COSTCostco

Increased security threats and more sophisticated cyber misconduct pose a risk to our systems, networks, products and services. We rely upon IT systems and networks, some of which are managed by or belong to third parties, including suppliers, partners, vendors, and service providers. Additionally, we collect, store store, and process sensitive information relating to our business, members, employees, and other third parties. Operating these IT systems and networks and processing and maintaining this data in a secure manner, manner are critical to our business operations and strategy. Remote work has also expanded possible attack surfaces. Attempts to gain unauthorized access to systems, networks networks, and data, both ours and third parties with whom we work, are increasing in frequency and sophistication, and in some cases, these attempts are successful. Cybersecurity attacks may range from random attempts to coordinated and targeted attacks, including sophisticated computer crimes and advanced persistent threats. Phishing attacks have emerged as are particularly prominent, including as vectors for ransomware attacks, which have increased in breadth and frequency. While we train our employees as part of our security efforts, that training cannot be completely effective. The rapid evolution of AI has automated and accelerated the scale of cybersecurity threats, potentially reducing the time for us to detect and mitigate potential information security incidents. If our security infrastructure fails to keep pace with these evolving threats, it could lead to more frequent or sophisticated compromises of our systems, networks, or data, adversely affecting our operations and member confidence. These threats pose a risk to the security of our systems and networks and the confidentiality, integrity, and availability of our data. Our IT systems and networks, or those managed by third parties such as cloud providers or suppliers that otherwise host or have access to confidential information, periodically have vulnerabilities, which may go unnoticed for a period of time. Our logging capabilities, or the logging capabilities of third parties, are also not always complete or sufficiently detailed, affecting our ability to fully investigate and understand the scope of security events. While our cybersecurity and compliance efforts seek to mitigate such risks, there can be no guarantee that the actions and controls we and our third-party service providers have implemented and are implementing, will be sufficient to protect our systems, information or other property.

Gross margin percentage increased 20 decreased three basis points. Excluding the impact of gasoline price deflation inflation on net sales, gross margin percentage was 11.03%, 11.22%, an increase of 11 10 basis points. This increase was positively impacted by 19 basis points in our warehouse ancillary and other businesses, primarily gasoline and pharmacy, offset by an 11 basis point decrease in core merchandise categories, primarily due to fresh foods and our co-branded credit card program. Gross margin percentage was negatively impacted by seven basis points due to a LIFO charge in 2025 for higher merchandise costs and one basis point categories. The majority of the increase in warehouse ancillary and other businesses. Changes businesses and the decrease in foreign currencies relative core merchandise categories was due to the U.S. dollar change in sales mix as warehouse ancillary and other businesses sales grew at a faster rate than core merchandise categories. Core merchandise categories were also negatively impacted by our co-branded credit card program as a result of reward costs associated with higher gasoline sales. IEEPA tariff refunds, net of investment in price reductions for members, positively impacted gross margin by approximately $224, attributable to our Other International and Canadian operations. three basis points.

In November 2023, a former employee filed a class action against the Company alleging claims under California law for failure to pay minimum wage, failure to pay overtime, failure to provide meal and rest breaks, failure to provide accurate wage statements, failure to reimburse expenses, failure to pay wages when due, and failure to pay sick pay. Martin Reyes v. Costco Wholesale Corporation, Sacramento County Superior Court (No. 23cv011351), removed to federal court, No. 2:24-cv-00300 (E.D. Cal.). A second amended complaint was filed, which the Company has moved to dismiss. In January 2024, the same plaintiff filed a related Private Attorneys General Act (PAGA) representative action, seeking civil penalties and asserting the same alleged underlying Labor Code violations and an additional suitable seating claim. In May 2024, the plaintiff filed an amended PAGA complaint; the Company has denied the material allegations of the complaint and filed a motion to stay the action. The motion was granted on December 18, 2024.

The Company accounts for income taxes using the asset and liability method. Deferred tax assets and liabilities are recognized for the future tax consequences attributed to differences between the financial statement carrying amounts of existing assets and liabilities and their tax bases, credits and loss carry-forwards. Deferred tax assets and liabilities are measured using tax rates expected to apply to taxable income in the years in which those temporary differences and carry-forwards are expected to be recovered or settled. The effect on deferred tax assets and liabilities of a change in tax rates is recognized in income in the period that includes the enactment date. A valuation allowance is established when necessary to reduce deferred tax assets to amounts that are more likely than not expected to be realized.