CSXCSX Corporation

In 2024, 2025, the Company generated $267 $634 million less cash from operating activities compared to prior year, primarily driven by lower cash-generating net earnings, the previously-discussed payment of $429 million of previously postponed taxes with no postponements available in 2025, and a $96 million prepayment for locomotive maintenance services. These decreases were partially offset by the impact of bonus depreciation and other changes in working capital. In 2024, the payment of $387 million of federal and state tax payments previously-postponed taxes related to the 2023 tax year. The 2024 results also reflect lower cash-generating net earnings as well as non-cash impacts year was more than offset by postponement of $429 million of federal and state tax payments postponed to 2025, as previously discussed. Cash from operating activities in the prior year includes the payment of $238 million for retroactive wages and bonuses, and associated taxes, taxes related to finalized labor agreements. the 2024 tax year. CSX used $378 $246 million more cash for investing activities in 2024 2025 compared to 2023, 2024, primarily as a result of due to higher property additions consistent with planned capital expenditures as well as the beginning of expenditures, including approximately $470 million related to rebuilding the Blue Ridge subdivision rebuild resulting as a result of impacts from impacts of Hurricane Helene. The Company used $805 million less cash for $1.0 billion decrease in net spending on financing activities compared to the prior year primarily due to lower was driven by fewer share repurchases, partially offset by repurchases and higher net debt repayments. proceeds from the issuance of long-term debt.

Potentially responsible parties, including Pharmacia, are participating in an EPA-directed allocation and settlement process to assign responsibility related to the lower river and the entire Study Area, respectively. CSXT participated in the EPA-directed allocation and settlement process on behalf of Pharmacia. On March 2, 2022, EPA issued a Notice Letter to Pharmacia, Occidental and eight other parties alleging they are liable under Section 107(a) of CERCLA for releases or threatened releases of hazardous substances and requesting each party, individually or collectively, submit good faith offers to EPA in connection with the entire Study Area. CSXT, on behalf of Pharmacia, responded to the Notice Letter and submitted a good faith offer to EPA on June 27, 2022, following meetings with a mediator from EPA’s Conflict Prevention and Resolution Center. On November 21, 2023, EPA notified the United States District Court for the District of New Jersey ("Court") that it intended to move to enter a Consent Decree (“CD”) with a group of potentially responsible parties. On January 31, 2024, EPA filed a motion to enter a modified CD with 82 potentially responsible parties, requiring payment of $150 million to resolve their liability with respect to the entire Study Area. Pharmacia is not a participant in the CD settlement. On April 1, 2024, Occidental filed its opposition to EPA's motion to enter the CD. Several other non-settling parties, including Pharmacia, filed comments concerning (but not opposing) entry of the CD. On December 18, 2024, the Court entered and approved the CD, which is now under appeal. Negotiations with EPA and other parties to resolve Pharmacia's liability continue.

Strong performance and reliability of the Company's technology systems are critical to operating safely and effectively, and protecting personal and customer data is essential to maintaining stakeholder trust. The Company has implemented processes designed to assess, identify, and manage material cybersecurity risks, as described further below. CSX maintains a cybersecurity framework that is integrated across the organization through people, processes and technology to help protect the personal information of its customers, its contractors and its suppliers as well as protect the integrity of its own operations. Cybersecurity is also integrated into the Company’s Enterprise Risk Management (“ERM”) program. The Company equips CSX systems with various cybersecurity tools, conducts vulnerability scans and provides critical cybersecurity information to application users, as appropriate. The Company also takes proactive measures to advise CSX employees of how they can assist the Company in its cybersecurity practices. CSX informs employees on cybersecurity best practices, including how to identify cyber-related suspicious activity, how to report such activity and, as appropriate, proactive measures employees can take to safeguard company information and devices. The Company also provides cybersecurity awareness training to employees and conducts cybersecurity testing exercises to help maintain cybersecurity vigilance. With the assistance of third-party consultants, the Company conducts an annual cybersecurity exercise, which is often a "tabletop" scenario involving a cross-functional group responding to a hypothetical cybersecurity threat.

CSX’s principal operating subsidiary, CSX Transportation, Inc. (“CSXT”), provides an important link to the transportation supply chain through its approximately 20,000 route mile rail network and serves major population centers in 26 states east of the Mississippi River, the District of Columbia and the Canadian provinces of Ontario and Quebec. It has access to over 70 ocean, river and lake port terminals along the Atlantic and Gulf Coasts, the Mississippi River, the Great Lakes and the St. Lawrence Seaway. The Company’s intermodal business links customers to railroads via trucks and terminals. CSXT also serves thousands of production and distribution facilities through track connections to more than 240 approximately 250 short-line and regional railroads. On June 1, 2022, CSX completed its acquisition of Pan Am Systems, Inc. (“Pan Am”), which is the parent company of Pan Am Railways, Inc. This acquisition expands CSXT’s reach in the Northeastern United States. For further details, refer to Note 17, Business Combinations.