software applications, technology or other systems, or those of our third-party providers, that are critical to our operations could disrupt our business and harm our operations, financial condition, and reputation. We are highly dependent upon the use of various proprietary and third-party information and security technology, software applications, external third-party services and other technology systems, and remote equipment and connectivity infrastructure, to access critical business systems necessary to operate our business.”

Annual report 2025A · The company itself

“We routinely face risks of cybersecurity incidents, whether through attempted or actual: cyber-attacks or cyber intrusions, ransomware and other forms of malware, computer viruses, attachments to emails, individual or brand impersonation, phishing, extortion or other scams.”

Annual report 2025A · The company itself

“•Our solutions, systems, websites and the data on these sources have been and may continue to be subject to cybersecurity events that could materially harm our reputation and future sales.”

Annual report 2026A · The company itself

“Other Business and Operational Risks Our business could be negatively impacted by cybersecurity events and other disruptions. We face various cybersecurity threats, including threats to our IT infrastructure and attempts to gain unauthorized access to our proprietary or classified information, denial-of-service attacks, as well as threats to the physical security of our facilities and employees, and threats from terrorist acts.”

Annual report 2025A · The company itself

“Despite our implementation of various security measures, our IT systems and operations (and the third-party IT systems and operations with which we interact) could be subject to damage or interruption from computer viruses, natural disasters, unauthorized physical or electronic access, power outages, telecommunications failure, computer system or network failures, wire transfer failure, employee error/malfeasance, cyber-attacks, security breaches, and other similar disruptions.”

Annual report 2025A · The company itself

“Furthermore, such a disruption may harm our reputation and business prospects and subject us to legal claims if there is loss, disclosure or misappropriation of or access to our customers, employees or suppliers' information.”

Annual report 2025A · The company itself

“Cybersecurity attacks and incidents are increasing in their frequency, sophistication and intensity. Malicious actors seek to steal money, gain unauthorized access to, destroy or manipulate data, and disrupt operations, and some of their attacks may not be recognized or discovered until after a significant period of time well after initial entry into the environment, such as novel or zero-day attacks that are launched before patches are available and defenses can be readied.”

Annual report 2025A · The company itself

“Non-compliance with laws or regulations related to customer and consumer privacy and information security, including a failure to ensure that third parties with access to sensitive customer and consumer information maintain its confidentiality, could materially adversely affect our reputation and business operations. The collection, maintenance, use, disclosure, and disposal of personally identifiable information by our insurance subsidiaries are regulated at the international, federal, and state levels. Applicable laws and rules are subject to change by legislation or administrative or judicial interpretation.”

Annual report 2025A · The company itself

“Further, identity fraud may increase and credit reporting practices may change in a manner that makes it more difficult for financial institutions, such as us, to evaluate the creditworthiness of consumers. In connection with our transaction banking activities, we face compliance, legal and regulatory risk, including with respect to know-your-customer, anti-money laundering and reporting requirements and prohibitions on transfers of property belonging to countries, entities and individuals subject to sanctions by U.S. or other governmental authorities.”

Annual report 2025A · The company itself

“Cybersecurity Risk Management Overview Cybersecurity risk is the risk of compromising the confidentiality, integrity or availability of our data and systems, leading to an adverse impact to us, our reputation, our clients and/or the broader financial system.”

Annual report 2025A · The company itself

“During 2025, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.”

Annual report 2025A · The company itself

“Third-party risk, including vendor risk, is the risk of an adverse impact due to reliance on third parties performing services or activities on our behalf. These risks may include legal, regulatory, information security, cybersecurity, reputational, operational or other risks inherent in engaging a third party.”

Annual report 2025A · The company itself

“Som følge av den urolige geopolitiske situasjonen opplever Gyldendal et komplekst digitalt trusselbilde, med økt omfang av sofistikerte sikkerhetstrusler fra ulike aktører.”

Annual report 2024A · The company itself

“We are increasingly dependent on digital technologies and services to conduct our business. We use these technologies for internal and operational purposes, including data storage, processing, and transmissions, as well as in our interactions with customers and suppliers. Examples of these digital technologies include analytics, automation, and cloud services. Our digital technologies and services, and those of our customers and suppliers, are subject to the risk of cybersecurity incidents and, given the nature of such incidents, some can remain undetected for a period of time despite efforts to detect and respond to them in a timely manner.”

Annual report 2025A · The company itself

“Nevertheless, we have experienced cybersecurity incidents and attempted breaches in the past, one of which resulted in an unauthorized third party gaining access to certain of our systems and exfiltrating information from those systems, which we previously disclosed in Form 8-Ks we filed with the SEC on August 23, 2024 and September 3, 2024. The incident caused disruptions and limitation of access to portions of our business applications supporting aspects of our operations and corporate functions, required us to incur significant costs, and required a significant amount of attention from management and our workforce.”

Annual report 2025A · The company itself

“Potentiell negativ påverkan Möjliga dataläckage av känslig kundinformation riskerar finansiella konsekvenser för såväl HANZA som kunder och därmed deras anställda och ägare.”

Annual report 2024A · The company itself

“Risk Dataintrång som ger upphov till förlorade data eller skadlig programvara med krav på lösensumma kan skada kunders förtroende för HANZA med intäktsförluster som följd. Intrång bidrar även till interna kostnader från produktionsuppehåll.”

Annual report 2024A · The company itself

“Risk för störningar i produktionen – HANZAs produktionsverksamhet består av en kedja av processer där avbrott eller störningar, till exempel till följd av brand, sabotage, maskinhaveri eller it-haveri, i något led skulle kunna få konsekvenser för HANZAs förmåga att framställa bolagets produkter i den omfattning och takt de efterfrågas. Sådana avbrott skulle negativt kunna påverka bolagets verksamhet, finansiella ställning och resultat.”

Annual report 2024A · The company itself

“Risks related to technology, data privacy and cybersecurity: Cybersecurity incidents or other forms of data breaches could result in the compromise of our facilities, confidential data or critical data systems, causing our operations to be impaired or impacted. A cybersecurity incident or other form of data breach could also give rise to potential harm to patients; remediation and other expenses; and exposure to liability under privacy and security laws, consumer protection laws, common law theories or other laws. Such incidents could subject us to litigation and foreign, federal and state governmental inquiries, damage our reputation, and otherwise be disruptive to our business.”

Annual report 2025A · The company itself

“We, directly and through our vendors and other third parties, collect and store on networks, devices and technology platforms sensitive information, including intellectual property, proprietary business information, protected health information of our patients and personally identifiable information of our employees, patients and consumers. Our facilities use EHR and other information systems and medical devices that store or transmit information that are integral to the provision of patient care, and these systems and devices are increasingly connected to the internet, hospital networks and other medical devices. The secure maintenance of this information and technology is critical to our business operations.”

Annual report 2025A · The company itself

“We rely on a substantial number of employees, contractors, personnel, hardware, software, applications, and third-party vendors, platforms and technologies, each of which may represent an attack surface for threat actors. Threats from malicious actors, including nation-state actors and ransomware groups, new vulnerabilities and advanced new attacks against our, or our vendors’, information systems and devices create risk of cybersecurity incidents, including ransomware, malware and phishing incidents, in which third parties attempt to fraudulently induce our employees or our vendors’ employees into disclosing usernames, passwords or other sensitive information, which can in turn be used for unauthorized access to our or our vendors’ systems.”

Annual report 2025A · The company itself

“We expect that we, our vendors and other third parties will continue to experience an increase in cybersecurity threats in the future, both directly and indirectly through threats targeting third parties, as the volume and intensity of cyberattacks on hospitals, health systems and other health care entities continue to increase.”

Annual report 2025A · The company itself

“Increasing use of AI technologies in our internal systems may create new attack surfaces or methods for threat actors, and threat actors may use AI technologies to make cyberattacks more difficult to detect, contain or mitigate.”

Annual report 2025A · The company itself

“However, as cyber threats continue to evolve, along with their increased volume and sophistication, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any cybersecurity vulnerabilities or incidents, and such measures may decrease the efficiency of our operations. We may also be required to expend additional resources to comply with evolving federal, state and industry requirements related to cybersecurity and information security, including those focused on health care providers.”

Annual report 2025A · The company itself

“There is also a risk that our confidential information becomes part of a model that is accessible by other third-party AI applications or users as a result of a cybersecurity incident or a third-party AI developer’s violation of our vendor engagement terms.”

Annual report 2025A · The company itself

“Although we have taken steps to protect the security of our information systems, with multiple layers of controls around the data maintained in those systems, our safety and security measures cannot always prevent the systems’ improper functioning or damage, or the improper access of systems or disclosure of personally identifiable information such as in the event of cyber-attacks or other cybersecurity incidents.”

Annual report 2025A · The company itself

“Table of Contents Cybersecurity incidents and cybersecurity threats affecting our or our operators’ or other third party providers’ information systems, including those caused by physical or electronic break-ins, computer viruses, malware, worms, attacks by hackers or foreign governments, ransomware attacks, disruptions from unauthorized access and tampering, including through social engineering such as phishing or vishing attacks, coordinated denial-of-service attacks, and similar breaches, could result in, among other things: (i) system disruptions; (ii) shutdowns; (iii) unauthorized access to or disclosure of confidential information, including as a result of impersonation of authorized users or manipulated communications; (iv) misappropriation of our or our business partners’ proprietary or confidential information; (v) breach of our legal, regulatory, or contractual obligations; (vi) inability to access or rely upon critical business records or systems; or (vii) other delays in our operations.”

Annual report 2025A · The company itself

“Any resulting financial impact to our tenants or borrowers, including liability claims or regulatory penalties, increased security and insurance costs as well as business impacts resulting from any damage to their reputation or harm to their business relationships, could negatively impact the ability of our tenants and borrowers to meet their financial and other contractual obligations to us, which could have a material adverse effect on our business, financial condition and results of operations.”

Annual report 2025A · The company itself

“As previously reported, in October 2023 Henry Schein experienced a cyber incident that primarily affected the operations of our North American and European dental and medical distribution businesses. During the years ended December 28, 2024 and December 30, 2023, we had a sales decrease in our dental and medical distribution businesses, which we believe was primarily a result of lower sales to episodic customers following the cyber incident.”

Annual report 2025A · The company itself

“In the ordinary course of business, we store sensitive data, including intellectual property, personal data, our proprietary business information and that of our employees, contractors, customers, vendors, partners, suppliers, and other third parties with whom we do business. In addition, we store sensitive data through cloud-based services that may be hosted by third parties and in data center infrastructure maintained by third parties.”

Annual report 2025A · The company itself

“We have been, and expect to be, subject to cyberattacks and other attempted intrusions into our networks and systems by a wide range of actors, including, but not limited to, nation state actors, criminal enterprises, terrorist organizations, and other organizations or individuals, as well as errors, wrongful conduct or malfeasance by employees and third-party service providers, (collectively, “malicious parties”) who have at times been able to circumvent or bypass our cyber security measures.”

Annual report 2025A · The company itself

“Despite our security measures, our information systems, infrastructure, and data have experienced security incidents and breaches and may be subject to or vulnerable to security incidents and breaches in the future, including ransomware and distributed denial-of-service attacks.”

Annual report 2025A · The company itself

“Additional impacts from cybersecurity incidents have included and could include reimbursement of remediation costs to our customers, suppliers, or distributors; lost revenue resulting from the unauthorized use of proprietary information or the failure to retain or attract business partners following an incident; increased insurance premiums; and damage to our competitiveness, reputation, stock price, and long-term shareholder value.”

Annual report 2025A · The company itself

“Hiabin toimintaan liittyvät olennaisesti myös tietoturvariskit. Kyberhyökkäys Hiabin, sen asiakkaiden tai toimittajien toiminnan kannalta kriittisiä järjestelmiä kohtaan voi aiheuttaa esimerkiksi häiriöitä toimintavarmuuteen, johtaa liikevaihdon laskuun ja aiheuttaa haittaa Hiabin maineelle.”

Annual report 2025A · The company itself

“Changes in ownership or management practices, perceptions of our corporate responsibility practices, perception of guest or employee health or safety, the occurrence of accidents or injuries, cyber-attacks, security breaches, natural disasters, crime, failure of suppliers, franchisees or business partners to comply with relevant regulations and contractual requirements relating to a variety of issues including environmental, human rights and labor, individual guest, owner or employee notoriety or similar events at our hotels and resorts can harm our reputation, create adverse publicity and cause a loss of consumer confidence in our business. Because of the global nature of our brands and the broad expanse of our business and hotel locations, events occurring in one location could negatively affect the reputation and operations of otherwise successful individual locations.”

Annual report 2025A · The company itself

“Cyber-attacks could have a disruptive effect on our business. From time to time we and our third-party service providers experience cyber-attacks, attempted and actual breaches of our or their information technology systems and networks or similar events, which could result in a loss of sensitive business or customer information, systems interruption or the disruption of our operations.”

Annual report 2025A · The company itself

“The sophistication of efforts by hackers to gain unauthorized access to information systems has continued to increase in recent years and may continue to do so at an accelerating pace as criminals increasingly leverage generative and agentic AI-based technologies and services. Breaches, thefts, losses or fraudulent uses of customer, employee or company data could cause consumers to lose confidence in the security of our websites, mobile applications, point of sale systems and other information technology systems and, as a result of this loss in confidence, choose not to purchase from us.”

Annual report 2025A · The company itself

“We are exposed to risks and costs associated with protecting the integrity and security of personal data and other sensitive information. We are subject to various risks and costs associated with the collection, handling, storage and transmission of personally identifiable information and commercial information, including costs related to compliance with U.S. and foreign data collection and privacy laws and other contractual obligations, as well as risks associated with the compromise of our systems collecting such information.”

Annual report 2025A · The company itself

“Our technology infrastructure and the third-party systems with which we interact, as well as any systems those third parties utilize, are subject to, and on occasion have experienced, damage, interruption, or malicious activity from a number of causes, including power and other critical infrastructure outages; computer and telecommunications failures; computer viruses; data or security breaches; internal or external data theft or misuse; cyber-attacks, including the use of malicious codes, worms, phishing, smishing, vishing, spyware, denial of service attacks, and ransomware; responsive containment measures by us that may involve voluntarily taking systems offline; natural disasters and catastrophic events such as fires, floods, earthquakes, tornadoes, hurricanes, or other extreme weather events; public health concerns, such as pandemics and quarantines; geopolitical tensions or conflicts, military conflicts, acts of war, terrorism or civil unrest; other systems outages; inadequate or ineffective redundancy; and design or usage errors or malfeasance by our associates, contractors or third-party service providers.”

Annual report 2026A · The company itself

“Our information systems, and those of our third-party service providers, are vulnerable to continually evolving data protection and cybersecurity risks. Despite our efforts, our cybersecurity risk management processes may not be fully implemented, complied with or effective in preventing or mitigating future cybersecurity risks. Unauthorized parties, including criminal threat actors, nation-states, or insiders (including associates or contractors engaged in fraudulent or malicious activities), have in the past gained access, and will continue to attempt to gain access, to these systems and data through technical vulnerabilities, breach of security policies, fraud or other means of deceiving or coercing our associates, contractors or third-party service providers, which could jeopardize the confidentiality, integrity, or availability of such information systems or data that we may handle.”

Annual report 2026A · The company itself

“In addition, the risk of cyber-attacks has increased in connection with geopolitical tensions or conflicts and ongoing trade and diplomatic tensions. In light of the conflicts in Europe, the Middle East and South America and other geopolitical events, nation-state actors or their supporters and other politically-motivated actors may launch retaliatory cyber-attacks, and may attempt to cause supply chain and other third-party service provider disruptions, or take other geopolitically-motivated retaliatory actions that may disrupt our business operations, result in data compromise, or both.”

Annual report 2026A · The company itself

“The availability of AI may enable new types of threat actors who may not otherwise have had the capabilities to engage in malicious activity to do so, or may enhance the capabilities of nation-state actors or organizing or coordinating groups to carry out attacks, or may generally enable novel types of attacks to be developed and deployed.”

Annual report 2026A · The company itself

“The payment methods that we offer, and the selling channels in which we operate, also subject us to fraud and theft by threat actors, who are becoming increasingly more sophisticated, including by using means such as AI, seeking to obtain unauthorized access to or exploit weaknesses that may exist in our sales, payments, and payment processing systems.”

Annual report 2026A · The company itself

“We are predominantly self-insured for a number of different risk categories, such as general liability (including product liability), property loss, workers’ compensation, employee group medical, employment practices liability and wage and hour claims, automobile claims, and cybersecurity and privacy liability, with third-party insurance coverage for certain catastrophic risks above the self-insurance levels.”

Annual report 2026A · The company itself

“We face the risk of material data breaches and disruptions of our managers’ or our own information technology systems, or the information technology systems of third parties on which we or our managers rely, which could materially adversely affect our business and results. Our third-party hotel managers are dependent on information technology networks and systems, including the internet, to access, process, transmit and store proprietary and customer information. These complex networks include reservation systems, vacation exchange systems, hotel management systems, customer databases, call centers, administrative systems, and third-party vendor systems. These systems require the collection and retention of large volumes of personally identifiable information of hotel guests, including credit card numbers and passport numbers.”

Annual report 2025A · The company itself

“Marriott International, the manager of a majority of our hotels, experienced a material data security breach involving the unauthorized access to the Starwood guest reservation database between 2014 and 2018. Marriott settled a multistate state attorneys' general investigation, pursuant to which it agreed to pay a $52 million fine and take various measures to protect data. Marriott also settled with the Federal Trade Commission and agreed to take measures to protect data.”

Annual report 2025A · The company itself

“Our worldwide operations could be disrupted by natural disasters, telecommunications failures, cybersecurity incidents or other disruptions impacting information technology systems, manufacturing equipment failures, power or water shortages, fires, extreme weather conditions, and other disasters or catastrophic events, for which we are predominantly self-insured.”

Annual report 2025A · The company itself

“We are subject to risks surrounding our information technology systems and industrial controls systems failures, and the use of emerging technologies, including artificial intelligence, as well as, network disruptions, breaches in data security and compliance with data privacy laws or regulations. We are highly dependent on various software and information technology systems to record and process operational, human resources and financial transactions. The proper functioning of Hubbell’s information technology systems is critical to the successful operation of our business.”

Annual report 2025A · The company itself

“We face risks from cyber-attacks and other information or security breaches, including denial of service attacks, hacking, social engineering attacks targeting our colleagues, contractors, and customers, malware intrusion or data corruption attempts, and identity theft that could result in the disclosure of confidential, proprietary, personal and other information, any of which could adversely affect our business or reputation, and create significant legal and financial exposure.”

Annual report 2025A · The company itself

“Our computer and data management systems and network infrastructure, and those of third parties on which we are highly dependent, are subject to cybersecurity risks and could be susceptible to cyber-attacks or other information or security breaches. Our business relies on the secure processing, transmission, storage, and retrieval of confidential, proprietary, personal, and other information in our computer and data management systems and network infrastructure, and in the computer and data management systems and network infrastructure of third parties.”

Annual report 2025A · The company itself

“We, along with our customers, regulators, and other third parties, including other financial services institutions and companies engaged in data processing, have been subject to, and are likely to continue to be the target of, cyber-attacks or other information or security breaches. These cyber-attacks or other information or security breaches include computer viruses, denial of service attacks, hacking, social engineering attacks (including phishing and smishing attacks) targeting our colleagues, contractors, and customers, malware intrusion or data corruption attempts, ransomware, improper access by employees or contractors, identity theft, and other security breaches that could result in the unauthorized release, gathering, monitoring, misuse, loss, destruction, or other processing of confidential, proprietary, personal, and other information of ours, our employees, our customers, or of third parties, damage our systems and infrastructure or otherwise materially disrupt our, our customers’, or other third parties’ network access or business operations.”

Annual report 2025A · The company itself

“Cybersecurity risks for banking organizations have significantly increased in recent years in part because of the proliferation of new technologies, including AI, and the use of the internet and telecommunications technologies to conduct financial transactions. For example, cybersecurity risks may increase in the future as we continue to increase our mobile-payment and other internet-based product offerings and expand our internal usage of web-based products and applications.”

Annual report 2025A · The company itself

“In addition, cybersecurity risks have significantly increased in recent years in part due to the increased sophistication and activities of cyber threat actors, such as organized crime affiliates, terrorist organizations, state-sponsored actors, hostile foreign governments, disgruntled employees or vendors, activists, and other external parties, including those involved in corporate espionage, any of whom may enhance their efforts through the use of AI.”

Annual report 2025A · The company itself

“Due to increasing geopolitical tensions, nation state cyber-attacks and ransomware are both increasing in sophistication and prevalence.”

Annual report 2025A · The company itself

“Remote work further increases the risk that we may experience cyber-attack or other information or security breaches as a result of our colleagues, contractors, and other third parties with which we do business or upon which we rely working remotely on less secure systems and environments.”

Annual report 2025A · The company itself

“Cyber-attacks or other information or security breaches, whether directed at us or third parties, may result in a material loss or have material consequences. Furthermore, the public perception that a cyber-attack or other information or security breach on our systems or infrastructure has been successful, whether or not this perception is correct, may damage our reputation with customers, clients, and third parties with which we do business.”

Annual report 2025A · The company itself

“A successful penetration or circumvention of our cybersecurity measures could cause us serious negative consequences, including: loss of customers, clients, and business opportunities; costs associated with maintaining business relationships after a cyber-attack or other information or security breach; significant business disruption to our operations and business, misappropriation, exposure, or destruction of our confidential, proprietary, personal, and other information, intellectual property, funds, and/or those of our customers or clients; or damage to our, our customers’, our clients’, and/or third parties’ systems or infrastructure. The occurrence of any of these events could result in a violation of applicable data privacy laws and regulations and other laws and regulations, litigation exposure, regulatory fines, penalties or intervention, loss of confidence in our cybersecurity measures, reputational damage, reimbursement or other compensatory costs, additional compliance costs, and could adversely impact our results of operations, liquidity, and financial condition.”

Annual report 2025A · The company itself

“We are exposed to many types of operational risks, including the risk of fraud or theft by colleagues or outsiders, unauthorized transactions by colleagues or outsiders, operational errors by colleagues, business disruption, and system failures. Huntington executes against a significant number of controls, a large percent of which are manual and dependent on adequate execution by colleagues and third-party service providers.”

Annual report 2025A · The company itself

“The company regularly addresses cybersecurity attacks and vulnerabilities. Cybersecurity attacks or other security incidents, including industry-wide incidents, have or could result in, for example, one or more of the following: unauthorized access to, disclosure, modification, misuse, loss, or destruction of company, customer, or other third-party data or systems; theft or import or export of sensitive, regulated, or confidential data including personal information and intellectual property, including key innovations in AI, quantum, or other disruptive technologies; the loss of access to critical data or systems through ransomware, crypto mining, destructive attacks or other means; and business delays, service or system disruptions or denials of service.”

Annual report 2025A · The company itself

“These information systems and networks are susceptible to damage, disruption, or shutdown from multiple factors, including failures during the process of upgrading or replacing software, databases, or components; power outages; telecommunications or system failures; terrorist attacks; natural disasters; individual error or malfeasance; server or cloud provider breaches; computer viruses or cyber security attacks or other breaches or incidents.”

Annual report 2025A · The company itself

“We, and some of our third-party vendors, have experienced cybersecurity attacks by threat actors (which may include state-sponsored organizations or nation state actors) and other cybersecurity breaches and incidents in the past, including, among other things, computer viruses and malware, ransomware, denial of service actions, phishing schemes, social engineering, the compromise, misappropriation and/or unauthorized access to (or acquisition or disclosure of) confidential or 25 otherwise protected information, and similar events, and will likely experience further attacks, breaches and incidents in the future, potentially with more frequency.”

Annual report 2025A · The company itself

“Information systems failure or disruption, due to cyber terrorism or other actions, may adversely impact our business and result in financial loss to the Company or liability to our customers. Our business is highly dependent on financial, accounting and other data-processing systems and other communications and information systems, including our enterprise resource planning tools. We process a large number of transactions on a daily basis and rely upon the proper functioning of computer systems.”

Annual report 2025A · The company itself

“We rely on the proper function, availability, and security of our products and IT systems; a successful cyber-attack or other breach or disruption of our products or these systems could have a material adverse effect on our business and results of operations.”

Annual report 2025A · The company itself

“We seek to manage, monitor and control our market, credit, operational, liquidity, and legal and regulatory compliance risks through risk management policies developed and implemented by our Steering Committee, which is chaired by our Chief Executive Officer and comprised of senior executives of our various operating subsidiaries. However, there can be no assurance that our procedures will be adequate.”

Annual report 2025A · The company itself

“Our business relies on technology and automation, causing us to be potentially vulnerable to various forms of cyber-attacks by external actors or malicious insiders. Cybersecurity risks continue to evolve, including through more sophisticated attacks, increased use of automation by threat actors and heightened targeting of financial institutions and digital asset-related services.”

Annual report 2025A · The company itself

“We rely on our computer software to receive and properly process internal and external data. Any disruption in the proper functioning of our software due to, for example, erroneous or corrupted data, or cyber-attacks, may cause us to make erroneous trades or suspend our services and could cause us great financial harm.”

Annual report 2025A · The company itself

“Additionally, custodial platforms are prime targets for hackers. A breach of our custody systems could lead to the theft of customer assets and unauthorized transfers, for which the company might be held liable, and traditional insurance may not adequately cover losses related to digital assets. Further, our ownership of a digital asset custody business may also involve dependencies on decentralized or other third party blockchain services and the protocols, which we do not control and in turn may expose us to new and evolving technological risks.”

Annual report 2025A · The company itself

“In addition, our acquisition of ICE Digital Trust, which is a New York limited purpose trust company, subjects us to additional regulation and oversight by the NYDFS, including requirements to comply with additional cybersecurity, anti-money laundering, capital adequacy and digital asset safekeeping requirements. Compliance with any such regulatory requirements increases our regulatory burden and gives rise to costs and expenses that may be material.”

Annual report 2025A · The company itself

“Our networks and those of our customers, third-party service providers and external market infrastructures may be vulnerable to compromise, unauthorized access, security technology failure, malware, social engineering, deepfake scams, denial of service attacks, terrorism, ransomware attacks, supply chain attacks, firewall or encryption failures or other security problems resulting in loss of data integrity, information disclosure, unavailability or fraud. The financial services industry has been targeted for purposes of political protest, activism and financial gain and our role in the global marketplace places us at greater risk than other public companies for cyberattack and other information security threats.”

Annual report 2025A · The company itself

“We are subject to cybersecurity and information technology risks related to breaches of security pertaining to sensitive company, customer, employee and vendor information as well as breaches in the technology used to manage operations and other business processes. Our business operations rely on securely managed information technology systems, some of which are provided or managed by third parties, for data capture, processing, storage and reporting.”

Annual report 2025A · The company itself

“In addition, despite careful security and controls design, implementation, updating, monitoring and independent third-party verification, our information technology systems, together with those of our third-party providers or joint venture partners, have been and could again be compromised or disrupted due to factors such as employee error or malfeasance, cyberattacks, including ransomware, malware, phishing attacks, advanced persistent threats, social engineering, credential stuffing or distributed denial-of-service attacks or data or security breaches by malicious actors such as common hackers, criminal groups or nation-state organizations or social activist (“hacktivist”) organizations, disruptions resulting from geopolitical events, natural disasters, failures or impairments of telecommunications networks or other catastrophic events.”

Annual report 2025A · The company itself

“Viktiga interna styrdokument Informationssäkerhetsinstruktion Integritetspolicy Integritetsstyrning GRI 418-1 Dokumenterade fall av klagomål gällande brott mot integritetsskydd och förlust av kunddata Dataskyddsrelaterade klagomål från extern part Frågor, granskningar och tillsyner från Dataskyddsmyndigheter Personuppgiftsincidenter 423 429 403 H8.11 Relationer med beslutsfattare och organisationer Såväl nationellt som internationellt är vi engagerade i dialoger med lagstiftare, myndigheter och branschorganisationer. Att aktivt delta i debatten om aktuella branschfrågor, och bidra till utvecklingen av nya regelverk inom kredithantering ser vi som en av våra viktigaste uppgifter som samhällsmedborgare.”

Annual report 2024A · The company itself

“OPERATIONAL RISKS Security incidents, improper access to or disclosure of our data or customers’ data, or other cyberattacks on our systems could harm our reputation, business, and financial condition. We host, collect, use and retain large amounts of sensitive and personal customer and workforce information, including credit card information, tax return information, bank account numbers, credit report information, login credentials and passwords, personal and business financial data, transaction records, social security numbers and payroll information, as well as our confidential, nonpublic business information.”

Annual report 2026A · The company itself

“Our technologies, systems, and networks have been subject to, and are increasingly likely to continue to be the target of, cyberattacks, computer viruses, ransomware or other malware, worms, social engineering, malicious software programs, insider threats, denial-of-service attacks and other cybersecurity threats that have in the past, and could in the future, result in the unauthorized release, gathering, monitoring, use, loss or destruction of sensitive and personal information of our customers and our workforce, or Intuit's sensitive business data or cause temporary or sustained unavailability of our data, software, and systems.”

Annual report 2026A · The company itself

“Our use of AI in our internal operations and technologies may also create new vulnerabilities or methods of attack.”

Annual report 2026A · The company itself

“In addition, techniques used to obtain unauthorized access to sensitive information change frequently and, as technologies like AI develop rapidly, malicious third parties are using these technologies to create new sophisticated attack methods that are increasingly automated, targeted and coordinated and more difficult to defend against.”

Annual report 2026A · The company itself

“Further, because we have created an ecosystem where customers can have one identity across multiple Intuit products, a security incident may give access to increased amounts of customer data.”

Annual report 2026A · The company itself

“Our use of Credit Karma user data is also subject to a Federal Trade Commission (FTC) order that requires maintenance of a comprehensive security program and biennial independent security assessments through 2034. Our failure to fulfill the requirements of the FTC’s order could result in fines, enforcement action, and reputational harm.”

Annual report 2026A · The company itself

“Throughout our operations, we rely on technology systems that integrate with various third-party vendors, including their AI services. The failure of these systems or services to perform at subscribed levels could adversely impact our business. Taking a proactive approach and engaging with our third-party vendors about service delivery and implementing security risk management controls allow us to mitigate any potential negative impact on our business.”

Annual report 2025A · The company itself

“Information security risks have generally increased in recent years due to the rise in new technologies and the increased sophistication and activities of perpetrators of cyberattacks. In the ordinary course of our business, we acquire and store sensitive data, including intellectual property, our proprietary business information, and personally identifiable information of our prospective and current residents, associates, and third-party service providers.”

Annual report 2025A · The company itself

“Security breaches and unauthorized use of our IT systems and information, or the IT systems or information in the possession of our vendors, could expose us, our clients, our data suppliers or others to risk of loss. We rely upon the security of our computer and communications systems infrastructure to protect us from cyberattacks and unauthorized access.”

Annual report 2025A · The company itself

“Cyber threats are rapidly evolving and are becoming increasingly sophisticated, including through the use of AI-supported attacks. As cyber threats evolve and become more difficult to detect and successfully defend against, one or more cyber threats might defeat the measures that we or our vendors take to anticipate, detect, avoid or mitigate such threats.”

Annual report 2025A · The company itself

“We have acquired various companies, products, services and technologies over the years. While we make significant efforts to identify and address IT security issues with respect to these acquisitions, we may still inherit security risks associated with these activities.”

Annual report 2025A · The company itself

“We also store proprietary and sensitive information in connection with our business, which could be compromised by a cyberattack. To the extent that any disruption or security breach results in a loss or damage to our data, an inappropriate disclosure of proprietary or sensitive information, an inability to access data sources, or an inability to process data or provide our offerings to our clients, it could cause significant damage to our reputation, affect our relationships with our data suppliers and clients (including loss of suppliers and clients), lead to claims against us and ultimately harm our business.”

Annual report 2025A · The company itself

“Some of our vendors have significant responsibility for the security of certain of our data centers and computer-based platforms or Software-as-a-Service ("SaaS") applications upon which our businesses rely to host or process data or to perform various functions. Also, our data suppliers have responsibility for security of their own computer and communications environments.”

Annual report 2025A · The company itself

“Business risks Group key risks Risk assessment Trend IT Security Health & Safety Technical Services (NEW) Environmental sustainability Commercial (NEW) Strategic transformation People Contract management Macroeconomic & political environment Outside risk appetite Increasing Within risk appetite Unchanged Decreasing We focus on managing the strategic risks that could affect the achievement of our long-term objectives, such as shifts in global market dynamics and evolving customer expectations, alongside the operational risks inherent in our day-to-day activities that may impact business performance in the short to medium term.”

Annual report 2025A · The company itself

“As a result, our information technology systems, including those provided by third-party cloud providers or other infrastructure-as-a-service providers,which have grown over time, including through acquisitions, have, and will continue to experience threats and cyber-attacks, including unauthorized access, state-sponsored cyber attacks, computer hackers, computer viruses, malicious code, ransomware, phishing and other security breaches, problems and system disruptions, including unauthorized access to and disclosure of our and our clients’ proprietary, classified or other protected information.”

Annual report 2025A · The company itself

“Kyberhyökkäys Kalmarin, sen asiakkaiden tai toimittajien toiminnan kannalta kriittisiä järjestelmiä kohtaan voisi aiheuttaa esimerkiksi häiriöitä toimintavarmuuteen, johtaa liikevaihdon laskuun ja aiheuttaa haittaa Kalmarin maineelle.”

Annual report 2025A · The company itself

“Our business is increasingly dependent on informational technology systems; operational technology systems; networks and services, including internal and public internet and intranet sites; data hosting and processing facilities and technologies; cloud-based services and hardware; physical security systems; digital, social media, and mobile technology platforms and other hardware; software-enabled shop-floor manufacturing and distribution automation systems or operational technology; and software and technical applications and platforms (collectively, “Technology Systems”), some of which are managed, hosted, provided or used by third parties, including cloud-based service providers and their vendors. Our Technology Systems and those of third-party partners could be misused, interrupted, damaged, invaded, corrupted, breached, or cease to function properly due to any number of causes, including catastrophic events, natural disasters, power outages, computer and telecommunications failures, improper data handling, phishing attempts, cyberattacks, malware and ransomware attacks, security breaches, security incidents, social engineering, credential compromises, or employee or other insider error or malfeasance.”

Annual report 2025A · The company itself

“However, due to the frequency with which attack techniques change and the increased volume and sophistication of attacks, there is the continuous potential for our business, results of operations, or financial condition to be 32 adversely affected by an information security or cybersecurity incident involving us or a third party with which we partner or its vendor, which could result in reputational, competitive, operational, or other business harm as well as financial costs and regulatory action.”

Annual report 2025A · The company itself

“Continuity of business applications and services has been, and may in the future be, disrupted by events such as infection by viruses or malware. In addition, our continuity of business applications and operations has been, and may in the future be, disrupted by other issues, including cybersecurity attacks (which may include social engineering, business email compromise, cyber extortion, denial of service, attempts to exploit vulnerabilities, hacking, website defacement, theft of passwords and other credentials, or unauthorized use of computing resources for digital currency mining); issues with or errors in systems' maintenance or security; migration of applications to the cloud; power outages; hardware or software failures; telecommunication failures; natural disasters; terrorist attacks; unintentional or malicious actions of employees or contractors; and fires and other catastrophic occurrences and other cyber incidents.”

Annual report 2025A · The company itself

“Similar risks exist with respect to our third-party service providers, including cloud data service and other information technology service providers, suppliers, distributors, contractors, and other business partners, that we rely upon for certain areas of our business, including payroll processing, health and benefit plan administration, and certain finance and accounting functions. When risks such as these materialize, the need for us to coordinate with various third-party service providers, including with respect to timely notification and access to personnel and information concerning an incident, and for third-party service providers to coordinate amongst themselves might make it more challenging to resolve the related issues.”

Annual report 2025A · The company itself

“Failure of key technology systems, cyberattacks, privacy breaches or data breaches could have a material adverse effect on our business, financial condition, results of operations and reputation. To conduct our business, we rely extensively on information and operational technology systems, many of which are managed, hosted, provided and/or used by third parties and their vendors.”

Annual report 2025A · The company itself

“Despite the security measures we have in place, the information and operational technology systems, including those of our customers, vendors, suppliers and other third-party service providers with whom we have contracted, have, in the past, and may, in the future, be vulnerable to cyber-threats such as computer viruses or other malicious codes, ransomware, cyber extortion, security incidents, denial of service attacks, unauthorized access, phishing attacks, social engineering and other disruptions from employee error, unauthorized uses, system failures, including Internet outages, unintentional or malicious actions of employees or contractors or cyberattacks by hackers, criminal groups, nation-states and nation-state-sponsored organizations and social-activist organizations.”

Annual report 2025A · The company itself

“A breach of information security or the failure of one or more key IT or operational (OT) systems, or those of third parties, may adversely affect our business, results of operations, or business reputation. Our business is dependent upon our operational systems to process a large amount of data and complex transactions.”

Annual report 2025A · The company itself

“We face the risk of a security breach, whether through cyber-attack on our IT infrastructure, insider threat, or threats to the physical security of our facilities and employees or other significant disruption of our IT networks and related systems or those of our suppliers or subcontractors. The risk of a security breach or disruption, particularly through cyber-attack or cyber intrusion, including by computer hackers, foreign governments and cyber terrorists, is persistent. The volume, intensity and sophistication of threats from around the world remains elevated.”

Annual report 2025A · The company itself

“Accordingly, we may be unable to anticipate these techniques or to implement adequate security controls or other preventative measures and future cyber security incidents may have a material negative impact on us.”

Annual report 2025A · The company itself

“While we have implemented robust practices to mitigate cybersecurity risks, and prior cybersecurity threats have not materially affected our business strategy, results of operations or financial condition, we could be negatively impacted by a cybersecurity breach, through cyber-attack, cyber intrusion, insider threats, supply chain incidents, or otherwise, or other significant disruption of our IT networks and related systems or of those we operate for certain of our customers.”

Annual report 2025A · The company itself

“Our information systems and records, including those we maintain with third-party service providers, may be subject to cyber-attacks and information security breaches. We have experienced a sophisticated criminal cybersecurity attack in the past and in the future we may experience global cybersecurity and information security threats with more frequency and severity, which may range from uncoordinated individual attempts to sophisticated and targeted measures directed at us.”

Annual report 2025A · The company itself

“In addition, increased use of artificial intelligence by threat actors, increases the risk of cyber-attacks and data breaches. Cyber-attacks can occur more quickly and evolve more rapidly when artificial intelligence is used by threat actors.”

Annual report 2025A · The company itself

“We rely extensively on information technology ("IT") systems, including Internet sites, data hosting facilities and other hardware and software platforms, some of which are hosted by third parties, to assist in conducting our businesses. These IT systems, like those used by most companies, may be vulnerable to a variety of disruptions, including, but not limited to, those caused by natural disasters, telecommunications failures, hackers, and other security issues. Moreover, these IT systems, like those of most companies, are subject to the possibility of computer viruses or other malicious codes, and to security breaches, cyber incidents, ransomware attacks or phishing-attacks.”

Annual report 2025A · The company itself

“Risks Related to Our Operations Failure, inadequacy, breach of, or unauthorized access to, our IT systems or those of our third-party service providers, unauthorized access to our confidential information, or violations of data protection laws, could result in material harm to our business and reputation.”

Annual report 2025A · The company itself

“Some third-party IT systems that are necessary for the operation of our business processes are maintained outside of our control but would impact business operations if compromised as a result of a cyber-attack.”

Annual report 2025A · The company itself

“We and others in the healthcare industry have been and continue to be targets for cyber-attacks, and the number of threats has increased over time.”

Annual report 2025A · The company itself

“Data loss or other breaches of our network security could materially harm our business and results of operations, and the processing, storage, use and disclosure of personal or sensitive information could give rise to liabilities and additional costs as a result of governmental regulation, litigation and conflicting legal requirements relating to personal privacy rights. Due to the nature of our business, we process, store, use, transfer and disclose certain personal or sensitive information about our customers and employees. Penetration of our network or other misappropriation or misuse of personal or sensitive information and data, including credit card information and other personally identifiable information, could cause interruptions in our operations and subject us to increased costs, litigation, inquiries and actions from governmental authorities, and financial or other liabilities.”

Annual report 2025A · The company itself

“We also face risks associated with security breaches and incidents affecting third parties with which we are affiliated or with which we otherwise conduct business. In particular, hardware, software or applications we develop or procure from third parties may contain, and have contained, defects in design or manufacture and/or may pose a security risk that could unexpectedly compromise information security, but none of which have been material to date. Consumers are generally concerned with the security and privacy of the internet, and any publicized security problems affecting our businesses and/or third parties may discourage consumers from doing business with us, which could have an adverse effect on our business, financial condition and results of operations.”

Annual report 2025A · The company itself

“CNA’s, or its vendors’, facilities and systems could become unavailable, inoperable, or otherwise impaired from a variety of causes, including natural events, such as hurricanes, tornadoes, windstorms, earthquakes, severe winter weather and fires, or other events, such as explosions, terrorist attacks, computer security breaches or cyber attacks, riots, hazardous material releases, medical epidemics or pandemics, utility outages, interruptions of data processing and storage systems or unavailability of communications facilities or systems.”

Annual report 2025A · The company itself

“During the fourth quarter of 2025, CNA was notified of a data breach impacting a vendor of a business associate of its current employee health insurance administrator. The breach was traced to compromised credentials leveraged by a threat actor, with the impacted vendor shutting down and rebuilding the affected environment upon discovery of the breach. Following a forensics analysis, it was determined that a substantial number of CNA’s employees (and dependents of employees) were impacted.”

Annual report 2025A · The company itself

“Failures or interruptions in or breaches to our or our subsidiaries’ computer systems or information technology or communication infrastructure or those of certain third parties could materially and adversely affect our or our subsidiaries’ operations. We and our subsidiaries are dependent upon information technologies, computer and communication systems and networks, including those maintained by us and our subsidiaries and those maintained and provided to us and our subsidiaries by third parties (for example, “software-as-a-service” and cloud solutions), to conduct operations.”

Annual report 2025A · The company itself

“Cyber attacks and other cyber incidents are occurring more frequently, are constantly evolving in nature, are becoming more difficult to prevent, detect and remediate, and are being carried out by groups and individuals with a wide range of expertise and motives, and that may have the backing of foreign governmental actors. The U.S. government has issued public warnings that indicate energy assets may be specific targets of cyber attacks, which can have catastrophic consequences, and hotel chains, among other consumer-facing businesses, have been subject to various cyber attacks targeting payment card and other sensitive consumer information.”

Annual report 2025A · The company itself

“Further, the increasing use of artificial intelligence and other advances in computer capabilities and technologies, by us and our subsidiaries and by our and their vendors and other third parties with whom we and they do business, may increase our and their exposure to risks of cyber attacks and other cyber incidents.”

Annual report 2025A · The company itself

“Performance issues with these customer-facing technology systems, including systems failures or interruptions, defects, capacity constraints, human error, natural disasters, power loss, failures by third parties, and cybersecurity threats such as distributed denial of service attacks, ransomware, phishing and other attempts to gain unauthorized access to or disrupt systems or data, or a complete failure of one or more of them without a disaster recovery plan that can be quickly implemented, could quickly destroy the positive benefits they provide to our home improvement business and negatively affect our customers’ perceptions of Lowe’s as a reliable online vendor and source of information about home improvement products and services.”

Annual report 2026A · The company itself

“In the normal course of business, we and our third-party service providers have in the past and will likely continue to experience cybersecurity threats and incidents, and certain of our third-party service providers have been subject to disruption due to ransomware and other cyber-attacks. Although, we do not believe such cybersecurity threats or incidents have had a material impact on us to date, there is no guarantee that a future cybersecurity threat or incident will be detected and remediated to not have a material adverse impact on our business strategy, reputation, results of operations, or financial condition.”

Annual report 2026A · The company itself

“Operational Risk •The Company is subject to operational risk which could adversely affect the Company’s business and reputation and create material legal and financial exposure. •The Company’s information systems may experience interruptions or breaches in security, such as cyber attacks, including due to events beyond the Company’s control. •The Company could incur higher costs, experience lower revenue, and suffer reputational damage in the event of the theft, loss or misuse of information, including due to a cyber attack.”

Annual report 2025A · The company itself

“The Company’s information systems may experience interruptions or breaches in security, such as cyber attacks, including due to events beyond the Company’s control. The Company relies heavily on communications and information systems, including those of third-party service providers, to conduct its business.”

Annual report 2025A · The company itself

“Like other U.S. financial services companies, the Company is constantly the target of cyber attacks and other attempts to disrupt its operations.”

Annual report 2025A · The company itself

“Information security risks for large financial institutions such as M&T have increased significantly in recent years in part because of the proliferation of new technologies, such as AI and digital and mobile banking to conduct financial transactions, the increased connectivity of third parties (including contractors) and electronic devices to the Company's systems, and the increased sophistication and activities of organized crime, hackers, terrorists, nation-states, activists and other external parties.”

Annual report 2025A · The company itself

“As cyber threats continue to evolve, the Company expects to continue to expend significant additional resources to modify or enhance its layers of defense or to investigate and remediate any information security vulnerabilities especially in light of heightened regulatory expectations around information security.”

Annual report 2025A · The company itself

“Additionally, successful cyber attacks at other large financial institutions, whether or not the Company is impacted, could lead to a general loss of customer confidence in financial institutions that could negatively affect M&T, including harming the market perception of the effectiveness of the Company’s security measures or the financial system in general which could result in reduced use of the Company’s financial products.”

Annual report 2025A · The company itself

“The Company, as well as third parties with which the Company does business, has expanded the use of cloud service providers, which could experience system breakdowns or failures, outages, downtime, cyber attacks, negative changes to financial condition, bankruptcy, or other adverse conditions, which could have a material adverse effect on the Company’s business and reputation.”

Annual report 2025A · The company itself

“The failure to properly upgrade or maintain the computer systems could result in greater susceptibility to attacks, particularly in light of the greater frequency and severity of attacks in recent years, as well as the growing prevalence of supply-chain attacks affecting software and information technology service providers.”

Annual report 2025A · The company itself

“Like other financial services firms, the systems, networks and devices of the Company, its customers, employees, service providers or other third parties with whom the Company interacts continue to be the subject of attempted unauthorized access, denial-of-service attacks, computer viruses, hacking, malware, ransomware, phishing or other forms of social engineering, and cyber attacks designed to obtain confidential information, destroy data, disrupt or degrade service, eliminate access or cause other damage.”

Annual report 2025A · The company itself

“Further, cybersecurity and information security risks for financial institutions have generally increased because of, among other things, the growth of new technologies (including AI), the use of the Internet and telecommunications technologies (including computers, smartphones, and other mobile devices outside the Company’s systems) by customers to conduct financial transactions, and the increased sophistication and activities of organized crime, fraudsters, hackers, terrorists, activists, instrumentalities of foreign governments and other external parties.”

Annual report 2025A · The company itself

“Further, as the Company expands its mobile and digital capabilities, cybersecurity risks increase.”

Annual report 2025A · The company itself

“A disruption or breach, including as a result of a cyber attack, or media reports of perceived security vulnerabilities at the Company or at third-party service providers could result in significant legal and financial exposure, regulatory intervention, remediation costs, damage to the Company's reputation, or loss of confidence in the security of systems, products and services that could adversely affect the Company’s business.”

Annual report 2025A · The company itself

“As a result of the data security incident involving unauthorized access to the Starwood Hotels & Resorts Worldwide, LLC, formerly known as Starwood Hotels & Resorts Worldwide, Inc. (“Starwood”), reservations database that we disclosed in November 2018 (the “Data Security Incident”), numerous lawsuits and investigations were filed or initiated against us, as described further in Note 7, and we may become subject to additional actions related to the Data Security Incident.”

Annual report 2025A · The company itself

“Additional cybersecurity incidents could have adverse effects on our business. We have enhanced our security measures to safeguard our information systems and data, and we intend to continue implementing additional measures in the future, but, as we have seen in the past, our measures may not be sufficient to maintain the confidentiality, security, or availability of the data we collect, store, and use to operate our business.”

Annual report 2025A · The company itself

“Our businesses provide numerous professional services, including the placement of insurance and the provision of consulting, investment advisory, investment management and actuarial services to clients around the world. As a result, the Company and its subsidiaries are subject to a significant number of errors and omissions, breach of fiduciary duty, breach of contract and similar claims, which we refer to collectively as "E&O claims."”

Annual report 2025A · The company itself

“Our information technology systems and information security control systems, and those of our numerous third-party providers, as well as the control systems of critical infrastructure they rely on, such as power grids, and undersea cables, are potentially vulnerable to unauthorized access, damage or interruption from a variety of external threats, including software bugs, physical attack, cyberattacks, computer viruses and other malware, malicious or destructive code, ransomware, social engineering attacks (including phishing, business e-mail compromise and digital or telephonic impersonation), hacking theft, denial-of-service attacks and other types of data and systems-related modes of attack. The techniques used to achieve such unauthorized access, damage or interruption change frequently and new techniques may not be identified until they are launched against a target, and we may be unable to anticipate these techniques or implement adequate preventative or remedial measures, resulting in potential data loss, data unavailability, data corruption or other damage to information technology systems.”

Annual report 2025A · The company itself

“In addition, remote and hybrid work arrangements have increased the risk of phishing and other cybersecurity attacks, unauthorized dissemination of personal, confidential, proprietary or sensitive data, and unauthorized access to company computing assets.”

Annual report 2025A · The company itself

“Our systems are also subject to compromise from internal threats such as fraud, mistakes, misconduct or other improper action by employees, vendors and other third parties with otherwise legitimate access to our systems. Moreover, we face the ongoing challenge of managing access controls in a complex environment. The latency of a compromise is often measured in months but could be years, and we may not be able to detect a compromise in a timely manner, and even if detected, there can be no assurance that we can mitigate or remediate such compromise in an adequate or timely manner.”

Annual report 2025A · The company itself

“Cyberattacks are increasing in frequency and evolving in nature. We are at risk of attack by a variety of adversaries, including nation states, state-sponsored organizations, opportunistic attacks, and organized crime and hackers, through use of increasingly sophisticated methods of attack, including the deployment of AI to find and exploit vulnerabilities, "deep fakes", long-term, persistent attacks (referred to as advanced persistent threats) and the use of the IT supply chain to introduce malware through software updates or compromised suppliers accounts or hardware.”

Annual report 2025A · The company itself

“In particular, the advance of AI and large language models has given rise to additional vulnerabilities and potential entry points for cyber threats. With generative AI, threat actors may have additional tools to automate breaches or persistent attacks, evade detection, or generate sophisticated phishing emails or other forms of digital impersonation, doing so quickly and without requiring deep technical understanding of potential exploits. Attackers may develop AI agents to fully automate the attack cycle, which could discover new and unexploited applications and dynamically create ways to exploit these weaknesses faster than security tools can adapt to and detect these new attack methods.”

Annual report 2025A · The company itself

“Further, we are at increased risk of a cyberattack during periods of heightened geopolitical conflict, such as the war in Ukraine and the conflict throughout the Middle East, as diplomatic events and economic policies may trigger espionage or retaliatory cyber incidents. Additionally, nation states may deploy threat actors masquerading as potential candidates for hire at target companies to perform corporate espionage or execute internal cyber threat activities.”

Annual report 2025A · The company itself

“As the breadth and complexity of the technologies we use and the software and platforms we develop continue to grow, including as a result of the use of mobile devices, cloud services, "open source" software, social media tools and the increased reliance on devices connected to the Internet (known as the "Internet of Things"), the potential risk of security breaches and cyber-attacks also increases. Despite ongoing efforts to improve our ability to protect data from compromise, we may not be able to protect all of our data across our diverse systems.”

Annual report 2025A · The company itself

“Our policies, employee training (including phishing prevention training), procedures and technical safeguards may also be insufficient to prevent, detect or remediate improper access to confidential, personal or proprietary information. In addition, the competition for talent in the data privacy and cybersecurity space is intense, and we may also be unable to hire, develop or retain suitable talent capable of adequately detecting, mitigating or remediating these risks.”

Annual report 2025A · The company itself

“In addition, managing and integrating multiple cloud environments with our internal systems increases the risk of configuration errors or vulnerabilities that could be exploited. Should an attacker gain access to our network using compromised credentials of an authorized user, we are at risk that the attacker might successfully leverage that access to compromise additional systems and data.”

Annual report 2025A · The company itself

“Certain measures that could increase the security of our systems, such as data encryption (including encryption of data at rest), heightened monitoring and logging, scanning for source code errors or deployment of multi-factor authentication, take significant time and resources to deploy broadly, and such measures may not be deployed in a timely manner or be effective against an attack. The inability to implement, maintain and upgrade adequate safeguards could have a material adverse effect on our business.”

Annual report 2025A · The company itself

“Our information systems must be continually updated, patched, and upgraded to protect against known vulnerabilities. The volume of new software and infrastructure vulnerabilities continues to increase markedly, as has the criticality of patches and other mitigation and remedial measures. In addition to mitigating and remediating newly identified vulnerabilities, previously identified vulnerabilities must also be continuously addressed.”

Annual report 2025A · The company itself

“Due to the large number and age of the systems and platforms that we operate, the increased frequency at which vendors are issuing security patches to their products, the need to test patches and, in some cases, coordinate with clients and vendors, before they can be deployed, we perpetually face the substantial risk that we cannot deploy patches in a timely manner.”

Annual report 2025A · The company itself

“We are at risk of a cyberattack involving a vendor or other third parties, which could result in a breakdown of such third party’s data protection processes or the cyberattackers gaining access to our infrastructure or data through a supply chain attack. Highly publicized data security breaches, such as the October 2025 Salesloft/Drift attack, may embolden malicious actors to target the IT supply chain and providers of business software.”

Annual report 2025A · The company itself

“Our systems’ availability could be impacted by poor or improperly tested software code and updates deployed to our environment by a third-party through normal and expected processes, which occurred with the CrowdStrike event in July 2024. Our reliance on third-party software components and open-source libraries as part of our software supply chain exposes us to significant cybersecurity risks, including malicious code insertion, vulnerabilities and compromised updates. Incidents such as the Shai Hulud NPM Worm, which spread through widely used JavaScript packages by exploiting trust in open-source dependencies, illustrate how supply chain attacks can lead to unauthorized access, data breaches, or disruption of critical applications, sometimes evading traditional security controls.”

Annual report 2025A · The company itself

“The complexity and scale of modern software supply chains make it difficult to fully vet and monitor all dependencies, increasing the likelihood that similar incidents could affect our systems and operations and result in business disruption, reputational damage and regulatory or legal consequences. Our control over and ability to monitor the cybersecurity practices of our third-party and fourth-party vendors and service providers, and other third parties with whom we do business, remains limited, and there can be no assurance that we can prevent, mitigate, or remediate the risk of any compromise or failure in the development processes or cybersecurity infrastructure or IT controls owned or controlled by such third parties.”

Annual report 2025A · The company itself

“The process of integrating the information systems of any businesses we acquire is complex and exposes us to additional risk. For instance, we may not adequately identify weaknesses and vulnerabilities in an acquired entity’s information systems, either before or after the acquisition, which could affect the value we are able to derive from the acquisition, expose us to unexpected liabilities or make our own systems more vulnerable to a cyberattack.”

Annual report 2025A · The company itself

“We have experienced data incidents and cybersecurity breaches, such as malware incursions (including computer viruses and ransomware), vulnerabilities in the software on which we rely, users exceeding their data access authorization, employee misconduct and incidents resulting from human error, such as emails sent to the wrong recipient, loss of portable and other data storage devices or misconfiguration of software or hardware resulting in inadvertent exposure of personal, sensitive, confidential or proprietary information or reduction of system availability. Like many companies, we are also subject to social engineering attacks such as WhatsApp scams and regular phishing email campaigns directed at our employees that can result in malware infections, fraud and data loss.”

Annual report 2025A · The company itself

“In the event of a cyberattack, we might have to take our systems offline, which could interfere with services to our clients or damage our reputation. A cyberattack may also result in systems or data being encrypted or otherwise unavailable due to ransomware or other malware.”

Annual report 2025A · The company itself

“Privacy or AI-related legal or regulatory violations, including unauthorized use disclosure or transfer of sensitive, personal or confidential client or Company data, whether through systems failure, employee negligence, fraud or misappropriation, by the Company, our vendors or other parties with whom we do business (if they fail to meet the standards we impose) could damage our reputation and subject us to significant litigation, monetary damages, regulatory enforcement actions, fines and criminal prosecution in one or more jurisdictions where we operate.”

Annual report 2025A · The company itself

“If any of our employees, contractors, consultants, vendors or service providers use any third-party AI powered software in connection with our business or the services they provide to us, it may lead to the inadvertent disclosure or incorporation of our confidential information into publicly available training sets, which may impact our ability to realize the benefit of, or adequately maintain, protect and enforce our intellectual property or confidential information, harming our competitive position and business.”

Annual report 2025A · The company itself

“These third parties also face their own technology, operating, business and economic risks, and any significant failures by them, including the improper use or disclosure of our confidential client, employee, or Company information or failure to comply with applicable law, could cause harm to our reputation or otherwise expose us to liability.”

Annual report 2025A · The company itself

“Our operations depend in particular upon our ability to protect our technology infrastructure against damage. If a business continuity event occurs, we could lose client or Company data or experience interruptions to our operations or delivery of services to our clients, which could have a material adverse effect.”

Annual report 2025A · The company itself

“A cyberattack or other business continuity event affecting us or a key vendor or other third party could result in a significant and extended disruption in the functioning of our information technology systems or operations or our ability to recover data, requiring us to incur significant expense to address and remediate or otherwise resolve such issues.”

Annual report 2025A · The company itself

“Information security risks for payments and technology companies such as ours have significantly increased in recent years in part because of the proliferation of new technologies (including AI), the use of the Internet and telecommunications technologies to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, “hacktivists”, terrorists, nation-states, state-sponsored actors and other external parties. These threats may derive from fraud or malice on the part of our employees or third parties, or may result from human error, software bugs, server malfunctions, software or hardware failure or other technological failure. These threats include cyber-attacks such as computer viruses, denial-of-service attacks, malicious code (including ransomware), social-engineering attacks (including phishing attacks) or information security breaches and could lead to the misappropriation or loss of consumer account and other information and identity theft.”

Annual report 2025A · The company itself

“We, like other financial technology organizations, routinely are subject to cyber-threats and our technologies, systems and networks, as well as the systems of our third-party providers, have been subject to attempted cyber-attacks. Because of our position in the payments value chain, we believe that we are likely to continue to be a target of such threats and attacks.”

Annual report 2025A · The company itself

“However, future attacks or breaches could lead to security breaches of the networks, systems (including third-party provider systems) or devices that our customers use to access our products and services, which in turn could result in the unauthorized disclosure, release, gathering, monitoring, misuse, loss or destruction of confidential, proprietary, sensitive and personal information (including account data information) or data security compromises. Such attacks or breaches could also cause service interruptions, malfunctions or other failures in the physical infrastructure, networks or operations systems that support our business and customers (such as the lack of availability of our services), as well as the operations of our customers or other third parties.”

Annual report 2025A · The company itself

“Moreover, while most of the lawsuits resulting from account data breaches do not involve direct claims against us and while we have releases from many issuers and acquirers, we could still face damage claims, which, if upheld, could materially and adversely affect our results of operations.”

Annual report 2025A · The company itself

“In addition, companies have generally experienced in recent years an increase in fraudulent activity and cyber-attacks, which has been further exacerbated by the increased use of AI. Criminals are using increasingly sophisticated methods to capture consumer personal information to engage in illegal activities such as counterfeiting or other fraud and may see their effectiveness enhanced by the use of AI.”

Annual report 2025A · The company itself

“We regularly experience such cyber-attacks and other security incidents of varying degrees, and we incur significant costs in protecting against or remediating such incidents. In addition, we are subject to a variety of laws and regulations in the United States and abroad relating to cybersecurity and data protection, including the GDPR and EU member state laws implementing the EU Cybersecurity Directive (NIS2), as well as obligations under our modified consent order with the FTC.”

Annual report 2025A · The company itself

“We have experienced, and expect to continue to experience, intentional misuse of our services and user data by third parties, as well as other undesirable, illicit, or high-risk activity on our platform. We are making significant investments in privacy, safety, security, and content and advertising review efforts to combat these activities, including investigations and audits of platform applications, as well as other enforcement efforts.”

Annual report 2025A · The company itself

“Our business and financial performance may be adversely affected by a cybersecurity attack. We rely on our technology infrastructure to interact with suppliers, sell our products and services, fulfill orders, support our customers, and bill, collect, and make payments.”

Annual report 2025A · The company itself

“We are vulnerable to system failures and data loss risks, which could harm our business. We rely on our technology infrastructure to interact with suppliers, sell our products and services, support our customers, fulfill orders, and bill, collect, and make payments. Our systems are vulnerable to damage or interruption from natural disasters, power loss, telecommunication failures, malicious employees or employee negligence, computer viruses, and other events.”

Annual report 2025A · The company itself

“By way of example, in September 2023, we experienced a cybersecurity issue affecting certain of our systems, in which criminal actors may have accessed certain personal information of some of our customers (the “Cybersecurity Issue”). Among other things, this issue resulted in system shutdowns that created operational disruptions at our domestic properties, adversely affected revenues, and subjected us to litigation, investigations, and potential regulatory penalties or other remedies.”

Annual report 2025A · The company itself

“Business interruptions to our operations or those of our key vendors, licensees or customers could harm our business. Operations at any of our facilities, at the facilities of any of our wafer fabrication or assembly and test subcontractors, or at any of our significant vendors, licensees or customers may be disrupted due to public health concerns (including outbreaks such as COVID-19), work stoppages or reduction in available labor, power loss, insufficient water, cyber-attacks, computer network compromises, incidents of terrorism or security risk, tariffs, political instability, governmental actions, telecommunications, transportation or other infrastructure failure, radioactive contamination, adverse changes in climate, or fires, earthquakes, floods, droughts, volcanic eruptions or other natural disasters.”

Annual report 2026A · The company itself

“For example, in August 2024, we determined that an unauthorized party disrupted our use of certain servers and some of our business operations. As a result, certain of our manufacturing facilities were operating at less than normal levels for a period of time, and our ability to fulfill orders was temporarily impacted.”

Annual report 2026A · The company itself

“Interruptions in and unauthorized access to our IT systems, security breaches or incidents impacting our systems or data that we or our service providers maintain or otherwise process including data belonging to us, or our customers, suppliers, contractors or employees, could adversely affect our business.”

Annual report 2026A · The company itself

“Due to the types of products we sell and the significant amount of sales we make to government agencies or customers whose principal sales are to U.S. government agencies, we have experienced and expect to continue to experience in the future, attacks on our IT systems and data, including attempts to breach our security, network compromises and attempts to introduce malicious software into our IT systems. Geopolitical events and tensions may increase these risks.”

Annual report 2026A · The company itself

“As AI and machine learning evolve, they may lead to the development of dramatically more effective security tools, and cyber‑attackers may leverage these tools to enhance attack methods, identify novel security vulnerabilities, develop malicious code, sophisticated phishing attempts, and convincing deep fakes that manipulate our content or the voices or images of our leaders.”

Annual report 2026A · The company itself

“Employees, consultants or partners may use AI tools in a manner posing risks to proprietary, confidential or regulated information and to intellectual property rights. The use of AI tools may result in allegations or claims relating to violation of third‑party IP rights, unauthorized access to or use or processing of proprietary, confidential or personal information, failure to comply with open‑source software requirements, or other legal or contractual obligations.”

Annual report 2026A · The company itself

“We face risks related to security vulnerabilities in our products. Our products, or IP that we purchase or license from third parties for use in our products, as well as industry-standard specifications that we implement in our products, may be subject to security vulnerabilities.”

Annual report 2026A · The company itself

“Our products are being used in application areas that create new or increased cybersecurity, privacy or safety risks including applications that gather and process data, such as the cloud or IoT, automotive applications, and applications that use AI.”

Annual report 2026A · The company itself

“There may be increased risk associated with the activities of the acquired company such as regulatory violations related to their use of AI in their operations, technology development or product offerings or cybersecurity or data governance risks.”

Annual report 2026A · The company itself

“The increasing use of our products in interconnected, autonomous, safety‑critical, defense‑related, and AI‑enabled systems may expose security vulnerabilities beyond traditional software exploits, including firmware, embedded functionality, or interactions with third‑party systems, which may only become apparent after large‑scale deployment.”

Annual report 2026A · The company itself

“In addition, employees and former employees, in particular former employees who become employees of our competitors, customers, licensees, or other third parties, including state actors, have in the past and may in the future misappropriate, wrongfully use, publish, access, process or provide to our competitors, customers, licensees or other third parties, including state actors, our technology, intellectual property, or other proprietary or confidential information.”

Annual report 2026A · The company itself

“These service providers also face significant cybersecurity threats, and they may be subject to cyber-attacks, disruptions, and interruptions to their networks and systems, and otherwise may suffer from security breaches and incidents. Any such breach or incident, including any involving misappropriation, loss or other unauthorized processing of data or software maintained or otherwise processed by our third-party service providers, or any perception any of these has occurred, could negatively impact our business, operations and financial results, as well as our relationship with our customers.”

Annual report 2026A · The company itself

“Continuity of business applications and services has been, and may in the future be, disrupted by events such as viruses or malware; other cybersecurity attacks; issues with or errors in systems’ maintenance or security; power outages; hardware or software failures; denial of service attacks; telecommunication failures; natural disasters; terrorist attacks; and other catastrophic occurrences.”

Annual report 2025A · The company itself

“Our use of third-party technology and business service providers may expose us to cybersecurity and privacy breaches.”

Annual report 2025A · The company itself

“These can include: (1) compromises of security systems, which could involve circumvention, denial-of-service attacks, or other cyberattacks such as hacking, phishing attacks, computer viruses, ransomware, malware or cyber extortion and (2) internal threats such as employee or insider errors, malfeasance, deepfake or social engineering schemes, physical breaches or other actions or attempts to exploit vulnerabilities.”

Annual report 2025A · The company itself

“Furthermore, the rapid evolution and increased adoption of artificial intelligence may intensify our cybersecurity risks and create new vectors of exposure.”

Annual report 2025A · The company itself

“Moody’s ability to conduct business may be materially and adversely impacted by a disruption in the infrastructure that supports its businesses and the communities in which Moody’s has large employee populations, including: (i) New York City, the location of Moody’s headquarters, (ii) India, (iii) major cities worldwide in which Moody’s has offices, and (iv) locations that may be affected by the Russia-Ukraine military conflict and the military conflicts in the Middle East. This may include a disruption involving physical or technological infrastructure (whether or not controlled by the Company), including the Company’s electronic delivery systems, the Company's data center facilities, or the Internet, used by the Company or third parties with or through whom Moody’s conducts business.”

Annual report 2025A · The company itself

“In addition, in the ordinary course of business, suppliers of Vendor Products are subject to various forms of cyber-attacks or other security incidents. Cyber-attacks, vulnerabilities in our suppliers’ software, systems or networks, failure of our suppliers’ safeguards, policies or procedures and other incidents related to our suppliers’ systems and networks, including supply-chain compromises, may cause material interruptions or malfunctions in our or such suppliers’ websites, applications or data processing and delivery, or may compromise the confidentiality and integrity of affected information.”

Annual report 2025A · The company itself

“Technology Risks Any failures, disruptions, instability or vulnerabilities in our information technology architecture, platforms, vendors and service providers, production and delivery systems, software, code, networks, the internet or other systems may disrupt our operations, 18 Table of Contents cause our products or services to be unavailable or fail and impose delays or additional costs, or impose conditions or restrictions on our products or services and have a material adverse effect on our business, financial condition or results of operations.”

Annual report 2025A · The company itself

“If our processes, confidentiality policies, conflict of interest policies or information barrier procedures fail or are insufficient, including as a result of intentional or unintentional human error, manual process failure, system error or other failure, then unauthorized release of, access to, or disclosure or misappropriation of data, including material non-public information or other confidential information (e.g., certain client portfolio data, index composition data, or ESG rating data), could harm our brand and reputation, lead to litigation, regulatory actions or penalties, and result in a loss of client confidence, which could have a material adverse effect on our business, financial condition or results of operations.”

Annual report 2025A · The company itself

“We 19 Table of Contents and our vendors and service providers are subject to security risks, including cyber-attacks and other security incidents, such as phishing scams or other social engineering attacks, deepfake attacks, hacking, tampering, intrusions, viruses, malware (including ransomware) and denial-of-service attacks – all of which could be exacerbated by AI technologies.”

Annual report 2025A · The company itself

“We may be exposed to more targeted and more sophisticated cyber-attacks and other security incidents because of our role or prominence in the global marketplace, including our handling of client portfolio data, the composition and use of our indexes and ESG ratings.”

Annual report 2025A · The company itself

“The use of AI by us or by others may also result in, and increase our exposure to, cyber-attacks or other security incidents, including those that involve confidential or personal information (e.g., proprietary, third-party, employee or client information).”

Annual report 2025A · The company itself

“Bedrägerier, som tyvärr är ett starkt ökande hot för många företag och konsumenter i Sverige.”

Annual report 2024A · The company itself

“System limitations or failures could harm our business. Our businesses depend on the integrity and performance of the technology, computer and communications systems supporting them.”

Annual report 2025A · The company itself

“If a material cybersecurity or other security breach impacts our services, systems, supply chain, or end-user customer systems, or if stored data is improperly accessed, our business could suffer significant harm. We store and transmit, and sell products and services that store and transmit, personal, sensitive and proprietary data related to our products, our employees, customers, partners (including third-party vendors such as data centers and providers of SaaS, cloud computing, and internet infrastructure and bandwidth), and their respective customers. This data includes intellectual property, records, and personal information.”

Annual report 2026A · The company itself

“Cyber-attacks and security breaches continue to increase, and of particular concern are supply-chain attacks against software development and breaches of technology service providers. We anticipate that cyberattacks will continue to increase in the future given cyber warfare has become a consistent lever within geopolitical conflicts and increasingly leverages hacktivism.”

Annual report 2026A · The company itself

“In addition, many of our products use open-source software, which generally does not provide any warranty or contractual protection and may be susceptible to compromise and supply-chain attacks by threat actors. Further, open-source or third-party software may contain vulnerabilities, which may or may not be known at the time of our inclusion of the software in a product.”

Annual report 2026A · The company itself

“The threat level under which Netcompany operates is ever-increasing... Cyber risks is one of our highest-scored risks”

Annual report 2025B · From the report

“A data breach in a Netcompany-supported project or client system may result in legal liabilities and remediation costs for us.”

Annual report 2025A · The company itself

“Data breach or cyber incidents (involving personal data) Data breaches and cyber incidents necessitate immediate action to stop and contain the breach. If we identify a breach, we notify our clients, who subsequently reach out to the implicated users.”

Annual report 2025A · The company itself

“System Resilience: We have established procedures for the effective management and rapid resolution of system downtime or failures. All relevant employees receive ongoing training in these methods to guarantee consistent and secure delivery of complex IT services.”

Annual report 2025A · The company itself

“Read more about our strategy Executive summary Financial review Corporate governance Sustainability statements Financial statements Social S4 Consumers and end-users 4S4 Data breaches or cyber incidents (involving personal data) Ensuring access to products and services Regular phishing email simulation train employees to recognise and report threats. Successful detection is acknowledged; failures are used as learning opportunities.”

Annual report 2025A · The company itself

“The Company and its payment processing partners also experience fraudulent use of payment methods and may experience unauthorized access to payment systems, and these efforts are becoming increasingly sophisticated, including from the use of AI tools. If the Company is unable to maintain its fraud and chargeback rates at acceptable levels, card networks may impose fines and additional card authentication requirements or terminate the Company’s ability to process payments. Measures the Company implements to reduce fraud may not be effective and may add friction to the subscription or payment process. The loss of the Company’s ability to process payments via any major payment method would adversely affect its business and results of operations.”

Annual report 2026A · The company itself

“Table of Contents The risks associated with cyberattacks are increasing, particularly as AI use continues to grow and the Company’s digital businesses expand. The number of cyberattacks continues to rise, and such attacks are becoming increasingly more sophisticated, targeted and difficult to detect, mitigate, prevent and remedy, particularly with the evolution of AI capabilities, including those that facilitate the discovery and exploitation of vulnerabilities.”

Annual report 2026A · The company itself

“We rely significantly on information technology to operate our business, including our supply chain and retail operations, and any failure, inadequacy or interruption of that technology could harm our ability to effectively operate our business. We are heavily dependent on Information Technology Systems, across our supply chain, including product design, production, forecasting, ordering, manufacturing, transportation, sales and distribution, as well as for processing financial information for reporting purposes, retail operations and other business activities. Information Technology Systems are critical to our operating activities and our business processes and may be negatively impacted by any service interruption or shutdown.”

Annual report 2026A · The company itself

“Our distribution, transmission and generation activities involve a variety of inherent hazards and operating risks, including potential public safety risks. Our gas distribution and transmission activities and our electric generation, transmission and distribution activities involve a variety of inherent hazards and operating risks, including, but not limited to, gas leaks and over-pressurization, downed power lines, stray electrical voltage, excavation or vehicular damage to our infrastructure, outages, environmental contamination, mechanical problems, damage from weather events, and other incidents, which could cause substantial financial losses. These hazards and risks have resulted and may result in serious injury or loss of life to employees and/or the general public, significant damage to property, environmental pollution, impairment of our operations, adverse regulatory rulings and reputational harm, which in turn could lead to substantial business and financial losses.”

Annual report 2025A · The company itself

“The implementation of the EU NIS2 directive, which expands obligations related to network and information security, has further reinforced NNIT’s dedication”

Annual report 2025A · The company itself

“NNIT is exposed to cybersecurity-related risks that have the potential to harm or damage computer systems, networks, or digital environments.”

Annual report 2025A · The company itself

“Failure to repel cybersecurity risks can lead to business disruptions, contract breach, data loss, regulatory implications & penalties and reputational damage.”

Annual report 2025A · The company itself

“Our systems involve the storage, transmission and other processing of clients’ and our personal, proprietary, confidential and sensitive information, and security breaches, including cyber-attacks or other information security incidents, have previously exposed us and could in the future expose us to theft, loss, destruction, gathering, monitoring, dissemination, misappropriation, misuse, alteration, or unauthorized disclosure of or unauthorized access to this information. Despite our implementation of a variety of security measures, our computer systems, networks, and data, including clients’ or our personal, proprietary, confidential and sensitive information, could be subject to cyber-attacks or other information security incidents, such as, among other things, from physical and electronic break-ins or unauthorized tampering, theft, malware and computer virus attacks, ransomware attacks, social engineering attacks (including phishing and vishing attacks), credential stuffing, account takeovers, insider threats or denial-of-service attacks.”

Annual report 2025A · The company itself

“Reliance on mobile or cloud technology or any failure by mobile technology and cloud service providers to adequately safeguard their systems and networks and prevent cyber-attacks or other information security incidents could disrupt our operations or the operations of our or their service providers and result in misappropriation, corruption or loss of personal, confidential, proprietary, or other sensitive information or the inability to conduct ordinary business operations.”

Annual report 2025A · The company itself

“We and our clients have been, and expect to continue to be, subject to a wide variety of cyber-attacks and other similar threats, including computer viruses, ransomware and other malicious code, distributed denial-of-service attacks, and phishing and vishing attacks, and it is possible that we could suffer material losses resulting from a breach. Because the techniques used to obtain unauthorized access, disable or degrade service or sabotage systems and networks change frequently and often are not recognized until launched against a target, we may be unable to anticipate these techniques, to implement adequate preventative measures, or to address them until they are discovered.”

Annual report 2025A · The company itself

“We could be the subject of legal claims or proceedings related to information security incidents, including regulatory investigations and other legal actions, carrying the potential for damages, fines, sanctions or other penalties, injunctive relief requiring costly compliance measures and reputational damage. Further, the market perception of the effectiveness of our information security measures could be harmed, our reputation could suffer and we could lose clients in conjunction with security incidents, each of which could have a negative effect on our business, financial condition and results of operations.”

Annual report 2025A · The company itself

“Operational Risk Overview Operational risk is inherent in each of Northern Trust’s businesses and corporate functions and reflects the potential for inadequate information systems, operating problems, challenges related to reliance on third parties, product design and delivery difficulties, potential legal actions or catastrophes to result in losses. This includes the potential that continuity of service and resilience may be impacted. Operational risk includes information technology and cybersecurity, compliance, fiduciary and legal risks, which under the Corporation’s risk structure are governed and managed explicitly.”

Annual report 2025A · The company itself

“Among other things, actual or threatened natural disasters, information systems failures, computer viruses, denial-of-service attacks and other cybersecurity incidents may cause disruptions to our information systems, telecommunications and other networks.”

Annual report 2025A · The company itself

“Despite robust cybersecurity measures, the Company has experienced cyber-attacks in the past and expects such threats to continue to evolve, including increasing in magnitude and sophistication.”

Annual report 2025A · The company itself

“We have experienced and expect to continue to experience disruptions, failures or breaches of our information technology environment, such as those caused by computer viruses, illegal hacking, criminal fraud or impersonation, acts of vandalism or terrorism or employee error. Our cybersecurity measures and/or those of our third-party service providers and/or customers may not detect or prevent such security breaches.”

Annual report 2025A · The company itself

“Our operations are subject to all the risks and hazards typically associated with the operation of gathering, transportation and distribution pipelines, storage facilities and processing and fractionation facilities, which include, but are not limited to, leaks, pipeline ruptures, damage by third parties, the breakdown or failure of equipment or processes and the performance of facilities below expected levels of capacity and efficiency. Other operational hazards and unforeseen interruptions include adverse weather conditions (including extreme cold weather), public health crises including a pandemic, cybersecurity attacks, geopolitical events, accidents, explosions, fires, the collision of equipment with our pipeline facilities (for example, this may occur if a third party were to perform excavation or construction work near our facilities) and catastrophic events such as tornados, hurricanes, earthquakes, floods and other similar events beyond our control.”

Annual report 2025A · The company itself

“A breach of information security, including a cybersecurity attack, or failure of one or more key information technology or operational systems, or those of third parties, may adversely affect our operations, financial results or reputation. Our businesses are dependent upon our operational systems to process a large amount of data and complex transactions.”

Annual report 2025A · The company itself

“According to experts, there has been a rise in the number and sophistication of cyberattacks on companies’ network and information systems by both state-sponsored and criminal organizations and, as a result, the risks associated with such an event continue to increase. A significant failure, compromise, breach or interruption in our systems, or those of our vendors or counterparties, could result in a disruption of our operations, physical or environmental damages, customer dissatisfaction, damage to our reputation and a loss of customers or revenues.”

Annual report 2025A · The company itself

“Cyberattacks against us or others in our industry could result in additional regulations or cumbersome contractual obligations. Current efforts by the federal government, such as the Improving Critical Infrastructure Cybersecurity executive order, and the TSA security directives, have utilized significant internal and external resources, and any potential future statutes, regulations or orders could lead to further increased regulatory compliance costs, insurance coverage costs or capital expenditures.”

Annual report 2025A · The company itself

“Orkla er avhengig av data og teknologi, og med større geopolitiske spenninger ser man et økende antall angrep. Selv om antallet observerte blokkeringsangrep har gått ned, er det en økning i mer sofistikerte cyberangrep hvor hackere forsøker å stjele data blant annet for økonomisk vinning.”

Annual report 2024A · The company itself

“We, and the third-party vendors upon which we rely, have experienced, and may in the future experience, cybersecurity attacks and threats, including threats or attempts to disrupt our information technology infrastructure and unauthorized attempts to gain access to sensitive or confidential information. Our and our third-party vendors’ technology systems have been, and in the future may be, damaged, disrupted, or compromised by harmful events, including malicious activities, natural occurrences, inadvertent errors, cybersecurity incidents or cyberattacks (including computer viruses, ransomware, and other malicious and destructive code, phishing attacks, and denial of service attacks), physical or electronic security breaches and incidents, natural disasters, fire, power loss, telecommunications failures, personnel misconduct, and human error.”

Annual report 2025A · The company itself

“We have experienced, and may in the future experience, disruptions, failures, data loss, corruption, unavailability, outages, and other performance problems with our infrastructure or cloud-based offerings due to a variety of factors, which have included or may in the future include infrastructure changes, introductions of new functionality, human or software errors, employee misconduct, capacity constraints, denial of service attacks, phishing attacks, computer viruses, ransomware, and other malicious or destructive code, or other security-related incidents, and our disaster recovery planning may not be sufficient for all situations. If we experience disruptions, failures, data loss, outages, or other performance problems, our business, financial condition, and results of operations could be adversely affected.”

Annual report 2025A · The company itself

“If these systems, or any part of the systems, are damaged, intruded upon, attacked, shut down or cease to function properly (whether by planned upgrades, force majeure, telecommunications failures, criminal acts, including hardware or software break-ins or extortion attempts, or viruses, or other cybersecurity incidents) and we suffer any resulting interruption in our ability to manage and operate our business or if our products are affected, our results of operations and financial condition could be materially adversely affected. The sophistication of cyber threats continues to evolve and grow, including the risk associated with the use of artificial intelligence and quantum computing by threat actors to conduct more targeted and evasive attacks.”

Annual report 2026A · The company itself

“We could be subject to reduced revenues, increased costs, liability claims, or harm to our competitive position as a result of cyberattacks, security vulnerabilities or Internet disruptions. We rely upon information technology (“IT”) networks, cloud-based platforms, and systems to process, transmit, and store electronic information, and to support a variety of business processes, some of which are provided by third-party vendors. Cyberattacks and security threats are a risk to our business and reputation.”

Annual report 2026A · The company itself

“Data Security and Privacy Leaks: We collect, use, and retain increasingly large amounts of personal information about our customers, employees of our customers, our employees, and other third parties, including: bank account, credit card, social security numbers, tax return information, health care information, retirement account information, payroll information, system and network passwords, and other sensitive personal and business information. At the same time, the continued occurrence of high-profile cyber and ransomware attacks and data breaches provides evidence of an external environment increasingly hostile to information security. We may be particularly targeted for cyberattack because of the amount and type of personal and business information that we collect, use, and retain, as well as during and after periods in which we acquire other companies.”

Annual report 2026A · The company itself

“Techniques used to attempt to obtain unauthorized or illegal access to systems and information (including customers’ personal data), disable or degrade service, exploit vulnerabilities, or sabotage systems are continuously evolving. These attempts may not be recognized or detected until after they have been launched against a target.”

Annual report 2025A · The company itself

“We believe that hostile actors, who may comprise individuals, coordinated groups, sophisticated organizations, or nation-state supported entities, may target PayPal due to our name, brand recognition, types of data (including sensitive payments- and identity-related data) that customers provide to us, and the widespread adoption and use of our products and services.”

Annual report 2025A · The company itself

“We hold our customers’ cryptocurrency assets through one or more third-party custodians. Financial and third-party risks related to our customer cryptocurrency offerings, such as inappropriate access to, theft, or destruction of cryptocurrency assets held by our custodians, insufficient insurance coverage by a custodian to fully reimburse us for such losses, a custodian’s failure to maintain effective controls over the custody and settlement services provided to us, a custodian’s inability to purchase or liquidate cryptocurrency holdings, the failure of the PYUSD Issuer to maintain sufficient reserve assets backing PYUSD, and defaults on financial or performance obligations by a custodian, banks with which the PYUSD Issuer maintains reserve assets or counterparty financial institutions, could expose us and our customers to loss and significantly harm our business, financial condition, and reputation.”

Annual report 2025A · The company itself

“Our business has in the past and could in the future be negatively affected by security incidents, systems disruptions or shutdowns or degraded systems performance. These incidents or disruptions may be caused by cyberattacks and other cyber incidents, network or power outages, software, equipment or telecommunications failures, the unintentional or malicious actions of employees or contractors, natural disasters, fires or other catastrophic events.”

Annual report 2025A · The company itself

“In addition, the rapid evolution and increased adoption of artificial intelligence technologies may increase our cybersecurity risks, including generative artificial intelligence augmenting threat actors’ technological sophistication to enhance existing or create new malware.”

Annual report 2025A · The company itself

“If we do not allocate and effectively manage the resources necessary to continue building and maintaining our information technology infrastructure, or if we fail to timely identify or appropriately respond to cyberattacks or other cyber incidents, our business has been and can continue to be adversely affected, which has resulted in and can continue to result in some or all of the following: transaction errors, processing inefficiencies, inability to access our data or systems, lost revenues or other costs resulting from disruptions or shutdowns of offices, plants, warehouses, distribution centers or other facilities, compromises of personal data, confidential information, intellectual property or other sensitive data, litigation, claims, legal or regulatory proceedings, inquiries or investigations, fines or penalties, remediation costs, damage to our reputation or a negative impact on employee morale and the loss of current or potential customers.”

Annual report 2025A · The company itself

“INFORMATION TECHNOLOGY AND CYBERSECURITY Significant disruptions of IT systems or breaches of information security could adversely affect our business.”

Annual report 2025A · The company itself

“As a global pharmaceutical company, our systems and assets are the target of frequent cyber-attacks. Such cyber-attacks are of ever-increasing levels of sophistication, including the use of adversarial AI techniques (for example, AI may be used to automate phishing attacks and other forms of social engineering, and accelerate vulnerability exploitation), and are made by groups and individuals with a wide range of motives (including, but not limited to, industrial espionage, extortion, property destruction and personal information theft) and expertise, including, but not limited to, organized criminal groups, “hacktivists,” nation states, employees, business partners and others.”

Annual report 2025A · The company itself

“A prolonged disruption at or shut-down of one or more of the facilities where our products or product components are produced, or sourced from, especially our ZYN production facility in Kentucky, U.S., which currently supplies substantially all of our capacity for ZYN sales in the U.S., due to natural- or man-made disasters or other events outside of our control, such as equipment malfunction or widespread outbreaks of acute illness, including COVID-19, supply chain constraints, a cybersecurity incident, or for any other reason, could limit our capacity to meet customer demands.”

Annual report 2025A · The company itself

“Risks Related to Cybersecurity, Data Governance and Artificial Intelligence We are significantly dependent on our and third-party information technology networks and systems, and a cybersecurity incident or attack against those networks or systems may adversely impact our business and operations. We and our business partners heavily rely on information technology networks and systems, including those connected to the Internet, to help manage business processes and operations, including the collection, storage, interpretation, and processing of confidential, sensitive, personal and other data; internal and external communications; marketing and e-commerce activities; the manufacture, sale, and distribution of our products; management of third-party business relationships; engagement with governmental authorities; innovation through research and development; and other activities necessary for business operations.”

Annual report 2025A · The company itself

“The failure or disruption of our information technology networks and systems, or those managed by third-party service providers or owned by our business partners and used in furtherance of PMI’s business, due to cybersecurity attacks; unauthorized attempts to corrupt or extract data; security vulnerabilities; failure to timely respond and mitigate cybersecurity risks; misconfigurations; human error; or failure or inability by us, third-parties, or our business partners to adhere to cybersecurity industry best practices, could place us at a competitive disadvantage, cause reputational damage, impact our operations, result in data breaches, significant business disruption, litigation, regulatory action including significant fines or penalties, financial impact, loss of revenue or assets including our intellectual property, personal, confidential, or sensitive data.”

Annual report 2025A · The company itself

“The most significant risks are cyber-attacks on infrastructure or hardware and the resulting reputational damage and potential liability for damages.”

Annual report 2025A · The company itself

“Numerous functions affecting the efficient operation of our businesses are dependent on the secure and reliable storage, processing and communication of electronic data and the use of sophisticated computer hardware and software systems and network infrastructure. The operation of our transmission and distribution systems, including gas distribution systems, as well as our generation plants, are all reliant on cyber-based, complex and integrated technologies.”

Annual report 2025A · The company itself

“In addition, these complex systems are subject to the risk that they could be the target of disruptive actions by terrorists, nation state actors or criminals or otherwise be compromised. Attacks may come through ransomware, software updates or patches, use of opensource software, firmware that hackers can manipulate to include malicious codes for exploitation at a later date, or the compromising of hardware by bad actors, creating serious risks to our security, the security of our customers' information, and potentially to our ability to provide power.”

Annual report 2025A · The company itself

“IT- & informationssäkerhet Pricers verksamheter är i hög grad beroende av en välfungerande IT-miljö. Avbrott och störningar i IT-systemen kan få konsekvenser. Vidare kan intrång i IT-miljön eller brister i hantering av kund-, medarbetarinformation eller affärskritiska data som hanteras i IT-miljön leda till minskat förtroende samt innebära en negativ påverkan på koncernens resultat.”

Annual report 2024A · The company itself

“Fraudulent claims may increase both claims and operational expenses. Customers may be targeted by fraudsters, creating financial and reputational risk. This can result in financial risks in circumstances where we make our customers and participants whole if the theft occurred by a defeat of our fraud prevention and detection processes.”

Annual report 2025A · The company itself

“Risks relating to computer cyber-terrorism, crisis on a national or global scale, climate change or other catastrophic events Interruptions in information technology, infrastructure or other internal or external systems used for our business operations, or a failure to maintain the confidentiality, integrity or availability of data residing on such systems, could disrupt our business, damage our reputation and adversely impact our profitability. Disruptions in information technology systems or cybersecurity breaches may impair operations and damage our reputation. In addition, we store and process confidential and proprietary business information on both company-owned and third party and/or vendor managed systems, including cloud service providers.”

Annual report 2025A · The company itself

“A significant information security or operational technology incident, including a cybersecurity incident, or the failure of one or more key information or operations technology systems, networks, hardware, processes and/or associated sites involving the Company or one of its service providers could have a material adverse impact on our business or reputation. We rely extensively on information and operational technology (IT/OT) systems, networks and services, including internet and intranet sites, data hosting and processing facilities and technologies, physical security systems and other hardware, AI, software and technical applications and platforms.”

Annual report 2026A · The company itself

“Increasing and evolving information security threats, including advanced persistent cybersecurity threats and the use of AI to autonomously find and exploit weaknesses, obtain information, craft social engineering content and execute large-scale attacks with increased speed and minimal human effort, pose a risk to the security of our services, systems, networks and supply chain, as well as the confidentiality, availability and integrity of our data and of our critical business operations.”

Annual report 2026A · The company itself

“Our IT/OT databases and systems and our third-party providers’ databases and systems have been, and will likely continue to be, subject to advanced computer viruses or other malicious codes, ransomware, unauthorized access attempts, denial of service attacks, phishing (including the use of adversarial AI techniques), social engineering, credential stuffing, automated vulnerability discovery, data encryption or exfiltration, deep fakes, hacking, supply chain software compromise and other cyber-attacks. Such attacks may originate from outside parties, hackers, criminal organizations or other threat actors, including nation states.”

Annual report 2026A · The company itself

“Our business and operations could suffer in the event of system failures, cybersecurity attacks or risks associated with AI. Despite system redundancy, the implementation of security measures and the existence of a disaster recovery plan for our internal and hosted information technology systems, our systems are vulnerable to damages from any number of sources, including energy blackouts, natural disasters, terrorism, war, adverse impacts of AI, telecommunication failures and cybersecurity attacks, such as malware, ransomware, or unauthorized access.”

Annual report 2025A · The company itself

“We may be adversely affected by asset and equipment failures, gas explosions, accidents, critical operating technology or business system failures, natural disasters, severe weather events, acts of war or terrorism or other acts of violence, sabotage, physical attacks or security breaches, cyberattacks, or other incidents, including pandemics, that impact our ability to provide safe and reliable service to our customers and remain competitive and could result in substantial financial losses.”

Annual report unknown yearA · The company itself

“If we fail to execute supply strategies that provide supply assurance, technology leadership and reasonable margins, our business and results of operations may be harmed. We are also subject to order and shipment uncertainties that could negatively impact our results of operations. •There are numerous risks associated with the operation and control of our manufacturing facilities, including a higher portion of fixed costs relative to a fabless model; environmental compliance and liability; impacts related to climate change; exposure to natural disasters, health crises, geopolitical conflicts and cyber-attacks; timely supply of equipment and materials; and various manufacturing issues.”

Annual report 2025A · The company itself

“RISKS RELATED TO PRODUCT DEFECTS OR SECURITY VULNERABILITIES •Failures in our products, or in the products of our customers or licensees, including those resulting from security vulnerabilities, defects or errors, could harm our business.”

Annual report 2025A · The company itself

“Our manufacturing operations could also be disrupted by cyber-attacks on our IT systems, as described in the Risk Factor below titled “Our business and operations could suffer in the event of security breaches of our IT systems, or other misappropriation of our technology, intellectual property or other proprietary or confidential information.””

Annual report 2025A · The company itself

“RISKS RELATED TO CYBERSECURITY OR MISAPPROPRIATION OF OUR CRITICAL INFORMATION Our business and operations could suffer in the event of security breaches of our IT systems, or other misappropriation of our technology, intellectual property or other proprietary or confidential information. The successful operation of various functions within our business, as well as the protection of our intellectual property and other proprietary or confidential information, depend in part on the security and functionality of our IT systems. Third parties regularly attempt to gain unauthorized access to our IT systems, and many such attacks are increasingly more sophisticated.”

Annual report 2025A · The company itself

“These attacks, which might be related to industrial, corporate or other espionage, criminal hackers or state-sponsored intrusions, include trying to covertly introduce malware to our computers and networks, including those in our manufacturing operations, exploiting vulnerabilities in hardware, software or other IT infrastructure and impersonating authorized users, among others.”

Annual report 2025A · The company itself

“We are also subject to ransom-style cyber-attacks, which could expose our confidential or proprietary information, demand payment of money and/or impact our IT systems and cause widespread disruption to our business, including our manufacturing operations.”

Annual report 2025A · The company itself

“Third parties that store and/or process our confidential information, or that provide products, software or services used in our IT infrastructure, are subject to similar attacks, which could also result in malware being introduced into our IT infrastructure, e.g., through the third parties’ software and/or software updates. Such attacks could result in the misappropriation, theft, misuse, disclosure, loss or destruction of the technology, intellectual property, or the proprietary, confidential or personal information, of us or our employees, customers, licensees, suppliers or other third parties, as well as damage to or disruptions in our IT systems.”

Annual report 2025A · The company itself

“For example, as AI continues to evolve, cyber-attackers could also use AI to develop malicious code and increasingly sophisticated phishing attempts.”

Annual report 2025A · The company itself

“In addition, employees and former employees, in particular former employees who become employees of our competitors, customers, licensees or other third parties, including state actors, have in the past and may in the future misappropriate, wrongfully use, publish or provide to our competitors, customers, licensees or other third parties, including state actors, our technology, intellectual property or other proprietary or confidential information. This risk is exacerbated as competitors for talent, particularly engineering talent, increasingly attempt to hire our employees.”

Annual report 2025A · The company itself

“Similarly, we provide access to certain of our technology, intellectual property and other proprietary or confidential information to our direct and indirect customers and licensees and certain of our consultants, who have in the past and may in the future wrongfully use such technology, intellectual property or information, or wrongfully disclose such technology, intellectual property or information to third parties, including our competitors or state actors.”

Annual report 2025A · The company itself

“Additionally, increasing use of AI by our employees and in our internal systems may create new attack surfaces or methods for malicious actors, and may increase the risk of unintended or inadvertent transmission of our proprietary or confidential information.”

Annual report 2025A · The company itself

“Our IT systems have been and are subject to potential cyberattacks, tampering or other security breaches. These attacks, if successful, could result in shutdowns or significant disruptions of our IT systems and/or in unauthorized persons exfiltrating and misappropriating intellectual property and other confidential information, including patient and employee data that we collect, transmit and store on and through our IT systems.”

Annual report 2025A · The company itself

“Additionally, new technology that we deploy to automate processes, improve customer 36 Table of Contents service, generate insights from lab and other data and stimulate innovation to improve operational efficiency, including the expanded use of AI, may further expose our IT systems to the risk of cyberattacks and may create the need for rapid modifications to our cybersecurity program.”

Annual report 2025A · The company itself

“For example, in June 2019, the Company reported that Retrieval-Masters Creditors Bureau, Inc./American Medical Collection Agency (AMCA), informed the Company that an unauthorized user had access to AMCA’s system. AMCA previously provided debt collection services for the Company and provided debt collection services for a company that provides revenue management services to the Company.”

Annual report 2025A · The company itself

“(n) Failure of the Company to maintain, defend and secure its financial, accounting, technology, customer data and other operational systems from cyberattacks, IT system outages, telecommunications failures, malicious human acts and failure of the systems of third parties upon which the Company relies.”

Annual report 2025A · The company itself

“Like other financial services firms, we experience malicious cyber activity directed at our computer systems, software, networks, and users on a daily basis. This malicious activity includes attempts at unauthorized access, implantation of computer viruses or malware, and denial-of-service attacks. We also experience large volumes of phishing and other forms of social engineering (including through the use of AI) attempted for the purpose of perpetrating fraud against the firm, our associates, or our clients.”

Annual report 2025A · The company itself

“We, like all businesses, are subject to cyberattacks and security incidents, which threaten the confidentiality, integrity and availability of our systems and information resources. Cyberattacks are malicious cyber activity and a security incident is a successful cyberattack that has the potential to expose sensitive data, internal systems or otherwise disrupt business operations. Those cyberattacks and security incidents may be due to intentional or unintentional acts by employees, contractors or third parties, who seek to gain unauthorized access to our or our service providers’ systems to disrupt operations, corrupt data or steal confidential information through malware, computer viruses, ransomware, social engineering (e.g., phishing attachments to e-mails) or other vectors.”

Annual report 2025A · The company itself

“We receive, collect, store, maintain, transfer, submit, and otherwise process personal user, employee, advertiser, and other personal, confidential, or sensitive information, and data breaches and other data security incidents expose us to a risk of loss of, or unauthorized access to, this personal information, litigation, and potential liability.”

Annual report 2025A · The company itself

“We have experienced in the past, and may in the future experience, cybersecurity attacks (including denial of service, phishing, social engineering, ransomware, malware, and integrity attacks), computer viruses, software bugs, internet interruptions, disruptions, or losses, spam or other attacks, breach by intentional or negligent conduct, theft or fraud on the part of employees or other third parties, including state-sponsored organizations with significant financial and technological resources, terrorism, improper operation, data loss, coding or configuration errors, credential stuffing, human error, natural disasters, and other security breaches, and as a result, unauthorized parties may impede or deny access to our platform or otherwise obtain access to our data or Redditors’ or advertisers’ data, including personal information.”

Annual report 2025A · The company itself

“For example, in February 2023, we experienced a data security incident in which an attacker was able to obtain an employee’s login credentials to gain access to certain contact information, internal documents, source code, and other internal business information.”

Annual report 2025A · The company itself

“In addition, our products operate in conjunction with, and we are dependent upon, third-party products and components across a broad ecosystem. There have been in the past, and may in the future be, significant attacks on certain of our third-party providers, such as the LastPass cybersecurity incidents in 2022.”

Annual report 2025A · The company itself

“Significant disruptions of information technology systems or breaches of data security could adversely affect our business. Our business is increasingly dependent on critical, complex, and interdependent information technology systems, including Internet-based systems, to support business processes as well as internal and external communications. The size and complexity of our computer systems could give rise to unidentified or unremedied systems weaknesses or breakdowns and malicious intrusions, which could impact key business processes, including those related to drug manufacturing.”

Annual report 2025A · The company itself

“In addition, our systems are potentially vulnerable to data security breaches – whether by employees or others – which may expose sensitive data to unauthorized persons. Data security breaches could lead to the loss of trade secrets or other intellectual property, result in demands for ransom or other forms of extortion, or lead to the public exposure of personal information (including sensitive personal information) of our employees, clinical trial patients, customers, and others.”

Annual report 2025A · The company itself

“These technologies may present business, compliance, and reputational risks. •Our business could be materially and adversely affected by a cybersecurity breach or other attack involving our computer systems or data or those of our customers or third-party or fourth-party service providers.”

Annual report 2025A · The company itself

“We are exposed to funding transaction losses due to reversals or insufficient funds. Some of our products and services are paid for by electronic transfer from customers’ bank accounts which exposes us to risks associated with reversals and insufficient funds. Unwinding of funds transfers due to reversals, and insufficient funds could arise from fraud, misuse, unintentional use, settlement delay, or other activities.”

Annual report 2025A · The company itself

“These providers have been and are susceptible to processing, operational, technological and security vulnerabilities, including security breaches, which might impact our business, and our ability to monitor our third-party service providers’ 59 Table of Contents data security is limited. In addition, these third-party service providers might rely on subcontractors to provide services to us that face similar risks.”

Annual report 2025A · The company itself

“Risks Related to Cybersecurity and Data Privacy Our business could be materially and adversely affected by a cybersecurity breach or other attack involving our computer systems or data or those of our customers or third-party or fourth-party service providers. Our systems, including those of companies we have acquired or may seek to acquire in the future, and those of our customers and third-party service providers have been and might in the future be vulnerable to cybersecurity issues. We, like other financial technology organizations, routinely are subject to cybersecurity threats and our technologies, systems, and networks have been and might in the future be subject to attempted cybersecurity attacks.”

Annual report 2025A · The company itself

“The operation of our platforms involves the use, collection, storage, sharing, disclosure, transfer, and other processing of customer information, including personal data. Security breaches and other security incidents could expose us to a risk of loss or exposure of this information, which could result in potential liability, investigations, regulatory fines, penalties for violation of applicable laws or regulations, litigation, and remediation costs, as well as reputational harm.”

Annual report 2025A · The company itself

“Cybersecurity attacks and other malicious internet-based activity continue to increase, and financial technology platform providers have been and expect to continue to be targeted. In light of media attention, we might be a particularly attractive target of attacks seeking to access customer data or assets and have experienced negative publicity in connection with previous security incidents and might in the future experience similar adverse effects relating to real or perceived security incidents, whether or not related to the security of our platforms or systems.”

Annual report 2025A · The company itself

“The increasing sophistication and resources of cyber criminals and other non-state threat actors and increased actions by nation-state actors make it difficult to keep up with new threats and could result in a breach of security.”

Annual report 2025A · The company itself

“Additionally, there is an increased risk that we might experience cybersecurity-related incidents as a result of any of our employees, service providers, or other third parties working remotely on less secure systems and environments. While we take significant efforts to protect our systems and data, including establishing internal processes and implementing technological measures designed to provide multiple layers of security, our safety and security measures might be insufficient to prevent damage to, or interruption or breach of, our information systems, data (including personal data), and operations, such as the November 2021 Data Security Incident.”

Annual report 2025A · The company itself

“Furthermore, to the extent the operation of our systems relies on our third-party service providers, through either a connection to, or an integration with, third parties’ systems, the risk of cybersecurity attacks and loss, corruption, or unauthorized access to or publication of our information or the confidential information and personal data of customers and employees is increased. Third-party risks include insufficient security measures, data location uncertainty, vulnerabilities and the possibility of data storage in inappropriate jurisdictions where laws or security measures might be inadequate. Our ability to monitor, and our resources to optimize integration with, third-party service providers’ data security practices are also limited.”

Annual report 2025A · The company itself

“Table of Contents For example, in late October 2024, a cyberattack occurred on our Newsroom in which a cyber attacker gained access to our Newsroom website, control of which is subcontracted to a third party vendor, for a limited number of hours. The cyberattack did not result in any unauthorized access of customer information.”

Annual report 2025A · The company itself

“In addition, in December 2024, a cyberattack occurred at Cyberhaven, a data protection company we utilize as a third-party vendor, creating the potential for attackers to steal sensitive data through a malicious version of a Google Chrome extension. Although we do not believe that this third-party vulnerability impacted us, the attack highlights the growing risk from cybersecurity threats against third-party service providers.”

Annual report 2025A · The company itself

“Due to applicable laws and regulations or contractual obligations, we could be held responsible for any information security failure or cybersecurity attack attributed to our vendors as they relate to the information we share with them. A vulnerability in a third-party service provider’s software or systems, a failure of our third-party service providers’ safeguards, policies or procedures, or a breach of a third-party service provider’s software or systems has in the past and may in the future result in the compromise of the confidentiality, integrity, or availability of our systems or the data housed in our third-party solutions.”

Annual report 2025A · The company itself

“Additionally, we could also be exposed to information security vulnerabilities or failures at third parties’ common suppliers or vendors (known as “fourth parties”) that could also impact the security of our data, and we may not be able to effectively directly monitor or mitigate such fourth-party risks, in particular as such risks relate to the use of common suppliers or vendors by the third parties that perform functions and services for us and our limited ability to assess the fourth party’s operational controls.”

Annual report 2025A · The company itself

“Manufacturers with a global footprint, such as ROCKWOOL, face persistent risks from sophisticated adversaries exploiting vulnerabilities at speed, targeting both IT and operational technology (OT) assets, and leveraging complex supply chain dependencies. The potential impacts range from business continuity disruption and intellectual property loss to reputational damage.”

Annual report 2025A · The company itself

“Credential compromise and identity-based attacks represent risks, and while we deploy identity threat protection and multi-factor authentication across our enterprise systems, determined attackers may still gain unauthorized access through sophisticated credential theft, session hijacking, social engineering, or privilege escalation techniques. Cybersecurity incidents including ransomware attacks, insider threats, system disruptions, and configuration errors could result in the misappropriation or corruption of data and assets, or disruptions to our business strategy, results of operations, and financial condition, and may require notification to customers and regulators with associated investigation, remediation, and monitoring obligations.”

Annual report 2025A · The company itself

“Global cybersecurity threats are rapidly evolving and attacks to identities, networks, platforms, systems, and endpoints can range from uncoordinated individual attempts to sophisticated and targeted measures known as advanced persistent threats, directed at the Company, its businesses, its customers, and/or its third-party service providers, including, but not limited to, cloud providers and providers of network management services. These may include such things as unauthorized access, phishing attacks, denial of service, insider threats, data exfiltration and extortion, introduction of malware or ransomware, and other disruptive problems caused by threat actors. We face emerging risks from AI-powered attacks, including deepfakes used to impersonate executives or customers, AI-assisted social engineering, prompt injection attempts against AI systems, and data poisoning targeting machine learning models.”

Annual report 2025A · The company itself

“Information or data security breaches, including cyberattacks on our transaction processing and computer information systems (including malware intrusion, data exfiltration, identity theft, and other types of cybersecurity threats), could disrupt our operations, result in theft or unauthorized disclosure of our confidential and valuable business information or credit card and other customer information, and could adversely affect our business, disrupt our operations, damage our reputation, increase our costs, and create significant legal exposure.”

Annual report 2026A · The company itself

“Cybercriminals may attempt to penetrate our point of sale and other transaction processing information systems to misappropriate customer or business information, including but not limited to credit/debit card, personnel, or trade information.”

Annual report 2026A · The company itself

“Cybercriminals (including state-sponsored actors) may attempt to penetrate our information systems, including supply chain and logistics systems, to deprive us from access to necessary business information and to disrupt our operations, as part of so-called “ransomware” extortion activity or otherwise.”

Annual report 2026A · The company itself

“Our information systems, including our back-up systems, are subject to damage or interruption from power outages, computer and telecommunications failures, cyberattacks, computer viruses, internal or external security breaches, catastrophic events such as severe storms, fires, earthquakes, floods, acts of terrorism, and design or usage errors by our associates or by third parties.”

Annual report 2026A · The company itself

“Viruses, ransomware, malware and other forms of cyber-attacks targeting utility systems and other energy infrastructure continue to increase in sophistication, magnitude and frequency, may not be recognized until launched against a target and may further escalate during periods of heightened geopolitical tensions. Adversaries increasingly use artificial intelligence to develop new hacking tools, exploit vulnerabilities, obscure malicious activities and increase the difficulty of detecting threats.”

Annual report 2025A · The company itself

“Risks Related to the Operation of Our Business •Actual or perceived cybersecurity events experienced by us or our third-party service providers may create the perception that our platform is not secure, and we may lose customers or incur significant liabilities. •We may lose key members of our management team or qualified employees or may not be able to attract and retain employees we need. •Delays in the release of, or actual or perceived defects in, our products may slow the adoption of our latest technologies, reduce our ability to efficiently provide services, decrease customer satisfaction and adversely impact future product sales. •Disruptions or defects in our services could damage our customers’ businesses, subject us to substantial liability and harm our business.”

Annual report 2025A · The company itself

“Risks Related to the Operation of Our Business Actual or perceived cybersecurity events experienced by us or our third-party service providers may create the perception that our platform is not secure, and we may lose customers or incur significant liabilities. In the ordinary course of our business, we store, transmit, generate, and process our and our customers’ confidential, proprietary and sensitive data. As our business expands across the globe, the number of employees, contractors, vendors and other third parties remotely accessing our systems continues to grow. Our growing business operations increase our exposure to cyberattacks by a range of actors, who have used and will continue to use assorted tactics, techniques, and procedures, including malicious code, ransomware, social engineering, business email compromises, supply chain attacks, denial of service attacks and similar internet-enabled, fraudulent activity, and the frequency of those attacks have become more common.”

Annual report 2025A · The company itself

“Additionally, as AI technologies continue to advance, threat actors can leverage these technologies to develop more sophisticated attack methods that are increasingly automated, targeted, coordinated and more difficult to defend against. The proliferation of these technologies could enable less skilled threat actors to initiate attacks and increase the frequency, scale and impact of security incidents.”

Annual report 2025A · The company itself

“Further, during times of war and other major conflicts, we and our third-party providers may be vulnerable to a heightened risk of geopolitically motivated attacks, including cyberattacks, that could materially disrupt our systems and operations, supply chain and ability to provide our services.”

Annual report 2025A · The company itself

“Our increasing reliance on third-party providers and public cloud infrastructure introduces new cybersecurity risks to our business operations. Third-party security incidents have occurred in the past and are likely to continue, as we rely on third-party service providers and technologies to operate business systems in a variety of contexts. Supply chain attacks have also increased in frequency and severity. We cannot guarantee that our third-party service providers or our supply chain infrastructure have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach of or disruption to our platform, systems and network or the systems and networks of third parties that support us and our business.”

Annual report 2025A · The company itself

“We have identified vulnerabilities in our products and services in the past and expect to continue to do so in the future. Consistent with our vulnerability management program, we prioritize security risks and consider their severity and potential impact in determining whether and when to remediate or mitigate them. In addition, we cannot be certain that we will be able to prevent, detect or remediate all vulnerabilities, and there have been delays and may continue to be delays in developing patches that can be effectively deployed to address vulnerabilities.”

Annual report 2025A · The company itself

“Yet, in configuring our platform, both our employees and customers have made errors in the past and may do so again in the future. We are aware that, on occasion, both our customers and ServiceNow have configured certain settings on our platform, or retained preset configurations, in ways that may not align with preferred or recommended security levels, which can result in, and has resulted in, information being made more widely accessible than intended. Such misconfigurations can be, and have been, identified publicly, increasing the risk of data being exposed unintentionally.”

Annual report 2025A · The company itself

“Our data security system and data governance framework, designed to protect our and our customers’ information and prevent data loss, may not be effective at preventing, detecting, responding to or remediating material breaches caused by intentional or unintentional actions or inactions by employees, contractors or third parties. Techniques used to sabotage or to obtain unauthorized access to systems are constantly evolving and may go undetected until we become aware of a successful attack. Moreover, we have experienced security incidents, which may reoccur in the future, that resulted in unauthorized access to, loss or inadvertent disclosure of confidential, proprietary and sensitive information.”

Annual report 2025A · The company itself

“An actual or perceived security breach or compromise can have a material effect on ServiceNow’s operations, finances and reputation. The adverse consequences can include accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to data; disruptions to our services; diversion of funds; litigation; indemnification and other contractual obligations; regulatory investigations; government fines and penalties; reputational damage; negative publicity; business and operational interruptions; loss of sales, customers and partners; mitigation and remediation expenses; and other material costs and liabilities.”

Annual report 2025A · The company itself

“Moreover, the incorporation of third-party, AI-generated or open-source software code into our or our customers’ systems increases the risk of exploitation of vulnerabilities.”

Annual report 2025A · The company itself

“Despite the security measures we have in place, our facilities and systems, and those of third parties we rely on or do business with, may be vulnerable to, or affected by damage or interruption resulting from, cybersecurity issues, including cyber attacks (including AI-powered cyberattacks), security breaches, fraud (including through phishing or social engineering attempts), malware (including ransomware and other programs that operate with malicious intent), power outages, system failures, acts of vandalism, human or technical errors, or other similar events or disruptions.”

Annual report 2025A · The company itself

“• Risken att tjänster och infrastruktur utsätts för cyberattacker, t.ex. i form av skadlig kod, DDoS-attacker, nätske, läckta identiteter, läckta autentiseringsuppgifter och attacker mot leveranskedjan.”

Annual report 2024A · The company itself

“Security breaches, phishing, spoofing, malware installations, attempts by others to gain unauthorized access to our information technology systems, networks, and databases, and other cyberattacks continue to become more sophisticated and persistent. We have been directly and indirectly subject to these attacks and expect to continue to be subject to these attacks.”

Annual report 2025A · The company itself

“Further, these incidents, which might be related to industrial, state-sponsored, and/or economic espionage, or financial cyber extortion or fraud, include covertly introducing malware and spyware to our computers, networks, and products (or to an electronic system operated by a third party for our benefit) and impersonating authorized users, among others. We seek to prevent, detect, and investigate all security incidents and to prevent their recurrence, but in some cases, we might be unaware of an incident or its magnitude, duration, and effects.”

Annual report 2025A · The company itself

“The theft, unauthorized use, transfer, or publication of our intellectual property, our confidential business, financial, and/or technical information, or the personal data of our employees and customers by third parties or by our employees could harm our competitive position, reduce the value of our investment in research and development and other strategic initiatives, or otherwise adversely affect our business and technology development. To the extent that any security breach or other cybersecurity incident results in inappropriate disclosure of data, including our customers’, suppliers’, licensees’, or employees’ confidential or personal information, we may incur liability, face contractual and regulatory fines and penalties, and sustain significant financial resources to remediate such breach.”

Annual report 2025A · The company itself

“In addition, certain suppliers, including cloud-based and critical service providers, and other third parties with whom we conduct business, including foundries, assembly and test contractors, and distributors, have been, and are likely to continue to be, subject to cybersecurity incidents, misappropriation efforts, or network disruptions that could jeopardize our proprietary or sensitive data, impact such third parties’ ability to meet their obligations to us, or otherwise negatively impact our ongoing business operations.”

Annual report 2025A · The company itself

“Despite our efforts, parties, including current and former employees, consultants, customers, licensees, suppliers, vendors, and other third parties may attempt to copy, disclose, transfer, misappropriate or obtain access to our information without our authorization. Furthermore, attempts by computer hackers or other third parties to gain unauthorized access to our systems or information could result in our confidential and/or proprietary information being compromised or our manufacturing and other business operations being interrupted.”

Annual report 2025A · The company itself

“In addition, certain of our products that we use contain firmware that incorporates or is 28 Table of Contents derived from “open source” software that generally is made publicly available by its developers or other third parties. Risks related to the use of open source software include, but are not limited to, the introduction of cybersecurity vulnerabilities into our products or development platforms, our noncompliance with applicable licensing terms, subjecting certain of our derivative works or software enhancements to public disclosure and/or unfavorable licensing conditions, potential restrictions on our ability to market the firmware associated with our products, and enhanced governmental or other third-party scrutiny of our products.”

Annual report 2025A · The company itself

“Om Sleep Cycles datasäkerhet drabbas av cyberattacker eller datavirus riskerar Sleep Cycle ett reducerat kundförtroende samt att bolagets rykte och varumärke skadas.”

Annual report 2024A · The company itself

“The Company must securely handle high volumes of traffic and operational data, which makes it vulnerable to various security risks and interruptions. The Company has experienced material technology system interruptions and delays that have made its websites and operational systems unavailable or slow to respond, which has prevented the Company from efficiently processing Customer transactions or providing services.”

Annual report 2025A · The company itself

“The Company’s IT Systems or those of third-party service providers could be damaged or interrupted by catastrophic events beyond its control such as fires, floods, earthquakes, tornadoes and hurricanes, power loss, computer and telecommunications failures, acts of war or terrorism, computer viruses, malware, ransomware, security breaches, and similar events or disruptions generally beyond the Company’s control. Any of these events could cause system interruptions, delays, and loss of critical data, and could prevent the Company from processing Customer transactions or providing services, which could make the Company’s business and services less attractive and subject the Company to liability.”

Annual report 2025A · The company itself

“The Company is increasingly exposed to cybersecurity attacks and data incidents impacting its IT Systems, or those of the Company’s vendors or service providers. Such cybersecurity incidents or data incidents could have a disruptive and material adverse effect on the Company’s business, financial position, or results of operations.”

Annual report 2025A · The company itself

“These IT Systems are essential for daily operations but are exposed to risks like programming errors, software malfunctions, unauthorized access, accidental leaks of sensitive information, denial of service attacks, ransomware, data corruption, business disruptions, outages, security breaches, computer viruses, data loss, scams, theft, insider threats, and human errors. These IT Systems may be subject to increasingly significant attacks by hackers, cybercriminals, nation-states, insiders, or other third parties.”

Annual report 2025A · The company itself

“Advances in computer capabilities, AI-enhanced attacks, social engineering, phishing, cryptography, inadequate facility security, insider threats, or other technological developments may result in a compromise or breach of the Company’s critical operations systems, physical assets, or technology the Company uses to safeguard confidential, personal, or proprietary information. A compromise of the Company’s IT Systems or physical assets, or those of a vendor or service provider, could lead to safety incidents, damage to the Company’s assets, significant remediation costs and liability, regulatory actions, privacy or securities law violations and related fines, loss of contracts, significant and long-lasting reputational harm, or a failure to meet the Company’s contractual obligations.”

Annual report 2025A · The company itself

“For example, cybersecurity incidents impacting the Company’s IT Systems or those provided by a vendor or service provider could disrupt the Company’s operations and even impact the safe operation of physical assets like aircraft.”

Annual report 2025A · The company itself

“To operate its business, the Company must receive, process, transmit, and store information related to a number of groups—Customers, Employees, contractors, business partners, and other third parties—and the Company’s operations depend upon secure processing, transmission (including over public networks), storage, and retention of that information. As noted above, this subjects the Company to cyber-attacks, which can vary in scope and sophistication, potentially resulting in unauthorized access to its systems or physical assets, data incidents, operational disruptions, and misappropriation of sensitive data.”

Annual report 2025A · The company itself

“A successful breach of the Company’s IT Systems could erode Customer confidence in the Company’s digital platforms, security measures, data protection, resiliency, and services. Beyond operational disruptions, such incidents could result in reputational damage, loss of Customer trust, regulatory investigations and fines, or individual or class action lawsuits, all of which could have a material adverse effect on the Company’s financial condition and results of operations.”

Annual report 2025A · The company itself

“Additionally, telecommunications outages such as the 2025 Newark outages and September 2025 Dallas outages have caused air traffic controllers to lose radar and communications, resulting in ground stops, delays, and cancellations. The continuation of these air traffic control disruptions and constraints or the FAA’s inability to meet staffing needs on a long-term basis may have a material adverse effect on the Company’s operations.”

Annual report 2025A · The company itself

“The Company’s systems and cybersecurity measures require ongoing monitoring and updating as technologies change, and security could be compromised, personal or confidential information could be misappropriated, or system disruptions could occur. The Company may also incur significant costs to modify, upgrade, or enhance its cybersecurity measures to protect and defend against such attacks and breaches.”

Annual report 2025A · The company itself

“Foto: Fra vår stand på Randsfjordfestivalen 2024 ANSVARLIG OG ETISK FORRETNINGSDRIFT Økonomisk kriminalitet undergraver det finansielle systemets integritet og er en trussel mot velferdssamfunnet og et sunt næringsliv. Vi og andre banker har plikt til å gjennomføre tiltak for å forebygge, avdekke og avverge svindel, hvitvasking, sanksjonsomgåelse og terrorhandlinger.”

Annual report 2024A · The company itself

“Personvern og datasikkerhet er strengt regulert, og vi er avhengige av kundenes tillit. Det er derfor viktig for oss å sikre verdiene og dataene vi forvalter.”

Annual report 2024A · The company itself

“Statistikk om vårt arbeid mot økonomisk kriminalitet i 2024 I 2024 så vi en betydelig økning i antall forsøk på svindel og reelle svindelsaker.”

Annual report 2024A · The company itself

“Dersom systemer og manuelle rutiner fanger opp betalinger vi ikke forstår bakgrunnen for, vil det iverksettes intern undersøkelse. I 2024 ble totalt 4123 transaksjoner identifisert for videre kontroll.”

Annual report 2024A · The company itself

“Norske banker er i forkant i bruk av teknologi, og dermed blir vi også et attraktivt mål for økonomisk kriminalitet ettersom store deler av vår bankvirksomhet skjer digitalt. Cyberhendelser er en potensiell trussel mot det finansielle systemet og den finansielle stabiliteten.”

Annual report 2024A · The company itself

“For konsernet er det viktig å forstå, identifisere og redusere denne påvirkningen. • Konsernet har en iboende negativ påvirkning som følge av at konsernets virksomhet kan utnyttes til å begå økonomisk kriminalitet. Konsernet har implementert flere tiltak for å forebygge og bekjempe økonomisk kriminalitet.”

Annual report 2024A · The company itself

“Det registreres en betydelig økning i antall bedragerier. Organiserte kriminelle aktører blir stadig mer profesjonelle og utvikler nye metoder for urettmessig å tilegne seg kunders midler.”

Annual report 2024A · The company itself

“Private og offentlige aktører rapporterer om økende antall uønskede hendelser relatert til informasjonssikkerhet. Tekniske løsninger og metoder for sosial manipulering og digitale bedragerier profesjonaliseres stadig, og de rammer både kunder, banken og våre underleverandører.”

Annual report 2024A · The company itself

“Hendelser knyttet til informasjonssikkerhet og personvern kan medføre ubehag og vesentlige tap for kunder, ansatte og eiere. For banken er det risiko for regulatoriske sanksjoner og tap av tillit.”

Annual report 2024A · The company itself

“Norske banker er utsatt for risiko knyttet til økonomisk kriminalitet. De viktigste kriminalitetsformene finansnæringen står ovenfor er hvitvasking, bedrageri, kortmisbruk, ID-misbruk, korrupsjon, terrorfinansiering, cyberkriminalitet og verdipapirkriminalitet, samt brudd på internasjonale sanksjoner.”

Annual report 2024A · The company itself

“I tillegg opplever norske banker, bedrifter og forbrukere en stor økning i Bærekraft Bærekraft side 188 SPAREBANKEN VEST ÅRSRAPPORT 2024 svindel og svindelforsøk fra både utenlandske og norske aktører.”

Annual report 2024A · The company itself

“Bankens mål er at vår IT-infrastruktur til enhver tid skal være så god at det ikke oppstår alvorlige sikkerhetshendelser. Antall sårbarheter og angrep er en ekstern faktor som banken i liten grad kan påvirke, men med å holde den digitale plattform oppdatert og robust skal gjøre oss i stand til å minimere risiko til et minimumsnivå.”

Annual report 2024A · The company itself

“Cybersecurity incidents could disrupt business operations, result in the loss of critical and confidential information, and adversely impact the Company's reputation, operating results, and financial condition.”

Annual report 2026A · The company itself

“Den største risikoen er hvis Storebrand blir misbrukt til hvitvasking og terrorfinansiering. Gitt Storebrands tiltak for å hindre hvitvasking og terrorfinansiering, vurderes risikoen som moderat.”

Annual report 2024A · The company itself

“For Storebrand kan det få store konsekvenser for drift og omdømme hvis konsernet rammes av cyberangrep og i tillegg ikke evner å gjenopprette systemene.”

Annual report 2024A · The company itself

“Informasjonssikkerhet Som finansinstitusjon er våre digitale løsninger og infrastruktur kritisk for samfunnet. Vi forvalter store mengder informasjon og verdier, noe som gjør oss til et attraktivt mål for trusselaktører. Cyberangrep blir stadig mer sofistikerte, og en hybrid arbeidshverdag øker risikoen for uønsket aktivitet.”

Annual report 2024A · The company itself

“We have historically experienced loss of inventory (also called shrink) due to damage, theft (including from organized retail crime), and other causes.”

Annual report 2026A · The company itself

“Cyber incidents or attacks targeting the systems and infrastructure used by us, our operators, other third parties with whom we do business or the oil and gas industry in general may adversely impact our operations, and if we are unable to obtain and maintain adequate protection of our data, our business may be adversely impacted. We and our operators increasingly rely on information technology systems to operate our respective businesses, and the oil and gas industry depends on digital technologies in exploration, development, production, and processing activities. Our technologies, systems and networks, and those of the operators on our properties and our vendors, suppliers and other business partners, have in certain instances been, and may in the future become, the target of cyberattacks or information security breaches that could result in the unauthorized release, gathering, monitoring, misuse, loss or destruction of proprietary, personal and other information, or other disruption of business activities.”

Annual report 2025A · The company itself

“Our business could be negatively impacted by cybersecurity threats and other disruptions. Our information technology (IT) and related systems are critical to the efficient operation of our business and essential to our ability to perform day-to-day processes. We routinely face persistent security threats, including threats to our IT infrastructure and unlawful attempts to gain access to our confidential, classified or otherwise proprietary information via phishing/malware campaigns and other cyberattack methods, as well as threats to the physical security of our facilities and employees.”

Annual report 2026A · The company itself

“Future attacks or breaches of data security, whether of our systems, the systems of our customers, suppliers, subcontractors or other business partners, or the systems of our service providers or other third parties who may have access to our data for business purposes, could disrupt our operations, cause the loss of business information or compromise confidential information, exposing us to liability or regulatory action. Such an incident also could require significant management attention and resources, increase costs that may not be covered by insurance, and result in reputational damage, potentially adversely affecting our competitiveness and our results of operations.”

Annual report 2026A · The company itself

“On September 26, 2024, following the court’s denial of an earlier proposed settlement agreement, the Company reached an agreement with the plaintiffs to settle all claims asserted in the Le case for an aggregate amount of $375.0 million payable in installments over an agreed-upon period of time by the Company (the “Updated Settlement Agreement”).”

Annual report 2025A · The company itself

“For example, rapid changes in the sophistication and use of certain types of cyber-attacks, such as ransomware and social engineering attacks, as well as other cyber incidents impacting our insureds, have increased the frequency and severity of losses under our policies.”

Annual report 2025A · The company itself

“If, as a result of a cyber-attack (the risk of which could be exacerbated by geopolitical tensions) or otherwise, we experience difficulties with technology, data and network security, outsourcing relationships or cloud-based technology, our ability to conduct our business could be negatively impacted.”

Annual report 2025A · The company itself

“Cyber-attacks and employee or vendor misconduct (inadvertent or intentional) could expose our systems or data to unauthorized parties or otherwise cause significant disruptions.”

Annual report 2025A · The company itself

“Like other global companies, our computer systems and networks are regularly subject to and will continue to be the target of computer viruses, malware or other malicious codes (including ransomware), unauthorized access, cyber-attacks or other computer-related penetrations.”

Annual report 2025A · The company itself

“Truecallers produkter och tjänster Den höga förekomsten av bedrägerier och oönskad kommunikation har stor påverkan på privatpersoners och ovana internetanvändares interaktioner med digitala tjänster och företag. Bedrägeri och nätfiske i olika kanaler minskar användarnas förtroende för onlineplattformar och inverkar negativt på deras sociala välbefinnande och tillit till digitala interaktioner.”

Annual report 2024A · The company itself

“In our regular business operations, we collect, process, store and transmit to commercial partners sensitive data, including personal information of our customers and employees, such as payment processing information, and information of our business partners to provide our services and operate our business. The Company must manage increasing legislative, regulatory and consumer focus on privacy issues, data security and cybersecurity risk management in a variety of jurisdictions domestically and across the globe.”

Annual report 2025A · The company itself

“Our network, systems and storage applications, and those systems and applications maintained by our third-party commercial partners (such as aircraft and engine suppliers, cloud computing companies, credit card companies, regional airline carriers and international airline partners) have been and likely will continue to be subject to attempts to gain unauthorized access, breaches, malfeasance or other system disruptions, including those involving criminal hackers, denial of service attacks, hacktivists, state-sponsored actors, corporate espionage, employee malfeasance and human or technological error.”

Annual report 2025A · The company itself

“Unplanned interruptions in UPM's or a supplier's critical information system services, loss of critical, financial or personal data due to reasons beyond UPM’s or its suppliers' control, such as power cuts, geopolitically-driven service restrictions, software or telecommunication errors or other major disasters, such as fires or natural disasters, as well as user errors by UPM’s own personnel or suppliers, can potentially cause major damage to UPM’s businesses and disruptions to the continuity of operations.”

Annual report 2025A · The company itself

“Cybersecurity and Technology Risk Factors Attempted security breaches, including from the exploitation of vulnerabilities, cyber-attacks and Distributed Denial of Service (“DDoS”) attacks against our systems and services increase our costs, expose us to potentially material liability, and could materially harm our business and reputation. As an operator of critical internet infrastructure, we experience a high rate of cyber-attacks and attempted security breaches targeting our systems and services, including the most sophisticated forms of attacks, such as advanced persistent threat attacks, exploitation of zero-day vulnerabilities, ransomware attacks, and social engineering attacks.”

Annual report 2025A · The company itself

“For example, recent advances in AI-based tools have made, and will continue to make, cyber-attacks more sophisticated, harder to defend, and easier and faster to launch. These tools allow for rapid exploitation of vulnerabilities, which hinders our ability to defend against such exploitation.”

Annual report 2025A · The company itself

“Security vulnerabilities in our systems and our vendors’ systems, including vulnerabilities in third party software and hardware, pose a material risk to our operations. We use externally-developed technology, systems, and services, including both hardware and software, for a variety of purposes, including compute, storage, encryption and authentication, back-office support, and other functions.”

Annual report 2025A · The company itself

“Our networks have been, and likely will continue to be, subject to DDoS attacks. Recent industry experience has demonstrated that DDoS attacks continue to grow in size and sophistication, due in part to advances in AI-based tools, and have the ability to widely disrupt internet services.”

Annual report 2025A · The company itself

“A significant disruption at any facilities within our internal or third-party supply chain, even on a short-term basis, whether due to the failure of a third-party supplier to fulfill the terms of their agreement with us, labor disruption, legal proceedings, adverse quality or compliance observation, other regulatory action, infringement of brand or other third-party intellectual property rights, natural disaster, civil or political unrest, export or import restrictions, or other events could impair our ability to produce and ship products to the market on a timely basis and could, among other consequences, subject us to exposure to claims from customers. Any of these events could also result in a loss of confidence from our customers, loss of 39 Table of Contents existing or potential business, and have a material adverse effect on our reputation, business, financial condition, results of operations, cash flows, ability to pay dividends or repurchase shares, and/or stock price.”

Annual report 2025A · The company itself

“In the ordinary course of business, we and our vendors collect, store and transmit large amounts of confidential information (including trade secrets or other intellectual property, proprietary business information and personal information), and it is critical that we do so in a secure manner to maintain the confidentiality and integrity of such confidential information. The size and complexity of our and our vendors’ systems and the large amounts of confidential information that is present on them also makes them vulnerable to security breaches from inadvertent or intentional actions by our employees, partners or vendors, or from attacks by malicious third parties.”

Annual report 2025A · The company itself

“A breach of our or our vendors’ security measures or the accidental loss, inadvertent disclosure, unapproved dissemination, misappropriation or misuse of trade secrets, proprietary information, or other confidential information, whether as a result of a cybersecurity threat or incident, theft, hacking, fraud, trickery, phishing or other forms of deception, or for any other cause, could enable others to produce competing products, use our proprietary technology or information, and/or adversely affect our business position.”

Annual report 2025A · The company itself

“Some of these third parties are outside the U.S., including significant elements of our IT and information systems infrastructure, and as a result we are managing many independent vendor relationships with third parties who may or could have access to our confidential information. The overall increase in supply chain attacks on companies generally, and our interdependency on third party suppliers increases the potential for supply disruptions and service IT and information system outages.”

Annual report 2025A · The company itself

“We face risks associated with cybersecurity incidents and other significant disruptions of our information technology (IT) networks and related systems or those IT networks and systems of third parties. We use our own IT networks and related systems to access, store, transmit, and manage or support a variety of our business processes and information and face risks associated with cybersecurity incidents and other disruptions of our IT networks and related systems, including as a result of unauthorized access attempts, denial of service or intrusions over the internet, malware, ransomware or other extortion tactics, computer phishing attempts and other forms of social engineering, fraudulent schemes, other cybersecurity incidents, attacks, intentional or unintentional intrusions or interruptions.”

Annual report 2025A · The company itself

“In the conduct of our business, we and our tenants rely on relationships with third parties, including cloud data storage and other information technology service providers, contractors, and other external business partners, for certain functions or services in support of key portions of our operations. These third-party entities are subject to similar risks relating to cybersecurity, business interruption, and systems and employee failures and a significant system failure or attack against such 28 Table of Contents third-party service provider or partner could have a material adverse effect on our business.”

Annual report 2025A · The company itself

“Cybersäkerheten blir allt viktigare för en motståndskraftig verksamhet. Cyberbrottslingar är välorganiserade och hotar organisationer på många olika sätt, däribland utpressningsprogram, informationsstöld och bedrägerier.”

Annual report 2024A · The company itself

“In the event of a disaster such as a natural catastrophe, terrorist attack or industrial accident, physical or electronic security breaches, such as breaches by computer hackers, the infection of our systems by a malicious computer virus, denial of service attack, or other cybersecurity incident, our systems could be inaccessible for an extended period of time.”

Annual report 2025A · The company itself

“Failure to maintain the security of information technology systems and confidential data may expose us to liability. Although we have taken reasonable steps intended to protect our data and information technology systems, and to mitigate potential risk of harm caused by cybersecurity incidents or breaches, no safeguards are perfect and any failure of these safeguards could cause a substantial disruption of our business operations, which could result in service interruptions, data security compromises, regulatory action, and other similar operational and legal issues, as well as substantial remediation and other costs.”

Annual report 2025A · The company itself

“Furthermore, although Grainger’s information systems are protected with backup and security systems, including physical and software safeguards and remote processing capabilities, information systems are still vulnerable to damage or interruption from natural or human induced disasters, extreme weather, power losses, telecommunication failures, user error, third-party actions such as malicious computer programs, denial-of-service attacks and cybersecurity breaches, and other problems.”

Annual report 2025A · The company itself

“If critical information systems fail or otherwise become unavailable, Grainger’s ability to operate its digital platforms, process orders, maintain proper levels of inventories, collect accounts receivable, disburse funds, manage its supply chain, monitor results of operations, and process and store team member or customer data, among other functions, could be adversely affected. Any such interruption of Grainger’s information systems could have a material adverse effect on its business or results of operations.”

Annual report 2025A · The company itself

“Cybersecurity threats and incidents, including breaches of information systems security, could damage Grainger’s reputation, disrupt operations, increase costs and/or decrease revenues.”

Annual report 2025A · The company itself

“Loss of customer, supplier, and team member information, intellectual property or other business information, or failure to comply with data privacy and security laws, or failure to maintain systems or software, could, for example, disrupt operations, damage Grainger’s reputation and expose Grainger to claims from customers, suppliers, financial institutions, regulators, payment card associations, team members and others, any of which could have a material adverse effect on Grainger, including its business strategy, financial condition and results of operations.”

Annual report 2025A · The company itself

“Grainger's IT infrastructure also includes products and services provided by suppliers, vendors and other third-party business partners, and these third parties may experience cybersecurity threats, breaches, attacks, disruptions, and other incidents that could affect confidentiality, integrity or availability of systems and proprietary or confidential information.”

Annual report 2025A · The company itself

“Grainger, or its third-party business partners, may face cybersecurity threats and incidents which could include unauthorized access to information systems, business email compromise, misconfiguration of assets, exploitation of vulnerabilities, malware (including viruses and other malicious code), ransomware, denial-of-service attacks and other targeted or organized cyber-attacks.”

Annual report 2025A · The company itself

“Cybersecurity threats or cybersecurity incidents that impact Grainger’s systems, or those of its third-party business partners, could have a material adverse effect on Grainger, including its business strategy, financial condition and results of operations. Such incidents could result in major disruptions to business operations, alteration or corruption of data or systems, costs related to remediation or the payment of ransom, and litigation including individual claims or consumer class actions, commercial litigation, administrative, and civil or criminal investigations or actions, regulatory intervention and sanctions or fines, investigation and remediation costs and possible prolonged negative publicity.”

Annual report 2025A · The company itself

“Although Grainger has a dedicated Information Security team, Grainger may be unable to anticipate, detect or prevent these techniques or implement effective preventative measures in all circumstances.”

Annual report 2025A · The company itself

“Negative incidents, including the loss of merchandise as a result of shrink or theft, ineffective use or misuse of AI technologies, inaccurate, biased or otherwise flawed 13 AI search and discovery results, or a data breach as a result of a cyberattack could quickly erode trust and confidence in our business and could result in customer dissatisfaction, consumer boycotts, workforce unrest and government investigations.”

Annual report 2026A · The company itself

“Our information systems are subject to damage or interruption from power outages, computer and telecommunications failures, computer viruses, ransomware, worms, other malicious computer programs, denial-of-service attacks, security incidents and breaches from a variety of threat actors, including both cybercriminals and nation state-sponsored actors and catastrophic events noted above in this Item 1A. The availability of our information systems and the integrity of data are essential to our business operations, including the processing of transactions, management of our associates, facilities, logistics, inventories, physical stores and clubs and our online operations.”

Annual report 2026A · The company itself

“Any failure to maintain the privacy or security of the information relating to our company, customers, members, associates, business partners and vendors, whether as a result of cyberattacks on our information systems or otherwise, could damage our reputation, result in litigation or other legal actions against us, result in fines, penalties, and liability, cause us to incur substantial additional costs and materially adversely affect our business and operating results.”

Annual report 2026A · The company itself

“Cyber threats are rapidly evolving and those threats and the means for disrupting or obtaining access to information systems or information stored in digital and other storage media are becoming increasingly sophisticated and frequent, and in some cases, they may lead to successful attacks. Unauthorized activities directed against information systems and devices, whether our own or those of our third-party service providers and vendors, have resulted in cybersecurity incidents, including malware, ransomware, denial of service attacks or phishing incidents.”

Annual report 2026A · The company itself

“Continued advancements and increased use of AI have intensified existing cybersecurity risks by enabling faster and more automated attack techniques, lowering the barrier to creating sophisticated threats, and further compressing the time in which we must detect and respond to potential threats. Advances in AI are also creating novel categories of cyber threats in which attackers use AI systems to autonomously conduct reconnaissance, generate and tailor exploit code, harvest credentials, craft highly convincing social‑engineering content, and execute large‑scale intrusion or extortion campaigns with minimal human involvement.”

Annual report 2026A · The company itself

“Those attacks involve attempts to impede the operations of our system or gain unauthorized access to our eCommerce websites (including marketplace platforms) or mobile commerce applications to obtain and misuse customers' or members' information including personal information and/or payment information, and related risks discussed in this Item 1A.”

Annual report 2026A · The company itself

“In certain circumstances, our contracts with payment card processors and payment card networks (such as Visa, Mastercard, American Express and Discover) generally require us to adhere to payment card network rules which could make us liable to payment card issuers and others if information in connection with payment cards and payment card transactions that we process is compromised, which liabilities could be substantial.”

Annual report 2026A · The company itself

“Our systems and our service providers’ systems have been, and likely will continue to be, targets and in some cases breached as a result of cybersecurity attacks. These systems could also be breached or disrupted due to employee error or misconduct, system vulnerabilities, power outages, natural disasters, extreme weather, terrorist attacks, war or other catastrophic events, as well as malicious code, hacking and phishing attacks, malware, ransomware, or otherwise.”

Annual report 2025A · The company itself

“The risk of cyberattacks is significant and continues to evolve as technologies advance and cyber criminals conduct their attacks using more sophisticated methods, including those which use AI. We may be unable to anticipate these methods and implement adequate preventative measures.”

Annual report 2025A · The company itself

“The risk of cyberattacks has also increased and is expected to continue to increase in connection with geopolitical events and dynamics, including ongoing conflicts in Europe and the Middle East and tensions with Russia, China, North Korea, Iran and other states. State-sponsored parties or their supporters may launch retaliatory cyberattacks, and may attempt to cause supply chain disruptions, or carry out other geopolitically motivated retaliatory actions that may adversely disrupt or degrade our operations and may result in data compromise.”

Annual report 2025A · The company itself

“The information technology systems and networks that we, our customers, suppliers, and other third parties rely on can be vulnerable to disruptions from cyberattacks, power failures, telecommunications outages, major events like natural disasters, acts of war or terrorism, employee errors, and other unexpected or uncontrollable occurrences.”

Annual report 2025A · The company itself

“We are regularly the target of attempted cyber intrusions, have experienced cyber intrusions, and anticipate continuing to be subject to such attempts as cyber intrusions become increasingly sophisticated and more difficult to predict and protect against. Technological advancements, including the progression of the capabilities of artificial intelligence, also increase the risk, likelihood and precision of cyber incidents.”

Annual report 2025A · The company itself

“Although we believe that the probability of occurrence of a significant cybersecurity incident is less than likely, if such an incident were to occur, the impact on the Company could be substantial. The magnitude of future cyber intrusions that result in a theft, destruction, loss, misappropriation, or release of sensitive and/or confidential information (belonging to us or third parties) or intellectual property, or material interference with our information technology systems or the technology systems of third parties on which we rely cannot be predicted, such incidents could result in material business disruption, direct financial loss, remediation costs, reputational harm, brand damage, alleged violation of privacy laws, loss of customers, potential regulatory investigations and enforcement or private litigation liability and competitive disadvantage.”

Annual report 2025A · The company itself

“Risks Related to Cybersecurity and Data Privacy • Disruption, cyber-attack or unforeseen problems with the security, maintenance or upgrade of the Company’s information and web-based systems could have an adverse effect on the Company’s business strategy, results of operations and financial condition. • If the Company’s security measures are compromised or fail to adequately protect its technology infrastructure, research and development efforts or manufacturing operations, the Company’s products and services may be perceived as vulnerable or unreliable, the information protected by the Company’s controls and processes may be subject to unauthorized access, acquisition or modification, the Company’s brand and reputation could be damaged, the services that the Company provides to its customers could be disrupted, and customers may stop using the Company’s products and services, all of which could reduce the Company’s revenue and earnings, increase its expenses and expose it to legal claims and regulatory actions.”

Annual report 2025A · The company itself

“The Company relies on its technology infrastructure and that of its third-party partners, including its software and banking partners, among other functions, to interact with suppliers, sell products and services, fulfill contract 31 Table of Contents obligations, ship products, collect and make electronic wire and check based payments and otherwise conduct business. The Company’s technology infrastructure and that of its third-party partners has been, and may in the future be, vulnerable to damage or interruption from, but not limited to, natural disasters, power loss, telecommunication failures, terrorist attacks, computer viruses, ransomware, unauthorized access to customer or employee data, unauthorized access to and funds transfers from Company bank accounts and other attempts to harm the Company’s systems. The risk of damage or interruption to technology infrastructure as a result of cyber-attacks has generally increased as the number, intensity and sophistication of attempted attacks from around the world have increased, including through state-sponsored actors and/or the use of artificial intelligence.”

Annual report 2025A · The company itself

“Successful cybersecurity intrusions, including those targeting the electronic control systems used at our generating facilities and electric and natural gas transmission, distribution, and storage systems, could disrupt our operations and result in loss of service to customers. Attacks may come through ransomware, software updates or patches, or firmware that hackers can manipulate. These intrusions may cause unplanned outages at our power plants, which may reduce our revenues or cause us to incur significant costs if we are required to operate our higher cost electric generators or purchase replacement power to satisfy our obligations, and could result in additional maintenance expenses.”

Annual report 2025A · The company itself

“Cybersecurity threats, including those leveraging AI, continue to increase, and the security measures and preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems against unauthorized access to secured data and systems may be insufficient to safeguard against all security breaches.”

Annual report 2025A · The company itself

“Material interruption to or loss of our information processing capabilities or failure to effectively maintain and upgrade our information processing hardware or systems could cause material financial loss, regulatory actions, reputational harm and/or legal liability. • Limited protection of our intellectual property could harm our business and our ability to compete effectively, and we face the risk that our services or products may infringe upon the intellectual property rights of others.”

Annual report 2025A · The company itself

“Cybersecurity incidents could disrupt our business operations. We rely on information technology systems throughout the Company to keep financial records, process orders, manage inventory, coordinate shipments to distributors and customers, maintain confidential and proprietary information, and other technical activities, and operate other critical functions such as internet connectivity, network communications, and email.”

Annual report 2025A · The company itself

“Despite our implementation of a variety of security controls and measures, as well as those of our third-party vendors, there is no assurance that such actions will be sufficient to prevent a cybersecurity incident. Further, as cybersecurity threats continue to rapidly evolve and become increasingly more difficult to detect and defend against, our current security controls and measures may not be effective in preventing cybersecurity incidents and we may not have the capabilities to detect and remediate certain vulnerabilities, which may allow unremediated vulnerabilities to persist over long periods of time.”

Annual report 2025A · The company itself

“Cybersecurity incidents can take a variety of forms including unintentional events as well as deliberate attacks by individuals, groups and sophisticated organizations, such as state sponsored organizations or nation-state actors. We rely on third-party vendors for certain services, which may require them to access our employee and/or customer data.”

Annual report 2025A · The company itself

“Any failure on our part, or by our third-party vendors, to maintain the security of data we are required to protect, including via the penetration of our network security and the misappropriation of confidential and proprietary information, could result in: business disruption; damage to our reputation; financial obligations to third parties; fines, penalties, regulatory proceedings; private litigation with potentially large costs; deterioration in our suppliers’, distributors’, and customers’ confidence in us; as well as other competitive disadvantages. Such failures to maintain the security of data could have a material adverse effect on our business, financial condition, and results of operations.”

Annual report 2025A · The company itself

“Our offerings are used in customer environments and have the possibility of being subject to a cybersecurity incident. Our customers may use certain of our products, solutions and services to transmit and/or process personal data and other sensitive information, and a cybersecurity incident could result in disclosure of confidential information or disrupt the availability of the customer’s data and systems.”

Annual report 2025A · The company itself

“We and our business partners are dependent on sophisticated information technology and if we fail to effectively maintain or protect our information systems and data, including from cybersecurity events, our business could be adversely affected. We are dependent on sophisticated information technology for our products and infrastructure. As a result of technology initiatives, expanding and evolving privacy and cybersecurity laws, changes in our system platforms and the ongoing integration of business acquisitions, we have been consolidating and integrating the number of systems we operate and have upgraded and expanded our information systems and cybersecurity capabilities.”

Annual report 2025A · The company itself

“Like other large multi-national corporations, we and the third parties with whom we contract regularly experience cyber attacks, certain of which (including email phishing attacks on our email systems) have been successful, and we expect to continue to be subject to such attacks. These attacks may include phishing, state-sponsored cyber attacks, industrial espionage, insider threats, computer denial-of-service attacks, computer viruses, ransomware and other malware, payment fraud or other cyber incidents. Evolving artificial intelligence and machine learning tools continue to improve the capabilities of cyber attackers. In addition, as a result of our adoption of remote work arrangements in many positions, a significant number of our employees who are able to work remotely are doing so, which exposes us to additional cybersecurity risks.”

Annual report 2025A · The company itself

“The threat level against Ørsted is high across all regions. The likelihood of espionage targeting Ørsted’s plants and projects grows. Threat actors seek competitive advantages in green energy and access to information on critical infrastructure.”

Annual report 2025A · The company itself

“Our information systems are susceptible to outages due to system failures, cybersecurity threats, failures on the part of third-party information system providers, natural disasters, power loss, telecommunications failures, viruses, fraud, theft, malicious actors or breaches of security. Like many companies, we, and some third parties upon which we rely, have experienced cybersecurity incidents and attacks on information technology networks and systems, products and services in the past but, to date, none have resulted in a material breach or had a material adverse impact on our financial condition, results of operations, or cash flows.”

Annual report 2025A · The company itself

“AddLifes decentraliserade affärsmodell med självständiga dotterbolag innebär att endast ett fåtal bolag delar IT-plattform och infrastruktur. Detta gör att risken för en betydande ekonomisk påverkan vid en större IT-incident för koncernen är relativt begränsad.”

Annual report 2023A · The company itself

“Our business relies on technology hardware, software, cloud services, infrastructure, networks and systems (collectively, IT Systems). We own and manage some IT Systems but also rely on critical third-party IT Systems, products and services. In the ordinary course of business, we and various third-party providers and business partners process and maintain sensitive data, including personal information about workers, customers and others, as well as intellectual property and proprietary or confidential information relating to our business and that of our customers and business partners (collectively, Confidential Data).”

Annual report 2025A · The company itself

“While we and others have implemented various controls and defenses, AMD and companies like AMD and our vendors and customers have been and are increasingly subject to cybersecurity attacks, risks and threats. Risks and threat factors range in sophistication from negligent or bad acts by individuals, hackers or insiders, to ransom gangs and state-sponsored attackers. Cyber threats may be generic, or they may be custom-crafted against our IT Systems or supply chain.”

Annual report 2025A · The company itself

“As AI capabilities improve and are increasingly adopted, we may see more sophisticated threats created through the use of AI technology to launch more automated, targeted and coordinated cyberattacks. These attacks could be crafted with an AI tool to directly attack IT Systems with increased speed and/or efficiency than a human threat actor or create more effective phishing emails. In addition, the threat could be introduced from the result of our or our customers and business partners incorporating the output of an AI tool that includes a threat, such as introducing malicious code by incorporating AI generated source code.”

Annual report 2025A · The company itself

“Defects or disruptions in our products and IT systems could require us to increase spending on upgrading systems, diminish demand for our solutions or subject us to substantial liability. Our solutions are highly complex and are designed to be deployed in and across numerous large and complex networks that we do not control.”

Annual report 2025A · The company itself

“Cybercrime poses a significant risk to Ambu’s operations and could impact delivery performance and competitive advantage.”

Annual report 2025A · The company itself

“Increased fraudulent activity associated with our products and services could materially adversely affect our financial condition and results of operations, including as a result of credit losses and other expenses.”

Annual report 2025A · The company itself

“As regulators increase their focus with respect to these financial crimes laws, new technologies such as digital currencies develop, near real-time money movement solutions are adopted, we introduce new products and geopolitical tensions increase, we face increased costs related to oversight, supervision and potential fines.”

Annual report 2025A · The company itself

“Such disruptions, operational issues, control and process weaknesses or other events could interrupt or compromise the quality of our services to customers, impact the confidentiality, integrity, availability and security of our data, lead to fraudulent transactions on our cards or other products, impact our business, cause brand or reputational damage, and lead to costs associated with responding to a disruption, including notification and remediation costs, costs to switch service providers or move operations in house, regulatory investigations and fines and increased regulatory oversight and litigation.”

Annual report 2025A · The company itself

“We offer managed services in certain of our data centers where we provide “remote hands” services for our customers. The access to our customers’ networks and data, which is gained from these services, creates some risk that our customers’ networks or data will be improperly accessed.”

Annual report 2025A · The company itself

“Fire, serious process disruptions or other reasons leading to disruption of production, or defects in raw materials or final products affecting food safety can lead to major property damage, losses from production interruptions, liabilities and other indirect adverse effects on the company’s operations.”

Annual report 2025A · The company itself

“We have been and may be the target or the subject of third-party litigation from time to time that could result in significant liabilities and/or reputational harm, which could have a material adverse effect on our results of operations, financial condition and liquidity. The activities of our businesses, including the investment activities of the funds and other vehicles we manage and activities of our employees in connection with the funds or vehicles, their portfolio companies, our insurance subsidiaries, as well as publicly listed vehicles we manage or sponsor may subject us and certain of our employees to the risk of litigation, including class actions, by third parties, including investors dissatisfied with the performance or management of such funds or vehicles, holders of our or the funds’ or other vehicles’ portfolio companies’ debt or equity, policyholders of our retirement services business, public stockholders and a variety of other potential litigants.”

Annual report 2025A · The company itself

“Further, we utilize AI technologies in our advertising solutions and in our business operations and may expand such use in the future. Our use of AI technologies, and the use of AI technologies in third-party products and services, may create additional cybersecurity risks or increase cybersecurity risks, including risks of security breaches and incidents, and related monetary liability and harm to our reputation and business.”

Annual report 2025A · The company itself

“In addition, certain vendors and third-party service providers are vulnerable to disruption from severe weather events, natural disasters, public health crises, cybersecurity incidents or similar services and other disruptions, and may be subject to financial distress, regulatory sanctions, labor shortages, system failures or other operational issues. Operational risks could increase as third-party service providers increasingly offer mobile and cloud-based software services rather than software services that can be operated within our own data centers, as certain aspects of the security of such technologies may be complex, unpredictable or beyond our control, and any failure by mobile technology or cloud service providers to adequately safeguard their systems and prevent cyber-attacks could disrupt our operations and result in misappropriation, corruption or loss of confidential, proprietary or personal information.”

Annual report 2025A · The company itself

“•The operation of infrastructure assets is exposed to potential unplanned interruptions caused by significant catastrophic or force majeure events, including cyber-attacks. These risks could, among other effects, adversely impact the cash flows available from investments in infrastructure assets, cause personal injury or loss of life, damage property, or instigate disruptions of service.”

Annual report 2025A · The company itself

“Further, we are dependent on third-party service providers for hosting hardware, software and data processing systems that we do not control. We also rely on third-party service providers for certain aspects of our businesses, including for certain information systems, technology and administration of our funds and compliance matters. While we perform risk assessments on our third-party providers, our reliance on them and their potential reliance on other third-party service providers removes certain cybersecurity functions from outside of our immediate control, and cyber-attacks on our third-party service providers could adversely affect us, our business and our reputation.”

Annual report 2025A · The company itself

“Our funds may invest in strategic assets having a national or regional profile or in infrastructure assets, the nature of which could expose them to a greater risk of being subject to a terrorist attack or cyber-attack than other assets or businesses. Such an event may have material adverse consequences on our investment or assets of the same type or may require applicable portfolio companies to increase preventative security measures or expand insurance coverage.”

Annual report 2025A · The company itself

“Distributing, transporting, and storing natural gas involve risks that may result in accidents and additional operating costs. Our operations involve a number of hazards and operating risks inherent in storing and transporting natural gas that could affect the public safety and reliability of our distribution system. While Atmos Energy, with the support from each of its regulatory commissions, is accelerating the replacement of pipeline infrastructure, operating issues such as leaks, accidents, equipment problems, and incidents, including explosions and fire, could result in legal liability, repair, and remediation costs, increased operating costs, significant increased capital expenditures, regulatory fines and penalties, and other costs and a loss of customer confidence.”

Annual report 2025A · The company itself

“Increased information technology (IT) security threats and more sophisticated and targeted computer crime could pose a risk to our systems, networks, products, solutions and services, as well as those of our suppliers and customers.”

Annual report 2025A · The company itself

“The sophistication of the global cyber threat landscape means that the digital infrastructure, client data, and operational systems require continuous and rigorous protection”

Annual report 2026A · The company itself

“Berner Industrier med dotterbolag är som deflesta företag beroende av olika informationssystem och annan teknologi för att sköta och ut veckla verksamheten. Oplanerade driftsavbrott och cybersäkerhetsincidenter, till exempel data intrång, virus, sabotage och andra cyberbrott, kan innebära både intäkts bortfall och anseendeförluster.”

Annual report 2024A · The company itself

“A prolonged global failure of cloud services provided to us could result in cascading systems failures.”

Annual report 2025A · The company itself

“Like other businesses, we have been, and expect to continue to be, subject to attempts at unauthorized access of our network, mishandling or misuse, computer viruses or malware, cyber attacks and intrusions and other events of varying degrees. To date, these events have not had, individually or in the aggregate, a material adverse effect on our operations or business.”

Annual report 2025A · The company itself

“A cybersecurity incident and other technology disruptions could negatively impact our business. We use technology in substantially all aspects of our business operations, including internet and cloud-based systems and applications. We also use mobile devices, social networking, outside vendors, and various platforms to connect with our employees, suppliers, and residents.”

Annual report 2025A · The company itself

“Cyber-attacks can include third parties gaining unauthorized access to our data, including sensitive information about our residents, as well as our vendors' data or information technology systems. These attacks may occur through stolen credentials, computer malware, phishing attacks, ransomware, and other deliberate attempts to compromise information security.”

Annual report 2025A · The company itself

“These third parties face potential risks relating to cybersecurity similar to ours which could disrupt their businesses and adversely impact us. While we provide guidance and specific requirements, in some cases, we do not directly control their information technology security operations or the amount of investment they place in guarding against cybersecurity threats.”

Annual report 2025A · The company itself

“In the normal course of our business, we obtain, are provided and have access to large amounts of personal data, including but not limited to credit and debit card information, personally identifiable information and other data from and about our guests, Team Members, and suppliers. A compromise or a breach in our systems, or another data security or privacy incident that results in the loss, unauthorized release, disclosure or acquisition of such data or information, or other sensitive data or information, or other internal or external cyber or data security threats, including but not limited to viruses, denial-of-service attacks, phishing attacks, social engineering attacks, ransomware attacks and other intentional or unintentional disruptions, could occur and have a material adverse effect on our operations and ability to operate, reputation, operating results and financial condition.”

Annual report 2026A · The company itself

“Operationell risk är risken för förlust till följd av såväl interna orsaker (datafel, misstag, bedrägerier, bristande efterlevnad av lagar och interna regler, övriga brister i den interna kontrollen etc.) som händelser i omvärlden (naturkatastrofer, extern brottslighet etc.).”

Annual report 2024A · The company itself

“Cyber-attacks against government agencies and their vendors are carried out by a range of different actors”

Annual report 2025A · The company itself

“Fail to execute strategy and build partner channels Fail to retain and attract talent Cyber Attack Competitors build standard platform similar to F2 Legal risks entering new geographical markets Mitigation Sharpening cBrain’s value proposition to customers, highlighting the gains of digitizing government using standard software, including efficiency gains, low risk, rapid implementation through configuration, and speed of action in permitting.”

Annual report 2025A · The company itself

“Fraud risk arises from attempted or actual theft of financial assets or other property of any client or the Company. Fraud risk includes internal fraud, or the risk arising from personnel attempting or committing theft of financial assets or other property of any client or the Company.”

Annual report 2025A · The company itself

“Our information technology systems are subject to damage or interruption due to cybersecurity attacks, system conversions, power outages, computer or telecommunication failures, catastrophic events such as fires, tornadoes and hurricanes and usage errors by our employee-partners. Although we have an active disaster recovery plan in place that is frequently reviewed and tested, and we believe that we have adopted appropriate measures designed to mitigate potential risks to our technology and our operations from these information technology-related and other potential disruptions, given the unpredictability of the timing, nature and scope of such disruptions, we could potentially be subject to production downtimes, operational delays and interruptions in our ability to provide products and services to our customers. Any disruption caused by the unavailability of our information technology systems could adversely affect our revenue, could require us to make a significant investment to fix or replace them and, therefore, could adversely affect our consolidated results of operations.”

Annual report 2026A · The company itself

“However, there can be no assurance that we will not experience material cybersecurity incidents in the future. If the network of security controls, policy enforcement mechanisms and monitoring systems to address these threats to our technology fails, or we are unable to successfully address cybersecurity incidents or the risks from cybersecurity threats, we could experience production downtimes, operational delays and interruptions in our ability to provide products and services to our customers, the compromising of confidential or otherwise protected Company, customer, or employee-partner information, destruction or corruption of data, security incidents, or other manipulation or improper use of our systems and networks which could result in financial losses from remedial actions, loss of business or potential liability and damage to our reputation.”

Annual report 2026A · The company itself

“In addition, we rely on software applications, enterprise cloud storage systems and cloud computing services provided by third-party vendors for certain information technology services, including our SAP enterprise system, payroll data, risk management data and lease data. If these third-party vendors, as well as our suppliers and other vendors, experience service interruptions or damage, security incidents, cyber-attacks, computer viruses, ransomware or other similar events or intrusions, our business and our consolidated results of operations may be adversely affected.”

Annual report 2026A · The company itself

“Our use of AI technologies also may increase cybersecurity, privacy and data protection risks. AI systems may process large volumes of proprietary, personal, customer, supplier and employee-partner information, and failures in the design, implementation or oversight of such systems could result in the unauthorized disclosure, misuse, loss or corruption of data.”

Annual report 2026A · The company itself

“The use of AI applications may result in data leakage or unauthorized exposure of data, including confidential business information, the personal data of end users, or other sensitive information. Such leakage or unauthorized exposure of data related to the use of AI applications could result in legal claims or liability or otherwise adversely affect our reputation and results of operations.”

Annual report 2025A · The company itself

“The software underlying our platform is highly complex and our practice is to release frequent software updates. The software has contained in the past, and may contain in the future, undetected errors or vulnerabilities, some of which may only be discovered after the code has been released. The third-party software that we incorporate into our platform may also be subject to errors or vulnerabilities.”

Annual report 2025A · The company itself

“These events can occur for many reasons, including hardware and software defects or malfunctions, cyberattacks such as denial-of-service, credential stuffing, and other types of attacks, human error, earthquakes, hurricanes, floods, fires, natural disasters, sustained drought, power losses, disruptions in telecommunications services, fraud, military or political conflicts, terrorist attacks, computer viruses, or other events.”

Annual report 2025A · The company itself

“If our service providers fail to perform adequately, experience outages, cyberattacks or other security incidents, financial distress or insolvency, our customers may not be able to make and receive payments or use their preferred payment methods, which could increase our costs, drive sellers away from our marketplaces, result in potential legal liability, and materially harm our business.”

Annual report 2025A · The company itself

“We and our service providers collect, store, use, retain, disclose, transfer and process a significant amount of confidential, personal and sensitive information from our users and employees, including transaction, identity, biometric, health, payments and financial information.”

Annual report 2025A · The company itself

“We have seen an increase in attack sophistication, and future attacks are likely to be increasingly sophisticated and highly targeted, particularly due to rapid developments in AI.”

Annual report 2025A · The company itself

“Under the FTC Act, the FTC’s jurisdiction includes the ability to bring enforcement actions based on the security measures we employ to safeguard the personal data of consumers. Allegations that we failed to safeguard or handle such data in a reasonable manner may subject us to regulatory scrutiny or enforcement action.”

Annual report 2025A · The company itself

“Department of Commerce’s National Institute of Standards and Technology’s Cybersecurity Framework; the Clarifying Lawful Overseas Use of Data Act; cyber incident notice requirements for banks and their service providers under rules and regulations issued by federal banking regulators; cybersecurity incident disclosure requirements for public companies under regulations issued by the SEC; and identity theft, file freezing, and similar state privacy laws.”

Annual report 2025A · The company itself

“Consumers can also subscribe to credit monitoring, which delivers alerts via email and text when changes to a user’s FICO Scores or other credit report content are detected. In addition, consumers can purchase identity theft monitoring products that alert them to potential risks of identity fraud.”

Annual report 2025A · The company itself

“Key FICO solutions currently offered include: •FICO® Fraud Solutions empower organizations to safeguard the business and their customers from payments fraud and application fraud. Leveraging advanced analytic capabilities on a large scale and in real-time, FICO Fraud Solutions identify fraud and enable strategies designed to prevent fraud across payment cards, money transfers, and instances where stolen or synthetic identities are exploited to open accounts.”

Annual report 2025A · The company itself

“Nedbrud i it-systemer eller cyber attack”

Annual report 2026A · The company itself

“Nedbrud i IT systemer eller cyber attack Flüggers drift er afhængig af stabile IT-systemer for at sikre, at produktionen løbende tilpasses efterspørgslen. Et nedbrud kan påvirke muligheden for at producere, fakturere og levere. Krigen i Ukraine øger generelt risikoen for cyber attacks.”

Annual report 2026A · The company itself

“Genmab may be subject to malicious cyber attacks... with the result of significant business disruptions”

Annual report 2025B · From the report

“The continuously evolving threat of cyber security, data leakage and data security are a key area of focus. A major cyberattack could result in an extended period of down time resulting in delays to customers and additional costs for the organization.”

Annual report 2025A · The company itself

“Our products and services, and the products and services of our third-party vendors and partners, may be subject to fraudulent usage, including, but not limited to domain name hijacking, revenue share fraud and other evolving schemes (external fraudulent activity).”

Annual report 2025A · The company itself

“Gränges är följaktligen utsatt för risker relaterade till avbrott och störningar i sin IT-infrastruktur, vilka kan orsakas av datavirus, strömavbrott, mänskliga eller tekniska fel, sabotage, väder- eller naturrelaterade händelser eller problem orsakade av bristande skötsel och underhåll. IT-attacker, fel och skador på IT-system, driftstörningar och felaktiga eller bristfälliga leveranser av IT-tjänster från Gränges IT-leverantörer som leder till omfattande produktionsavbrott skulle kunna ha en väsentlig negativ effekt på Gränges verksamhet.”

Annual report 2024A · The company itself

“Harboe vurderer, at trusselsbilledet for IT-sikkerhed stadig er stigende”

Annual report 2026B · From the report

“We, and our third-party service providers, are regularly the target of rapidly evolving cyber threats, including denial of service attacks, ransomware, spyware, misinformation, phishing/smishing/vishing attacks, business compromise attacks, typosquatting, automated attacks, employee errors, negligence or malfeasance, the use of malicious codes or worms, payment fraud, and other unauthorized occurrences on, or conducted through, our or our third-party service providers' information systems and networks. Therefore, we continuously monitor and update our information technology networks and infrastructure to prevent, detect, address, and mitigate the risk of unauthorized access, misuse, computer viruses, and other events that could have a security impact.”

Annual report 2025A · The company itself

“We have been subject to cyber attacks, ransomware, and other security breaches, though these incidents historically have not had a significant impact on our business operations.”

Annual report 2025A · The company itself

“Cyberrisk HEXPOL använder modern IT-infrastruktur för kommunikation och verksamhetsstöd. Störningar i dessa system kan påverka verksamheten negativt både vad gäller marknadsaktiviteter och produktion. Cyberattacker och missbruk av data kan också leda till att personuppgifter och immateriella tillgångar kommer i felaktiga händer.”

Annual report 2024A · The company itself

“In 2024, the Company identified certain quality issues involving noncompliance with welding procedures at Newport News. The Company commenced an investigation and disclosed the matter to the U.S. Government.”

Annual report 2025A · The company itself

“ANDRA RISKOMRÅDEN I VÄRDEKEDJAN Risker relaterade till informationssystem, personuppgifter och cyberbrott Koncernen förlitar sig starkt på dess IT-system för att kunna driva sin verksamhet. Störningar eller fel i kritiska IT-system kan ha direkt påverkan exempelvis på produktion och logistik.”

Annual report 2024A · The company itself

“Cyber-attacks and disruptions in information systems may result in interruptions of production, increasing IT costs and financial losses.”

Annual report 2025A · The company itself

“Our suppliers, which operate in multiple countries around the world, could also experience disruptions in their operations resulting from various factors, including equipment malfunction or failure, regulatory requirements or actions, raw material shortages, labor disputes or shortages, including from the effects of public health pandemics, cyberattacks, natural and other disasters, and wars or other geopolitical events.”

Annual report 2025A · The company itself

“Kempower has identified potential negative impacts and risks regarding potential individual safety incidents or damage due to malfunction of products.”

Annual report 2025A · The company itself

“In addition, given the Dodd-Frank legislative mandate to centrally clear eligible derivative contracts, we rely on central clearing counterparties to remain open and operationally viable at all times. A financial institution or other counterparty failure or a cybersecurity breach that causes the failure of or disruption to a counterparty or client, may materially and adversely affect our business, financial condition, or results of operations.”

Annual report 2025A · The company itself

“Our products may contain vulnerabilities that could be exploited by cybersecurity attackers, allowing them to introduce malicious code into our products to gain access to customer networks. Such attacks could lead to disruptions to our customers’ operations or processes, system downtime, financial loss, loss of their intellectual property, business information and proprietary data, or corruption of data, which could impact Keysight’s reputation, and result in loss of confidence in our products, loss of orders, and loss in revenue, which could materially impact our financial results.”

Annual report 2025A · The company itself

“We, and our third-party service providers, like all businesses, are subject to cyberattacks and security incidents that threaten the confidentiality, integrity, and availability of our IT systems and information resources. Cyberattacks and security incidents include intentional or unintentional acts by employees, customers, contractors or third parties, who seek to gain unauthorized access to our or our service providers’ systems to disrupt operations, corrupt data, or steal confidential or personal information through malware, computer viruses, ransomware, software or hardware vulnerabilities, social engineering (e.g., phishing attachments to e-mails) or other vectors. Cyberattacks are becoming more challenging to identify, investigate and remediate, because attackers increasingly use techniques and tools, including artificial intelligence, that circumvent controls, avoid detection, and remove or obscure forensic evidence, including as a result of the intensification of state-sponsored cybersecurity attacks during periods of geopolitical conflict.”

Annual report 2025A · The company itself

“Turvallisuuteen ja yllättäviin tapahtumiin liittyvät riskit Tietotekniikka on merkittävässä roolissa KONEen sekä sen toimittajien ja asiakkaiden toiminnassa, ja KONEen liiketoiminta on riippuvainen tiedon laadusta, oikeellisuudesta, saatavuudesta ja luotettavuudesta. Tämä altistaa KONEen IT-häiriöille ja kyberturvallisuusriskeille, sillä operatiiviset tietojärjestelmät ja -tuotteet voivat olla alttiita toiminnan keskeytymiselle, tiedon häviämiselle tai manipuloimiselle sekä toimintahäiriöille, mikä puolestaan voi johtaa prosessien ja tuotteiden saatavuuden häiriöihin.”

Annual report 2025A · The company itself

“Further, we have experienced, and may continue to experience, input cost volatility due global competition for resources, foreign currency fluctuations, geopolitical conditions or conflicts, cybersecurity incidents, severe weather, natural disasters, global climate change, water risk, pandemics, crop failures, crop shortages due to plant disease or insect and other pest infestation, changes in consumer demand, alternative energy initiatives, including increased demand for biofuels, and agricultural programs.”

Annual report 2025A · The company itself

“Geopolitical tensions or conflicts, and the rapid evolution and increased adoption of artificial intelligence technologies may further heighten the risk of cybersecurity attacks.”

Annual report 2025A · The company itself

“Factors that are hard to predict or beyond our control, such as weather or other geological events or natural disasters, including hurricanes, earthquakes, floods, tsunamis, or wild fires (whether as a result of climate change or otherwise), raw material shortages, fires or explosions, political unrest, geopolitical conflicts, terrorism, civil strife, acts of war, public corruption, expropriation, generalized labor unrest or labor shortages, cybersecurity incidents, or pandemics, could damage or disrupt our operations or the operations of our customers, suppliers, vendors, co-manufacturers, distributors, or regulators.”

Annual report 2025A · The company itself

“There are a number of risks associated with our reliance on contract manufacturers including: •reduced control over delivery schedules and planning; •availability of manufacturing capability and capacity, particularly during periods of high demand; •reliance on the quality assurance procedures of third parties; •risks associated with data security breaches or cyber-attacks targeting our contract manufacturers, including manufacturing disruptions or unauthorized access to information; and •potential misappropriation of our intellectual property.”

Annual report 2026A · The company itself

“Like other companies, we are subject to ongoing attempts by malicious actors, including through hacking, malware, ransomware, denial-of-service attacks, social engineering, exploitation of internet-connected devices, and other attacks, to obtain unauthorized access to, or acquisition or other processing of confidential or other information or otherwise affect service reliability and threaten the confidentiality, integrity and availability of our systems and information stored or otherwise processed on our systems. Cyber threats have increased in recent years, in part due to increased remote work and frequent attacks, including in the form of phishing emails, malware attachments and malicious websites.”

Annual report 2026A · The company itself

“The Company depends upon information systems and other digital technologies for controlling operations, processing transactions and summarizing and reporting results of operations (“IT systems”). The secure processing, maintenance and transmission of information is critical to the Company’s operations. These IT systems or those of Lundin Gold’s suppliers could be subject to network disruptions caused by a variety of sources, including computer viruses, security breaches, defective software updates and cyber-attacks, as well as disruptions resulting from incidents such as cable cuts, damage to physical plants, natural disasters, terrorism, fire, power loss, vandalism and theft. operations also depend on the timely maintenance, upgrade and replacement of networks, equipment, IT systems and software, as well as pre-emptive expenses to mitigate the risks of failures.”

Annual report 2024A · The company itself

“Increased global information cybersecurity threats and more sophisticated, targeted computer crime pose a risk to the confidentiality, availability and integrity of our data, operations and infrastructure. Our cybersecurity and infrastructure protection technologies, disaster recovery plans and systems, employee training and vendor risk management may not be sufficient to defend us against all unauthorized attempts to access our information or impact our systems.”

Annual report 2025A · The company itself

“Other disruptions in the manufacturing process or product sales, trade and fulfillment systems for any reason, including infrastructure, information and equipment malfunction, including due to cyber attacks, failure to follow specific protocols and procedures, supplier or Company facility shut-downs, defective raw materials, labor shortages, natural disasters such as hurricanes, tornadoes, earthquakes, or wildfires, property damage or facility closures from riots or public protests, and other environmental factors and the impact of epidemics, pandemics, or other public health crises, and actions by businesses, communities and governments in response, could lead to launch delays, product shortages, unanticipated costs, lost revenues and damage to our reputation.”

Annual report 2026A · The company itself

“Continuity risks Production continuity can be affected by serious disruptions such as fires, explosions, significant machine breakdowns, extreme weather events, environmental damage, labour disputes, cyberattacks, infectious diseases, problems with the availability of raw materials and energy, and disruptions in the supply chain.”

Annual report 2025A · The company itself

“Catastrophic events or geopolitical conditions could disrupt our business. A disruption or failure of our systems, operations, or supply chain because of a major earthquake, weather event, cyberattack, terrorist attack, pandemic, or other catastrophic event could cause delays in completing sales, providing services, or performing other critical functions.”

Annual report 2026A · The company itself

“Verksamhet Global leveranskedja påverkar möjligheten att leverera Inköp, hemarbete, digitalisering, kontinuitetsplan i produktion Utbildning, investeringar för att möta SUA-krav Exponering mot bolagsspionage Påverkad produktionskapacitet till följd av externa händelser Brandsäkerhetssystem, flera leverantörer av kritiska funktioner (IT, elektricitet), etablerad affärskontinuitetsplan Risker kopplade till leverantörer och leverantörskedja som påverkar vår förmåga att leverera och säkra verksamheten.”

Annual report 2024A · The company itself

“Accidents or equipment failures occurring in the course of our operating activities could result in significant liabilities, interruptions or shutdowns of facilities or the need for significant safety or other expenditures. We engage in mining and industrial activities, including rail transportation, that can result in serious accidents or experience equipment failures. If our procedures are not effective, or if an accident or equipment failure were to occur, we could be subject to liabilities arising out of property damage, personal injuries or death, our operations could be interrupted and we might have to shut down or abandon affected facilities.”

Annual report 2025A · The company itself

“Koncernens IT-infrastruktur kan være mål for cyber- eller ransomwareangreb”

Annual report 2025A · The company itself

“Operatiivisella tasolla Nesteen liiketoiminnan suorituskyky on hyvin riippuvainen jalostustoiminnan jatkuvasta luotettavuudesta. Suunniteltujen seisokkien lisäksi esimerkiksi katkot käyttöhyödykkeiden tai kriittisten laitteiden käytettävyydessä voivat aiheuttaa odottamattomia tuotannon häiriöitä, jotka vaikuttavat Nesteen kykyyn vastata asiakaskysyntään. Samoin häiriöt toimitusketjussa ja keskeytykset kuljetuksissa, kuten esimerkiksi merikuljetuksille ominaiset riskit, voivat uhata Nesteen liiketoiminnan jatkuvuutta operatiivisella tasolla.”

Annual report 2025A · The company itself

“Inom koncernens produktområden finns det alltid en risk att produkter på grund av seriefel kan komma att behöva återkallas på grund av materialfel eller annat fel genom så kallad “recall”. Riskerna reduceras genom ett systematiskt kvalitetsarbete och rutiner för kontroll.”

Annual report 2024A · The company itself

“Yhtiö saattaa epäonnistua tieto- ja kyberturvallisuusriskien tunnistamisessa, mikä voi johtaa asiakkaan tietojen luvattomaan käyttöön, julkistamiseen, korruptoitumiseen, katoamiseen tai väärinkäyttöön. Tällainen epäonnistuminen voi johtaa siihen, että asiakkaat saattavat luopua yhtiön palveluiden käytöstä ja siihen, että yhtiö rikkoo tietosuoja- ja tietoturvalainsäädäntöä.”

Annual report 2025A · The company itself

“Cyberhoten mot företag och deras kunder har ökat stadigt med åren. Attackerna har blivit mer sofistikerade och inträffar allt oftare. Den här trenden är tydlig även i Norden.”

Annual report 2025A · The company itself

“Increased information technology threats and cybersecurity incidents and threats could pose a risk to our systems, networks, products, solutions and services and those of our business partners. We have experienced and expect to continue to experience cybersecurity threats and some cybersecurity incidents to our systems and networks.”

Annual report 2025A · The company itself

“The following impacts and risks have been identified as material for the Company Impacts associated with end user privacy Negative impact As an airline, the Company collects, uses and stores the personal data received from its passengers. This includes personal information that is legally required for the passengers to board and disembark flights, including, but not limited to personal identity and contact information and information regarding their visa status or other entry requirements in relation to their final destination.”

Annual report 2024A · The company itself

“Disruption to IT systems, such as cyberattacks or infrastructure failure, resulting in business disruption or breach of data confidentiality. • Could limit our ability to produce and safeguard product quality. • Could compromise patients’ or other individuals’ privacy. • Could limit our ability to maintain operations or limit future business opportunities if proprietary information is lost. • Could have an adverse impact on sales, profits and market position. • Proactive company-wide information security awareness initiatives. • Continuity plans for non-availability of IT systems. • Company-wide internal audit of IT security controls. • Detection and protection mechanisms in IT systems and business processes.”

Annual report 2025A · The company itself

“Cyber-attacks, including ransomware attacks by organized criminal threat actors, nation-states, and nation-state-supported actors, may become more prevalent and severe.”

Annual report 2026A · The company itself

“In addition, we rely extensively on various systems, some of which are provided by third-party service providers, to manage inventory, process transactions, and timely provide products to our stores and customers. These systems are subject to failure, damage, or interruption, including power outages, telecommunications failures, computer viruses, cyber-attacks, security breaches, or other catastrophic events. If these systems are damaged or fail to function properly, we may experience loss of critical data and interruptions or delays in our ability to manage inventories, deliver product, or process customer transactions.”

Annual report 2025A · The company itself

“Orion’s own production and other operations are exposed to risks that may materially disrupt their operations or even interrupt them at least temporarily. Such risks include, for example, accidents, damages, natural disasters, strikes, employee illness, conflicts, terrorism, cyber-attacks, hybrid influence, disruption of information or communication systems, disruption of energy supply, and disruption of supply and logistics chains.”

Annual report 2025A · The company itself

“Such disruptions may significantly impact our operations and data security. A breach of data confidentiality or business interruption may temporarily affect our revenue and profitability.”

Annual report 2025A · The company itself

“Potentiell negativ påverkan Uppströms Pandox verksamhet Nedströms Cybersäkerhet (Företagsspecifik upplysning) I sin roll som hotelloperatör hanterar Pandox stora mängder av gästernas personliga och känsliga information. Om denna information läcker ut kan det få allvarliga konsekvenser för gästerna. Cyberbrottslighet ökar generellt i samhället.”

Annual report 2024A · The company itself

“IT risks Park Street uses IT to a considerable extent and are thus exposed to operational disruption of the established IT safety. This can cause operating and financial losses.”

Annual report 2025A · The company itself

“En hel eller delvis nedlukning af forretningssegmenternes IT-systemer som følge af et cyberangreb kan få negativ indvirkning”

Annual report 2025A · The company itself

“Informationssäkerhet Information är en viktig tillgång och tillgången till information är en förutsättning för att Peab ska kunna bedriva sin verksamhet. Omvärldsutvecklingen innebär en förhöjd risk att Peab ska utsättas för direkta cyberangrepp eller indirekta angrepp via digitala leveranskedjor, med konsekvenser för verksamheten.”

Annual report 2024A · The company itself

“These systems are subject to damage or interruption from power outages, system, network, internet and telecommunications failures, hackers, including through a ransomware attack, computer worms, viruses, and other destructive or disruptive cybersecurity incidents, and catastrophic events. Such incidents could also result in significant costs to repair or replace such networks or information systems, as well as actual monetary losses in case of a cybersecurity incident that resulted in fraudulent payments or other cash transactions.”

Annual report 2025A · The company itself

“In the ordinary course of our business we acquire and store sensitive data, including personally identifiable information of our prospective and current customers and our employees. The secure processing and maintenance of this information is critical to our operations and business strategy.”

Annual report 2025A · The company itself

“While we aim to develop, integrate, and use AI responsibly, we may ultimately be unsuccessful in identifying or resolving issues, such as accuracy limitations, cybersecurity risks, unintended biases, and discriminatory outputs, before they arise. AI is a new and emerging technology in early stages of commercial use and presents a number of risks inherent in its use, including, but not limited to, ethical considerations, public perception, intellectual property protection, regulatory compliance, privacy concerns, and data security, all of which could have a material adverse effect on our business, results of operations, and financial position.”

Annual report 2025A · The company itself

“Our computer systems, including our back-up systems, are subject to damage or interruption from power outages, computer and telecommunications failures, computer viruses, security breaches (through cyber-attacks from computer hackers and sophisticated organizations), catastrophic events such as fires, tornadoes and hurricanes, usage errors by our employees, or cyber-attacks or errors by third party vendors who could gain access to our confidential data or that of our customers, vendors, or employees. In particular, the frequency, severity and novelty of cyber-attacks on companies has increased significantly in recent years, including significant ransomware attacks and foreign attacks on prominent companies and computer software programs, as threat actors become increasingly sophisticated and employ techniques, including malicious uses of AI such as deepfakes, to launch attacks that are increasingly difficult to detect and defend against.”

Annual report 2025A · The company itself

“In line with its sustainability strategy, Puuilo aims to ensure the quality and safety of the products it sells as well as the security of customer data.”

Annual report 2026A · The company itself

“We and/or our suppliers may fail to effectively prevent, detect and recover from security breaches and, therefore, such breaches could result in misuse of our assets, loss of property including trade secrets and confidential or personal information, and other business disruptions.”

Annual report 2025A · The company itself

“Like other major corporations, we are the target of cyber-attacks, from time to time, which include phishing, spam emails, hacking, social engineering, industrial espionage and malicious software.”

Annual report 2025A · The company itself

“Risk för överträdelser på grund av cyberattacker – Rejlers riskerar att utsättas för cyberattacker genom våra produkter och tjänster, vilket kan leda till potentiella avvikelser i informationssäkerheten. Negativ inverkan Risk för incidenter kopplat till informationssäkerhet – Det finns en risk för informationssäkerhetsincidenter, inklusive brott mot integritet eller sekretessavtal.”

Annual report 2024A · The company itself

“Cyber security and data privacy are an ongoing focus, and we have made and will 8 continue to make investments to protect our customer data, intellectual property and global operations.”

Annual report 2025A · The company itself

“Cybersecurity threats are continuously evolving and may have an impact on our customers, suppliers, subcontractors, and other third parties with whom we do business routinely, both on premises and in the cloud, attempting to gain unauthorized access to our confidential, proprietary, or otherwise protected information, classified information, or personal data or other information relating to our employees, customers, and other third parties, or to disrupt our systems or the systems of third parties.”

Annual report unknown yearA · The company itself

“In addition, our products could fail as a result of cyber-attacks, such as those that seize control and result in misuse or unintended use of our products, or other intentional acts.”

Annual report unknown yearA · The company itself

“•Should we or our third-party service providers experience a local or regional disaster or other business continuity problem, such as an earthquake, hurricane, flood, civil unrest, protests, military conflict, terrorist attack, public health crisis (e.g., pandemic), security breach, cyber attack, data breach, power loss, telecommunications failure or other natural or man-made disaster, our ability to continue to operate will depend, in part, on the availability of our or our third-party service provider’s personnel, our or our third-party service provider’s office facilities and the proper functioning of our or our third-party service provider’s computer, telecommunication and other related systems and operations.”

Annual report 2025A · The company itself

“•Given our businesses are often privy to material non-public information concerning our customers, our data could be improperly used, including for insider trading by our employees and third-party vendors with access to key systems. We have experienced insider trading incidents involving employees in the past, and it is not always possible to deter misconduct by employees or third-party vendors.”

Annual report 2025A · The company itself

“In addition, Sanoma is exposed to potential cyberattacks or data breaches resulting from unauthorised or accidental loss of, or access to personal data managed by Sanoma or by third parties processing data on Sanoma’s behalf.”

Annual report 2025A · The company itself

“The risks can be divided into physical risks, such as fire, sabotage and equipment breakdown, and logical risks, such as information security risks, including the increasing threat of malware and cyberattacks, hacking of personal data or other sensitive data assets, and employee or software failure.”

Annual report 2025A · The company itself

“Otillräckligt skydd av data kan leda till försämrat anseende och varumärke, förlorade affärer och böter.”

Annual report 2024A · The company itself

“Koncernens datasystem kan drabbas av tekniska störningar eller cyberattacker som kan störa och skada datasystemen, äventyra skyddet av konfidentiell information, orsaka informationsförluster som är kostsamma eller omöjliga att åtgärda och avbrott i verksamheten.”

Annual report 2024A · The company itself

“Med dessa följer en risk att koncernen ska bli utsatt för stöld av information, till exempel via dataintrång. Vidare finns en risk att koncernen inte lyckas bibehålla existerande patentskydd, att pågående patentansökningar inte beviljas eller att ytterligare patentskydd för framtida tekniker och applikationer inte erhålls.”

Annual report 2024A · The company itself

“I och med att säkerhetshot blir mer sofistikerade innebär de en ökad risk för incidenter som kan ha betydande negativ inverkan på företag, samhället och individer. Den ökade förekomsten av cybersäkerhetshot skapar både risk och möjligheter eftersom en effektiv säkerhet kan utgöra en konkurrensfördel, medan brist på åtgärder kan riskera att skada kundernas förtroende.”

Annual report 2024A · The company itself

“Like other prominent retail companies, we have experienced cyber-attacks (e.g., phishing) and other attempts to breach or gain unauthorized access to our systems, as have our third-party service providers, business partners, and licensees. We expect such threats to continue and evolve, especially with the rapid evolution and increased adoption of artificial intelligence.”

Annual report 2025A · The company itself

“Transactions of this nature also involve a number of risks and financial, accounting, tax, regulatory, strategic, client relationship, managerial, operational, cybersecurity, cultural and employment challenges, which could adversely affect our consolidated results of operations and financial condition.”

Annual report 2025A · The company itself

“Operativ risk är risken för förluster till följd av icke ändamålsenliga eller misslyckade interna pro cesser, mänskliga fel, felaktiga system eller externa händelser. Definitionen inkluderar legal risk, modellrisk och risk inom informa tions- och kommunikationsteknik (IKT-risk).”

Annual report 2024A · The company itself

“Cyberattacker och sabotage av digital infrastruktur används av såväl statliga aktörer som cyberkriminella för att slå ut verksamheter, påverka försörjningskedjor eller försvaga samhällen.”

Annual report 2024A · The company itself

“These technology systems and the operation thereof are vulnerable to disruption from circumstances beyond our control, including fire, natural disasters, power outages, systems failures, security breaches, espionage, cyber-attacks, viruses, theft and inadvertent release of information. In the normal course of business, we and our third-party providers experience cybersecurity threats and incidents of varying degrees from time-to-time, including ransomware, ransom-related extortion, and phishing attacks, as well as distributed denial of service attacks and the theft of data.”

Annual report 2026A · The company itself

“The legal and regulatory landscape and industry standards surrounding artificial intelligence technologies are rapidly evolving and remain uncertain, and compliance may impose significant operational costs and may limit our ability to develop, deploy or use artificial intelligence technologies. Furthermore, the deployment of artificial intelligence systems could expose us to increased cybersecurity threats, such as data breaches and unauthorized access leading to financial losses, legal liabilities, and reputational damage.”

Annual report 2026A · The company itself

“Därför har Saab vidtagit ökade säkerhetsåtgärder för att skydda anläggningar, personal och IT samt åtgärder relaterade till cyberrisker, vilket kan leda till ökade kostnader.”

Annual report 2024A · The company itself

“Catastrophic events and climate change may have a long-term impact on our business. Natural disasters, cyber incidents, weather events, wildfires, power disruptions, telecommunications failures, pandemics, health crises and other public health events, failed upgrades of existing systems or migrations to new systems, acts of terrorism, geopolitical conflict (such as the Russia-Ukraine war and the war in the Middle East), or other events could cause outages, disruptions and/or degradations of our infrastructure (including our or our partners’ information technology and network systems), a failure in our ability to conduct normal business operations, or the closure of public spaces in which players engage with our games and services all of which could materially impact our reputation and brand, financial condition and operating result.”

Annual report 2026A · The company itself

“Euroopan geopoliittisen kriisin mahdollinen eskaloituminen, yleisen taloustilanteen heikkeneminen, vallitseva korkea korkotaso ja inflaatio saattavat johtaa Talenomin asiakkaiden liiketoimintojen supistumiseen tai konkursseihin, mikä aiheuttaisi asiakasmenetyksiä tai asiakkuuksien pienenemistä. • Talenom saattaa epäonnistua yritysostojen toteuttamisessa tai ostettujen yhtiöiden integroinnissa yhtiön liiketoimintaan. • Kilpailutilanne voi kiristyä kilpailijoiden mahdollisesti tuodessa uusia palveluita markkinoille tai aloittamalla hintakilpailun. • Yhtiön omiin tai yhteistyökumppaneiden tarjoamiin IT-järjestelmiin ja tietoliikenneyhteyksiin voi kohdistua tietoturvaloukkauksia tai niiden ylläpidossa ja päivittämisessä voi ilmetä puutteita, vikoja tai häiriöitä. • Laaja-alainen kustannusinflaatio saattaisi johtaa merkittävään kustannustason nousuun. • Epäonnistuminen rekrytoinneissa tai henkilöstön sitouttamisessa.”

Annual report 2024A · The company itself

“Because our fulfillment centers include automated and computer-controlled equipment, they are susceptible to risks including power interruptions, system failures, software viruses, configuration errors and security breaches.”

Annual report 2026A · The company itself

“Use of AI by our employees or third-party service providers could increase the risk of exposure of our proprietary, confidential, sensitive or personal information.”

Annual report 2026A · The company itself

“Operational Risks and Insurance We are subject to all risks inherent in the midstream natural gas, NGLs and crude oil businesses. These risks include, but are not limited to, explosions, fires, mechanical failure, cyberattacks, terrorist attacks, product spillage, weather, nature and inadequate maintenance of rights of way.”

Annual report 2025A · The company itself

“We are subject to cybersecurity risks. A cyber incident could occur and result in information theft, data corruption, operational disruption, disclosure of business sensitive, confidential or personally identifiable information, misdirected wire transfers, reputational harm, and financial loss. • The widespread outbreak of illnesses or any other public health crises that impacts operations and/or the global demand for energy commodities may have material adverse effects on our business, financial position, results of operations and/or cash flows.”

Annual report 2025A · The company itself

“CYBER Risks The Group relies on IT systems in its day-to-day operations. Disruptions or faults in critical production systems have a direct negative impact.”

Annual report 2025A · The company itself

“In addition, tension in the global political situation increases the risk of supply chain disruptions, sanctions, increasing cyber threats and risk of sabotage of critical infrastructure.”

Annual report 2024A · The company itself

“För att skydda kundernas integritet och personliga data genomför Tele2 regelbundna stresstester, sårbarhetstester och penetrationstester för att förebygga cyberattacker på Tele2s nätverk. Som en del av de proaktiva säkerhetsåtgärderna använder Tele2 tjänster från så kallade ”white hat”-hackare, som identifierar potentiella sårbarheter i IT-säkerheten och rapporterar dessa till Tele2. Detta gör det möjligt för Tele2 att åtgärda säkerhetsbrister innan de utnyttjas av skadliga aktörer och därigenom skydda kunder och andra intressenter.”

Annual report 2024A · The company itself

“Stødt stigende antal cyberangreb, som kan have forskellige negative følger og medføre tab.”

Annual report 2025A · The company itself

“Even a disruption as brief as a few minutes could have a negative impact on marketplace activities and could result in a loss of revenue. These facilities may be located in areas prone to natural disasters and may experience catastrophic events such as earthquakes, fires, floods, power loss, telecommunications failures, public health crises and similar events. They may also be subject to break-ins, sabotage, intentional acts of vandalism, cyberattacks and similar misconduct.”

Annual report 2025A · The company itself

“Our information technology systems, networks, connected services, and infrastructure and technology, including artificial intelligence (AI) technology, embedded in certain of our control products have been and are at risk to cyber attacks and unauthorized access.”

Annual report 2025A · The company itself

“In addition, the rapid evolution and increased adoption of AI technologies may intensify our cybersecurity risks, including risks from malicious or misuse of AI to craft increasingly sophisticated cybersecurity attacks against us, our business partners, or our third-party vendors.”

Annual report 2025A · The company itself

“•Our growing use of artificial intelligence (“AI”) and machine learning may present additional risks, including risks associated with algorithm development or use, the tools and data sets used, and/or a complex, developing regulatory environment. •We are subject to climate risks, including physical and transitional risks, and if we are unable to manage such risks, our business may be adversely impacted. •Increased attention to, and evolving expectations regarding environmental and social matters may adversely impact our business, reputation and liabilities, including in the context of certain goals we have announced. •Occurrence of a catastrophic event, including but not limited to disease, a weather event, war, or terrorist attack, could adversely impact our business, financial condition and results of operation. •We rely on third parties maintaining open marketplaces to distribute our platform and to provide the software we use in certain of our products and offerings.”

Annual report 2025A · The company itself

“Our financial performance and our reputation could be adversely affected, and we could be subject to legal liability or regulatory enforcement actions, if we are unable to protect against, or effectively respond to, cyberattacks or other cyber incidents. We depend on the security of our information technology systems, and those of our third-party vendors, to support numerous business processes and activities, including our online ordering system.”

Annual report 2025A · The company itself

“The most significant operational risks for Vaisala’s operations relate to suppliers and potential extended unavailability or disruption of IT and other critical digital infrastructure, resulting from software failures, power outages, cyberattacks, malware, or similar causes. If realized, these risks could result in production delays or stoppages, major service unavailability, interruptions in operations, financial loss, or loss of critical data.”

Annual report 2025A · The company itself

“In the event of a major earthquake, hurricane, or other natural disaster, or catastrophic event such as an actual or threatened public health emergency (e.g., a global pandemic), fire, extreme weather event, power loss, telecommunications failure, cyberattack, armed conflicts (including the Russian invasion of Ukraine and the conflict in the Middle East), or terrorist attack, we may be unable to continue our operations at full capacity or at all and may experience system interruptions, reputational harm, delays in our solution development, lengthy interruptions in our services, breaches of data security, loss of key employees, and loss of critical data, all of which could have an adverse effect on our future operating results.”

Annual report 2026A · The company itself

“Harassment related to interaction between users on our services might lead to emotional distress, loss of trust in the platform and decreased user engagement Personal safety of consumers and/or end - users S4-1 – Policies related to consumers and end-users To manage our material impacts, risks and opportunities related to consumers and end-users, Schibsted Marketplaces has the following policies in place: Schibsted Marketplaces’ Security Policy, Privacy and Cookie Policy and Schibsted Marketplaces’ Code of Conduct.”

Annual report 2024A · The company itself

“We use cloud technologies and any failure by cloud or other technology service providers to adequately safeguard their systems and prevent cyber-attacks or data privacy incidents could disrupt our operations and result in misappropriation, corruption, or loss of confidential or proprietary information. The third parties upon which we rely face similar risks and when they experience a security breach of their systems, our security can be adversely affected.”

Annual report 2025A · The company itself

“Aktuella händelser i världen har lett till en ökning av antalet cyberattacker globalt, till exempel har flera attacker ägt rum mot andra företag på marknader där Viaplay Group är närvarande. Under 2024 har attackmetoderna delvis förändrats, men koncernen har hängt med i utvecklingen tack vare ytterligare investeringar i system och verktyg som förbättrar möjligheter att skydda tjänsten mot skadliga attacker och bedrägeriförsök.”

Annual report 2024A · The company itself

“In the normal course of our business, we have been the target of malicious cyber activity.”

Annual report 2025A · The company itself

“Our facilities and systems, as well as those of our suppliers, are vulnerable to natural disasters, adverse weather, climate change, technology issues and other unexpected events, any of which have resulted and could result in an interruption in our business and harm our operating results. Our retail stores, corporate offices, distribution and manufacturing facilities, customer care centers, infrastructure and e-commerce operations, as well as the operations of our suppliers from which we receive goods and services, are vulnerable to damage from earthquakes, tornadoes, hurricanes, fires, floods or other volatile weather, climate change, power losses, government-mandated shutdowns, telecommunications failures, hardware and software failures, computer hacking, cybersecurity breaches, computer viruses and similar events.”

Annual report 2026A · The company itself

“We are also vulnerable to certain additional risks and uncertainties associated with our e-commerce and mobile websites, apps and digital marketing efforts, including: changes in required technology interfaces; website downtime and other technical failures; internet connectivity issues; costs and technical issues as we upgrade our website software; computer viruses; cyberattacks; human error; supplier reliability; changes in applicable international, federal and state regulations, such as the European Union's General Data Protection Regulation (“GDPR”), the California Consumer Privacy Act (“CCPA”), the California Privacy Rights Act (“CPRA”) and other emerging or evolving privacy laws and related compliance costs; security breaches; and consumer privacy concerns.”

Annual report 2026A · The company itself

“In addition, the recent surge of AI technology, including generative AI used to deploy more sophisticated attacks, creates an additional level of security, privacy and legal risk.”

Annual report 2026A · The company itself

“We are also subject to risks associated with our reliance on third-party technology providers, including cloud-based and software-as-a-service providers, for access to our systems and the accuracy and security of the their functionality. System upgrades, migrations or integrations may increase our exposure to cybersecurity risks or service interruptions.”

Annual report 2026A · The company itself

“The illegal distribution and sale by third parties of counterfeit or illegally compounded versions of our products or of stolen, diverted or relabeled products could have a negative impact on our reputation and business. Third parties may illegally distribute and sell counterfeit or illegally compounded versions of our products that do not meet the exacting standards of our development, manufacturing and distribution processes. Counterfeit or illegally compounded medicines pose a significant risk to animal health and safety because of the conditions under which they are manufactured and the lack of regulation of their contents.”

Annual report 2025A · The company itself

“These events and factors include, but are not limited to, equipment failure, raw material shortages, natural disasters, adverse weather conditions, accidents, explosions, fires, environmental events, strikes or other labor or industrial disputes, war or acts of terrorism, cybersecurity attacks, or other unexpected outages.”

Annual report 2025A · The company itself

“Alle egne aktiviteter G1: Forebyggelse og opdagelse, herunder uddannelse Jeudan opererer i en branche, hvor korruption og bestikkelse kan forekomme, hvilket udgør en potentiel negativ påvirkning, især i forbindelse med indkøb af materialer og blandt medarbejdere i værdikæden.”

Annual report 2025A · The company itself

“The decrease in Operational risk RWA in 2025 is primarily due to lower execution-related losses, partially offset by an increase in litigation-related incidents.”

Annual report 2025A · The company itself

“Risk of loss or theft of assets, including inventory shrinkage, is inherent in the retail business. Loss may be caused by error or misconduct of Associates, customers, vendors or other third parties, including through organized retail crime and professional theft, and may be further impacted by macroeconomic factors, including the enforcement environment, as well as increased inventory levels in our stores.”

Annual report 2026A · The company itself