Compare companies, side by side

… These potentially impactful future events could include service disruptions, unauthorized access to our systems or equipment, viruses, ransomware, and/or the compromise, acquisition, or destruction of our data. We also could be impacted by cybersecurity events targeting third parties

Marked against last year's 10-K

A significant cybersecurity incident or other disruption to our technology infrastructure resulting from internal and external threats could disrupt our business operations. To conduct business, we extensively rely on information and operational technology systems. The threat landscape is vast, with potential attacks from cybercriminals, nation-states, state-sponsored actors and others including, but not limited to, service denials, unauthorized access, compromised equipment or rolling stock, extortion, or theft of data or money. As a result, our business continuity and disaster recovery plans and activities may not be sufficient for all eventualities, resulting in the potential for a data breach or significant service or operational disruption or failure involving one or more information or operational technology systems operated by us or under control of third parties, including computer hardware, software, cloud services and transportation and communications equipment. Such failures or disruptions can adversely impact our business by, among other things, preventing intercompany communications and disrupting operations that may result in direct or indirect monetary losses, damage to equipment or property, or loss of confidence in corporate competency. Any one or more of these events could have a material adverse effect on our results of operations, financial position, or operations. Although we maintain security programs designed to protect our information and operational technology systems, we are continually targeted by threat actors attempting to access our networks and we may be unable to detect or prevent a breach of our systems or equipment or disruption to our service in the future. In addition, while we have previously experienced technology outages and cybersecurity events that have impacted our systems and service, future events may result in more significant impacts to our operations, reputation or financial results. These potentially impactful future events could include service disruptions, unauthorized access to our systems, systems or equipment, viruses, ransomware, and/or the compromise, acquisition, or destruction of our data. We also could be impacted by cybersecurity events targeting third parties

Item 1A, Risk Factors, 10-K Feb 9, 2026open_in_new

cybersecurity. Additional or updated safety, security, or cybersecurity regulation by Congress, the DOT, or DHS could have a negative impact on our business and the efficiency, conduct, or complexity of our operations including (but not limited to) increased operating costs, capital expenditures, claims, and litigation.

Marked against last year's 10-K

Railroads are also subject to the enactment of laws by Congress and regulation by the DOT (including the FRA) and the DHS (including the TSA), which regulate many aspects of our operations related to safety, security, and cybersecurity. Additional or updated safety, security, or cybersecurity regulation by Congress, the DOT, or DHS could have a negative impact on our business and the efficiency, conduct, or complexity of our operations including (but not limited to) increased operating costs, capital expenditures, claims, and litigation.

Item 1A, Risk Factors, 10-K Feb 9, 2026open_in_new

Our business and financial performance may be adversely affected by cyber-attacks on information technology (IT) infrastructure and products, as well as changes in cybersecurity regulations. Our business may be impacted by disruptions to our own or third-party IT …

Marked against last year's 10-K

Our business and financial performance may be adversely affected by cyber-attacks on information technology (IT) infrastructure and products, as well as changes in cybersecurity regulations. Our business may be impacted by disruptions to our own or third-party IT infrastructure, and the products and services that we provide our customers are also at risk of being adversely affected by cyber-attacks. Like other companies, we regularly experience cyber-based attacks. Cybersecurity threats are continuously evolving and may have an impact on our customers, suppliers, subcontractors, and other third parties with whom we do business routinely, both on premises and in the cloud, attempting to gain unauthorized access to our confidential, proprietary, or otherwise protected information, classified information, or personal data or other information relating to our employees, customers, and other third parties, or to disrupt our systems or the systems of third parties. Cybersecurity threats also include attacks targeting the security, confidentiality, integrity, and/or availability of the hardware, software, and information installed, stored, or transmitted in our products, including after the purchase of those products and when they are incorporated into third-party products, facilities, or infrastructure. We are also exposed to the risk of insider threat attacks. Any such attacks could disrupt our systems or those of third parties (including mission and safety critical systems), impact business operations, result in unauthorized release of confidential, proprietary, or otherwise protected information, and corrupt our data or that of third parties. The threats we face are continuous and evolving, and vary in degree of severity and sophistication. These threats include advanced persistent threats from highly organized adversaries, including but not limited to cyber criminals, nation states, and so-called hacktivists, particularly those adverse to the security interests of the U.S. and its allies, which target us and other defense contractors. These types of threats are related to the geopolitical environment and have, therefore, grown in number due to recent geopolitical conflicts. In addition, as a result of the rapid pace of technological change, we and our customers, suppliers, subcontractors, and other third parties with whom we conduct business continue to rely on legacy systems and software, which can be more vulnerable to cyber threats and attacks. Moreover, we, like other companies, are seeing an unprecedented number of previously unknown vulnerabilities, for which there are no known mitigations, being revealed by new attacks. Further, the sophistication, availability, and use of artificial intelligence by threat actors present an increased level of risk. Due to the evolving threat landscape, we have experienced and expect to continue to experience more frequent and increasingly advanced cyber-attacks. In addition, changes in domestic and international cybersecurity-related laws and regulations have expanded cybersecurity-related compliance requirements, and cybersecurity regulatory enforcement activity has grown. We expect the regulatory environment to continue to evolve, and these regulatory changes could increase our operational and compliance expenditures and those of our suppliers, and lead to new or additional IT and product development expenses. We also face reputational, litigation, and financial risks in relation to potential required disclosures and increased risk of enforcement. We continue to make investments and adopt measures designed to enhance our protection, detection, response, and recovery capabilities, and to mitigate potential risks to our technology, products, services, and operations from potential cybersecurity threats, as well as to comply with evolving regulations. However, given the unpredictability, nature, and scope of cyber-attacks, it is possible that we are unable to defend against all cyber-attacks, that potential vulnerabilities could go undetected and persist in the environment for an extended period, or that we may otherwise be unable to mitigate customer losses and other potential consequences of these attacks. In addition, some products and services that we provide to customers, particularly those related to public security, may raise potential liabilities related to privacy and intellectual property. In some cases, we must rely on the safeguards put in place by our customers, suppliers, subcontractors, and other third parties to protect against and report cyber threats and attacks. We could potentially be subject to production downtimes, operational delays, other detrimental impacts on our operations, or ability to provide products and services to our customers, the compromise of confidential information, intellectual property or otherwise protected information, misappropriation, destruction, or corruption of data, security breaches, other manipulation or improper use of our or third-party systems, networks, or products, financial losses from remedial actions, loss of business, or potential liability, penalties, fines, and/or damage to our reputation. Any of these could have a material adverse effect on our competitive position, results of operations, financial condition, or liquidity. Due to the evolving nature of such risks, the impact of any potential incident cannot be predicted. Further, our insurance coverage, which may exclude losses from war or cyber operations, may not be adequate to cover all related costs and we may not otherwise be fully indemnified for them.

Item 1A, Risk Factors, 10-K Feb 6, 2026open_in_new

Cybersecurity, artificial intelligence, and data security and protection laws and regulations are evolving and present increasing compliance challenges, which may increase our costs, affect our competitiveness, cause reputational harm, and expose us to substantial fines or other penalties.

Marked against last year's 10-K

Cybersecurity Cybersecurity, artificial intelligence, and data security and protection laws and regulations are evolving and present increasing compliance challenges, which may increase our costs, affect our competitiveness, cause reputational harm, and expose us to substantial fines or other penalties.

Item 1A, Risk Factors, 10-K Feb 6, 2026open_in_new

As an aerospace and defense company, we face a multitude of security threats, including cybersecurity threats ranging from attacks common to most industries, such as ransomware and denial-of-service, to attacks from more advanced and persistent, highly organized adversaries …

Marked against last year's 10-K

As an aerospace and defense company, we face a multitude of security threats, including cybersecurity threats ranging from attacks common to most industries, such as ransomware and denial-of-service, to attacks from more advanced and persistent, highly organized adversaries, including nation state actors, some of which target the U.S. defense industrial base and other critical infrastructure sectors. The sophistication of the threats continues to evolve and grow, including the risk associated with the use of emerging technologies, such as artificial intelligence and quantum computing, for nefarious purposes. In addition to cybersecurity threats, we face threats to the security of our facilities and employees from terrorist acts, sabotage and other disruptions, any of which could adversely affect our business. The improper conduct of our employees or others working on our behalf who have access to export controlled, classified or other sensitive information could also adversely affect our business and reputation.

Item 1A, Risk Factors, 10-K Jan 29, 2026open_in_new

Given the persistence, sophistication, volume and novelty of threats we face, we may not be successful in preventing or mitigating an attack that could have a material adverse effect on us and the costs related to cyber or other security …

Marked against last year's 10-K

Given the persistence, sophistication, volume and novelty of threats we face, we may not be successful in preventing or mitigating an attack that could have a material adverse effect on us and the costs related to cyber or other security threats or disruptions may not be fully insured or indemnified by other means. The national security aspects of our business and much of the data we protect increase and create different risks relative to other industries. National security considerations may also preclude us from from, or cause us to delay, publicly disclosing a cybersecurity incident.

Item 1A, Risk Factors, 10-K Jan 29, 2026open_in_new

… time, including through acquisitions, have, and will continue to experience threats and cyber-attacks, including unauthorized access, state-sponsored cyber attacks, computer hackers, computer viruses, malicious code, ransomware, phishing and other security breaches, problems and system disruptions, including unauthorized access …

Marked against last year's 10-K

As a provider of information technology services operating in multiple regulated industries and geographies and a government contractor, we and our service providers, suppliers and subcontractors collect, store, transmit and otherwise process personal, confidential, proprietary and sensitive information, including classified information. As a result, our information technology systems, including those provided by third-party cloud providers or other infrastructure-as-a-service providers,, providers, which have grown over time, including through acquisitions, have, and will continue to experience threats and cyber-attacks, including unauthorized access, state-sponsored cyber attacks, computer hackers, computer viruses, malicious code, ransomware, phishing and other security breaches, problems and system disruptions, including unauthorized access to and disclosure of our and our clients’ proprietary, classified or other protected information. We are also subject to social engineering attacks which have caused, and may also seek to cause in the future, payments due to or from us to be misdirected to fraudulent accounts, which may not be recoverable by us.

Item 1A, Risk Factors, 10-K Nov 20, 2025open_in_new

… artificial intelligence technologies may intensify our cybersecurity risks (e.g., AI used to develop malicious code and sophisticated phishing attempts). Because the techniques used to obtain unauthorized access or sabotage systems change frequently, cyber-attacks continue to become more sophisticated …

Marked against last year's 10-K

While we have security measures and technology in place designed to protect our and our clients’ proprietary, classified and other protected information, there can be no assurance that our efforts will prevent all threats to our computer systems. The U.S. federal government has continued to raise concerns about the potential for cyber-attacks generally as a result of heightened geopolitical tension and conflicts, including the Russia-Ukraine and Israel-Hamas conflicts and the escalating tensions in the Middle East, among others. In addition, the rapid evolution and increased adoption of artificial intelligence technologies may intensify our cybersecurity risks (e.g., AI used to develop malicious code and sophisticated phishing attempts). Because the techniques used to obtain unauthorized access or sabotage systems change frequently, cyber attacks cyber-attacks continue to become more sophisticated and generally are not identified until they are launched against a target. As such, we may be unable to anticipate these techniques or to implement adequate preventative measures. As a result, we may be required to expend significant resources to protect against the threat of system disruptions and security breaches or to alleviate problems caused by these disruptions and breaches. Any of these events could damage our reputation, result in significant business interruption, cause us to incur significant liability and have a material adverse effect on our business, financial condition and results of operations.

Item 1A, Risk Factors, 10-K Nov 20, 2025open_in_new

… vendors, subcontractors or other third parties to minimize the impact of cyber threats, other security threats or business disruptions. These third parties may have varying levels of cybersecurity expertise and safeguards. Our commercial arrangements with these third parties include processes …

New this year Item 1A, Risk Factors, 10-K Feb 12, 2026open_in_new

… The risk of a security breach or disruption, particularly through cyber-attack or cyber intrusion, including by computer hackers, foreign governments and cyber terrorists, is persistent. The volume, intensity and sophistication of threats from around the world remains elevated. These …

New this year Item 1A, Risk Factors, 10-K Feb 12, 2026open_in_new

… equipment, system or application failure, including as a result of maintenance, obsolescence, unsupportability or age; application upgrades or implementations; human error or malfeasance; vandalism; natural disasters; fire; utility outages; and cybersecurity incidents, including ransomware, denial-of-service, e-mail compromises …

Marked against last year's 10-K

We rely on information technology, technology (“IT”), including operational technology, technology and communications networks communication networks, to run operate our manufacturing processes and equipment, to enable business processes and processes, support employee productivity, interface with customers and to process, transmit, store channel partners, and manage our electronic information, including confidential business information and data relating to employees, customers or other business customers, and partners. We also rely on key third parties, such as direct and indirect suppliers, contract manufacturers, cloud-based service providers, and outsourced business process providers, including in the areas of our businesses and functions, such as Information Technology, Finance, Human Resources, Commercial Services, Procurement and Travel. Together, we depend on information technology infrastructure and communication networks for access to reliable and secure networks in order to run our and their businesses. Regardless of the protection measures we, or the third parties we rely on, have implemented, information technology IT and communications communication networks may be susceptible to damage or disruption due to causes causes, such as: equipment, system or application failure, including as a result of maintenance, obsolescence, unsupportability or age; application upgrades or implementations; human error or malfeasance; vandalism; natural disaster; disasters; fire; power, communication or other utility outage or failure; outages; and cybersecurity incidents, including ransomware, denial-of-service, vendor e-mail compromise, compromises, deepfake attacks, malware, phishing, and computer viruses resulting from a wide ranging threat landscape, including attacks by nation states and others. In addition to damage or disruption, these cybersecurity incidents may lead to also result in security and data breaches. Cybersecurity and other IT disruption risks may increase during integration or separation of businesses or during the provision of transition services.

Item 1A, Risk Factors, 10-K Feb 25, 2026open_in_new

• theft, compromise, misappropriation or challenges in protecting our technology, intellectual property or data, including from cybersecurity and AI threats.

Marked against last year's 10-K

• theft, compromise, misappropriation or challenges in protecting our technology, intellectual property or data; data, including from cybersecurity and AI threats.

Item 1A, Risk Factors, 10-K Feb 25, 2026open_in_new

• Our internal computer systems, and those of our third-party providers, may fail or suffer from events beyond our control, including from cybersecurity events, which could reduce revenue and earnings, increase expenses and expose us to legal and regulatory claims.

New this year Item 1A, Risk Factors, 10-K Feb 9, 2026open_in_new

In addition, cyber-attacks could extract Confidential Information and such attacks could also include the deployment of harmful malware, ransomware, digital extortion, business email compromises and denial-of-service attacks, social engineering (including phishing attacks) and other means to affect …

New this year 10-K, 10-K Feb 9, 2026open_in_new

Manufacturing or design defects impacting safety, cybersecurity, or quality issues (or the perception of such issues) for our products and services can lead to personal injury, death, property damage, data loss, or other damages. These events could lead to recalls …

Word for word as last year Item 1A, Risk Factors, 10-K Feb 25, 2026open_in_new

… These systems can be, and in the past have been, damaged, disrupted, accessed, or shut down due to attacks by computer hackers, nation states, cyber-criminals, computer viruses, error or malfeasance by employee or former employees, power outages, hardware failures …

Marked against last year's 10-K

We collect, store, have access to and otherwise process certain confidential or sensitive data, including proprietary business information, customer data, personal data, and other information that is subject to privacy and security laws, regulations and/or customer-imposed controls. We rely on information technology systems, some of which are managed by third parties and some of which are managed on a decentralized, independent basis by our operating companies, to process, transmit, and store electronic information (including sensitive data such as confidential business information and personally identifiable data relating to employees, customers, and other business partners), and to manage or support a variety of critical business processes and activities. These systems may be can be, and in the past have been, damaged, disrupted, accessed, or shut down due to attacks by computer hackers, nation states, cyber-criminals, computer viruses, error or malfeasance by employee or former employees, power outages, hardware failures, telecommunication or utility failures, catastrophes, or other similar events, and in any such circumstances our system redundancy and other disaster recovery planning may be ineffective or inadequate. In addition, security breaches of our systems or lack of sufficient control in our systems (or the systems of our customers, suppliers or other business partners) could result result, and have resulted, in the misappropriation, change, destruction, exfiltration or unauthorized disclosure of confidential information or personal data belonging to us or to our employees, partners, customers, or suppliers. Like many multinational corporations, our information technology systems have been subject to computer viruses, malicious codes, and other cyber-attacks that have resulted in disruption of our operations, unauthorized access to confidential information and increased the cost of operations through containment, investigation and remediation efforts, including cybersecurity incidents in the fourth quarter of 2023. efforts. Furthermore, we expect to be subject to similar incidents in the future as such attacks become more sophisticated and frequent, any of which may have a material adverse impact on our business continuity, operations or financial results. Increasing use of artificial intelligence may increase these risks. Any of the attacks, breaches, or other disruptions or damage described above, as well as corresponding investigation, containment, and remediation efforts, can disrupt our operations, delay production and shipments, result in theft of our and our customers’ intellectual property and trade secrets, disclosure of personal data, damage customer and business partner relationships and our reputation, or result in defective products or services, legal claims and proceedings, liability and penalties under privacy laws, and increased costs for security and remediation, each of which could adversely affect our business and financial results.

Item 1A, Risk Factors, 10-K Feb 25, 2026open_in_new

… Further, we cannot ensure the cybersecurity measures they take will be sufficient to protect any information we share with them or prevent any disruption arising from a technology failure, cyber-attack, or other information or security breach. We depend on …

Word for word as last year Item 1A, Risk Factors, 10-K Feb 17, 2026open_in_new

Emerging cybersecurity regulations (including the EU Cyber Resilience Act) increasingly mandate rigorous cybersecurity standards for our products and services. These mandates may increase our operational costs by requiring additional investment in secure product development, vulnerability management, and product lifecycle management …

New this year Item 1A, Risk Factors, 10-K Feb 17, 2026open_in_new

Disruptions to the various information technology and information security systems upon which our operations and our products and our services rely, especially cyber-security incidents, including data security breaches, ransomware or computer viruses, could harm our business, reduce our revenue, increase our expenses, damage our reputation and adversely impact our performance.

Marked against last year's 10-K

Disruptions to the various information technology and information security systems upon which our operations and our products and our services rely, especially cyber-security incidents, including data security breaches, ransomware or computer viruses, could harm our business, reduce our revenue, increase our expenses, damage our reputation and adversely impact our performance.

Item 1A, Risk Factors, 10-K Feb 13, 2026open_in_new

The manner in which a customer implements or operates the products and services they purchase from us may be contrary to information security or cybersecurity industry best practices or manuals regarding use. Such implementation or improper use may lead to a cybersecurity breach and, regardless of whether the breach is attributable to our products or services, the market perception of the effectiveness of our products or services could be harmed.

Marked against last year's 10-K

The manner in which a customer implements or operates the products and services they purchase from us may be contrary to information security or cybersecurity industry best practices or manuals regarding use. Such implementation or improper use may lead to a cybersecurity breach and, regardless of whether the breach is attributable to our products or services, the market perception of the effectiveness of our products or services could be harmed.

Item 1A, Risk Factors, 10-K Feb 13, 2026open_in_new

Despite our implementation of cybersecurity measures, which have focused on prevention, mitigation, resilience and recovery, our network and products, including access solutions, may be vulnerable to cybersecurity attacks, computer viruses, malicious codes, malware, ransomware, phishing, social engineering, denial of service …

Marked against last year's 10-K

Despite our implementation of cybersecurity measures, which have focused on prevention, mitigation, resilience and recovery, our network and products, including access solutions, may be vulnerable to cybersecurity attacks, computer viruses, malicious codes, malware, ransomware, phishing, social engineering, denial of service, hacking, break-ins and similar disruptions. Cybersecurity attacks and intrusion efforts are continuous and evolving, and in certain cases they have been successful at the most robust institutions. The scope and severity of risks that cyber threats present have increased dramatically and include, but are not limited to, malicious software, ransomware attacks, attempts to gain unauthorized access to data or premises, exploiting weaknesses related to vendors or other third parties that could be exploited to attack our systems, denials of service and other electronic security breaches that could lead to disruptions in systems, unauthorized release of confidential or otherwise protected information and corruption of data. Any such event could have a material adverse effect on our business, financial condition, results of operations and cash flows as we face regulatory, reputational and litigation risks resulting from potential cyber incidents, as well as the potential of incurring significant remediation costs. Further, while we maintain insurance coverage that may, subject to policy terms and exclusions, cover certain aspects of our cyber risks, such insurance coverage may be insufficient to cover our losses or all types of claims that may arise in the continually evolving area of cyber risk.

Item 1A, Risk Factors, 10-K Feb 17, 2026open_in_new

Finally, the regulatory environment around cybersecurity is increasingly challenging, with additional reporting requirements around cybersecurity, risk management, strategy and governance, as well as increased disclosure obligations around the occurrence of material cybersecurity incidents. These requirements may present material obligations and …

Word for word as last year Item 1A, Risk Factors, 10-K Feb 17, 2026open_in_new

We are subject to risks imposed by data breaches and operational disruptions, both random and targeted, including through cyberattack or cyber-intrusion, ransomware attack, malware attack, or denial-of-service attack by computer hackers, foreign governments and state-sponsored actors …

Marked against last year's 10-K

A significant data breach or other disruption to our technology infrastructure could disrupt our operations and result in the loss of critical sensitive or confidential information, adversely affecting our reputation, business, or results of operations. Our ability to attract and retain customers, efficiently operate our businesses, execute our DRIVE transformation, and compete effectively increasingly depend in part upon the sophistication, security, and reliability of our technology network, including our ability to provide features of service that are important to our customers, to protect our confidential business information and the information provided by our customers (including personal information), and to maintain customer confidence in our ability to protect our systems and to provide services consistent with their expectations. For example, we rely on information technology to receive shipment information in advance of physical receipt of packages, to track items that move through our delivery systems, to efficiently plan deliveries, to clear shipments through customs, to execute billing processes, and to track and report financial and operational data. We are subject to risks imposed by data breaches and operational disruptions, both random and targeted, including through cyberattack or cyber-intrusion, ransomware attack, malware attack, or denial-of-service attack by computer hackers, foreign governments and state-sponsored actors, cyber terrorists and hacktivists, cyber criminals, malicious employees or other insiders of FedEx Federal Express or third-party service providers, and other groups and individuals. Data breaches and other technology technological disruptions of companies and governments continue to increase as the number, intensity, and sophistication of attempted attacks and intrusions from around the world have increased and we, our customers, and third parties increasingly store and transmit data by means of connected information technology systems. Additionally, risks such as code anomalies, “Acts of God,” transitional challenges in migrating operating company functionality to our FedEx enterprise automation platforms, data leakage, cyber-fraud, and human error pose a direct threat to our products, services, systems, and data and could result in unauthorized intrusion or block legitimate access to sensitive or confidential data regarding our operations, customers, employees, and suppliers, including personal information. The rapid evolution and increased sophistication, availability, and use of emerging technologies such as AI technologies and machine learning by us, our customers, suppliers, business partners, third-party providers, and bad actors may increase the likelihood of the occurrence of data breaches and operational disruptions.

Item 1A, Risk Factors, 10-K Jul 20, 2026open_in_new

Although we do not believe the cyber incidents and other systems disruptions that we and our third-party service providers have experienced to date have had a material effect on our business, there is no guarantee that a future cybersecurity …

New this year Item 1A, Risk Factors, 10-K Jul 20, 2026open_in_new

Our business is subject to complex data privacy, data security, cybersecurity, and AI laws and regulations that may significantly increase our costs and adversely affect our business.

Item 1A, Risk Factors, 10-K Aug 5, 2026open_in_new

Laws and regulations regarding data privacy, data security, cybersecurity, and AI in North America continue to be updated and expanded. Enforcement actions relating to these areas continue to increase and be an area of focus. The failure to comply with …

Item 1A, Risk Factors, 10-K Aug 5, 2026open_in_new

… vulnerabilities (including those of third-party software or systems), computer viruses, ransomware, denial of service (“DoS”) and other electronic security breaches. Cyber-attacks from computer hackers and cyber criminals and other malicious internet-based activity continue to increase, and our …

Marked against last year's 10-K

We may face global cybersecurity threats, which may range from uncoordinated individual attempts to sophisticated and targeted measures, known as advanced persistent threats, directed at us and our customers, suppliers, and service providers. Cybersecurity incidents and network security breaches have included in the past, and may in the future include, but are not limited to, attempts to access or unauthorized access of information, exploitation of vulnerabilities (including those of third-party software or systems), computer viruses, ransomware, denial of service (“DoS”) and other electronic security breaches. Cyber-attacks from computer hackers and cyber criminals and other malicious internet-based activity continue to increase generally, increase, and our services and systems, including the systems of our outsourced service providers, have been and may in the future continue to be the target of various forms of cybersecurity incidents such as Domain Name System attacks, wireless network attacks, viruses and worms, malicious software, ransomware, application centric attacks, peer-to-peer attacks, business email compromises and phishing attempts, backdoor trojans and distributed DoS attacks. Furthermore, given that new technologies continue to emerge, the methods used by computer hackers and cyber criminals to obtain unauthorized access to data or to sabotage computer systems change frequently and continue to grow in sophistication. Accordingly, we may be unable to anticipate or detect such attacks or promptly and effectively respond to them. For example, the rapid evolution of AI and machine learning technologies and the implementation of pilot programs integrating generative AI into both our internal and external-facing systems may intensify our cybersecurity risks.

Item 1A, Risk Factors, 10-K Sep 26, 2025open_in_new

For example, the rapid evolution of AI and machine learning technologies and the implementation of pilot programs integrating generative AI into both our internal and external-facing systems may intensify our cybersecurity, privacy and data security risks, such as the …

New this year Item 1A, Risk Factors, 10-K Sep 26, 2025open_in_new

We have been, and expect we will continue to be, the subject of cybersecurity attacks, including unauthorized intrusion, malicious software infiltration, network disruption, denial of service, corruption of data, ransomware attack, insider threats, and theft of sensitive information (including our …

Marked against last year's 10-K

We have been, and expect we will continue to be, the subject of cybersecurity attacks, including unauthorized intrusion, malicious software infiltration, network disruption, denial of service, corruption of data, ransomware attack, insider threats, and theft of sensitive information (including our intellectual property). Although none of the cybersecurity incidents that we have identified to date have materially affected us, including our business strategy, operations, results of operations, or financial condition, we continue to face significant known and unknown cybersecurity threats. In the future, a cybersecurity attack, unauthorized intrusion, malicious software infiltration, network disruption, denial of service, corruption of data, ransomware attack, theft of non-public or other sensitive information, exploitation of previously unknown "zero-day" vulnerabilities, or similar act by an unauthorized party (which could include our personnel) with respect to our businesses or our authorized third parties’ businesses, or inadvertent acts or inactions by our authorized third parties or personnel, could result in the loss, disclosure or misuse of confidential personal or business information or our intellectual property or the theft of client or ADP funds, which could have a materially adverse effect on our business or results of operations or that of our clients, result in liability, litigation, regulatory investigations and sanctions or a loss of confidence in our ability to serve clients, or cause current or potential clients to choose another service provider. As the global environment continues to grow increasingly hostile, the security of our operating environment is ever more important to our clients and potential clients. As a result, the breach or perceived breach of our security systems or the security systems of our authorized third parties could result in a loss of confidence by our clients or potential clients and cause them to choose another service provider, which could have a materially adverse effect on our business, financial condition or results of operations.

Item 1A, Risk Factors, 10-K Aug 5, 2026open_in_new

While ADP maintains insurance coverage that, subject to policy terms and conditions and a significant self-insured retention, is designed to address losses or claims that may arise in connection with certain aspects of data and cyber risks, such insurance coverage may be insufficient to cover all losses or all types of claims that may arise in the continually evolving area of data and cyber risk.

Word for word as last year Item 1A, Risk Factors, 10-K Aug 5, 2026open_in_new

… the availability of commodities, supply chain disruption and decreased business spending; cyber-incidents; disruptions to our or our business partners’ global technology infrastructure, including through cyberattack or cyber-intrusion; adverse changes in international trade policies and relations; claims, litigation and …

Word for word as last year Item 7, MD&A, 10-K Feb 5, 2026open_in_new

The ongoing conflict between Russia and Ukraine has resulted in worldwide geopolitical and macroeconomic uncertainty, including volatile commodity markets, foreign exchange fluctuations, supply chain disruptions, increased risk of cybersecurity incidents, reputational risk, increased operating costs (including fuel and other input …

Marked against last year's 10-K

The ongoing conflict between Russia and Ukraine has resulted in worldwide geopolitical and macroeconomic uncertainty, including volatile commodity markets, foreign exchange fluctuations, supply chain disruptions, increased risk of cybersecurity incidents, reputational risk, increased operating costs (including fuel and other input costs), environmental, health and safety risks related to securing and maintaining facilities, additional sanctions and other regulations (including restrictions on the transfer of funds to and from Russia). As discussed below, we We do not have operations in Russia.

Item 7, MD&A, 10-K Feb 5, 2026open_in_new

… Recent developments in the threat landscape include the use of AI and machine learning by attackers to automate, enhance, and evade detection during cyber attacks, along with an increased number of cyber extortion and ransomware incidents. These attacks may involve …

Marked against last year's 10-K

We devote significant resources to engineer secure products and ensure security vulnerabilities are mitigated, and we require our third-party third party service providers to do so as well. Remote-work arrangements may increase our exposure to cyberattacks cyber attacks due to vulnerabilities in unsecured devices, networks, and employee environments. Breaches could occur during transfer of data-to-data centers or at any time, and result in unauthorized physical or electronic access to our or our customers’ data. Third parties may attempt to fraudulently induce employees or customers into disclosing sensitive information such as usernames, passwords or other information to gain access to our data or our customers’ data. Additionally, hackers may develop and deploy viruses, worms and other malicious software programs that attack or gain access to our networks and data centers. Recent developments in the threat landscape include the use of AI and machine learning by attackers to automate, enhance, and evade detection during cyberattacks, cyber attacks, along with an increased number of cyber extortion and ransomware incidents. These attacks can feature may involve higher financial ransom demands and demonstrate increasing sophistication, including novel ransomware techniques, diverse methodologies, and advance capabilities such as adaptive malware and deepfake-enabled phishing schemes. Increasing socioeconomic and political instability in some countries has heightened these risks. In addition, retaliatory acts by foreign governments in response to Western sanctions could include cyber attacks that could directly or indirectly impact our operations.

Item 1A, Risk Factors, 10-K Feb 25, 2026open_in_new

We also face increasing and evolving disclosure obligations related to cyber and other security events. Despite rigorous processes, we risk failing to meet existing or future disclosure obligations or having our disclosures misinterpreted. National security or public safety considerations may also affect, or in limited instances prevent, public disclosure of a cybersecurity incident.

Marked against last year's 10-K

We also face increasing and evolving disclosure obligations related to cyber and other security events. Despite rigorous processes, we risk failing to meet all our existing or future disclosure obligations or having our disclosures misinterpreted. National security or public safety considerations may also affect, or in limited instances prevent, our public disclosure of a cybersecurity incident in certain circumstances. incident.

Item 1A, Risk Factors, 10-K Feb 25, 2026open_in_new

We face various cybersecurity threats, including attempts to gain unauthorized access to our systems and networks, denial-of-service attacks, threats to our information technology infrastructure, ransomware and phishing attacks, and attempts to gain unauthorized access to our company-, customer …

Marked against last year's 10-K

We face various cybersecurity threats, including attempts to gain unauthorized access to our systems and networks, denial-of-service attacks, threats to our information technology infrastructure, ransomware and phishing attacks, and attempts to gain unauthorized access to our company-, customer- and employee-sensitive information. These threats come from a variety of actors actors, some of which are highly organized and sophisticated sophisticated, such as nation-state actors and criminal enterprises. In addition, the techniques used in cyberattacks evolve rapidly, including from emerging technologies, such as advanced forms of automation and artificial intelligence. As cyber threats increase in volume and sophistication, the risk to the security of these systems and networks - and to the confidentiality, integrity, and availability of the data they house - continues to evolve, requiring constant vigilance and concerted, company-wide risk management efforts.

Item 1A, Risk Factors, 10-K Jan 30, 2026open_in_new

We have experienced, and may in the future experience, whether directly or through our subsidiaries or our supply chain, third-party service providers or other channels, cyber-related incidents. There is no guarantee that a future cyber-related attack or incident would not result in significant operational, regulatory, or financial impacts that could materially affect our business strategy, results of operations or financial condition.

Marked against last year's 10-K

We have experienced, and may in the future experience, whether directly or through our subsidiaries or our supply chain, third-party service providers or other channels, cyber-related incidents. While prior cyber-related attacks and incidents (including those at our wholly-owned subsidiaries Boeing Distribution, Inc. in 2023 and Jeppesen, Inc. in 2022) have not materially affected our business strategy, results of operations or financial condition, there There is no guarantee that a future cyber-related attack or incident would not result in significant operational, regulatory, or financial impacts that could materially affect our business strategy, results of operations or financial condition.

Item 1A, Risk Factors, 10-K Jan 30, 2026open_in_new

We face ongoing cybersecurity threats to our information technology infrastructure including data loss, data exfiltration, denial of service, and ransomware, among others. We have experienced non-material cybersecurity incidents, attempts to breach our systems and other similar attacks, including incidents …

Word for word as last year Item 1A, Risk Factors, 10-K Aug 4, 2026open_in_new

Security breaches or cybersecurity incidents could adversely affect our financial results and ability to operate, could result in personal, confidential or proprietary information being misappropriated, and may cause us to be held liable or suffer harm to our reputation.

Word for word as last year Item 1A, Risk Factors, 10-K Aug 4, 2026open_in_new

… Increased global cybersecurity requirements, vulnerabilities, threats, computer viruses and more sophisticated and targeted cyber-related attacks such as ransomware, as well as cybersecurity failures resulting from human or technological errors, pose risk to the security of our and our customers …

Marked against last year's 10-K

Cybersecurity - Increased cybersecurity requirements, vulnerabilities, threats and more sophisticated and targeted attacks, as well as failures, pose risk to our and many critical third parties' systems, networks, products, solutions, services and data. Increased global cybersecurity requirements, vulnerabilities, threats, computer viruses and more sophisticated and targeted cyber-related attacks such as ransomware, as well as cybersecurity failures resulting from human or technological errors, pose risk to the security of our and our customers', partners', suppliers' and third-party service providers' infrastructure, products, systems and networks and the confidentiality, availability and integrity of GE Aerospace and customers' data, as well as associated financial and reputational risks. The perpetrators of such attacks include sophisticated malicious actors, including states and state-affiliated actors targeting critical infrastructure. The risks in this area continue to grow, and we expect cyberattacks will continue to accelerate on a global basis in frequency and impact as threat actors increasingly use artificial intelligence and other techniques to circumvent security controls, evade detection and remove forensic evidence. As a result, there can be no assurance that our cybersecurity risk management processes, including our policies and controls, will be effective in promptly or effectively detecting, containing or remediating cybersecurity attacks, which may result in material harm to our systems, information or business.

Item 1A, Risk Factors, 10-K Jan 29, 2026open_in_new

… The cybersecurity leadership team meets with senior management to review and discuss GE Aerospace’s cybersecurity program, including emerging cyber risks, threats and industry trends. The cybersecurity leadership team also assists management in supervising efforts to prevent, detect, mitigate, and …

Marked against last year's 10-K

GE Aerospace’s management team is ultimately responsible for assessing and managing risks from cybersecurity threats, and in this regard, the CIO and CISO lead leads the Company’s overall cybersecurity function and cybersecurity leadership team. The CIO has over 25 years of extensive experience in the information technology (IT) field and leads the IT strategy and services supporting the Company’s global operation. The CISO has over 25 substantial IT experience in the aerospace industry with many years of experience focused on global information assurance data protection and cyber security programs. The cybersecurity leadership team meets with senior management to review and discuss GE Aerospace’s cybersecurity program, including emerging cyber risks, threats and industry trends. The cybersecurity leadership team also assists management in supervising efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including by collaborating with internal security personnel and business stakeholders, and incorporating threat intelligence and other information obtained from governmental, public or private sources to inform our cybersecurity technologies and processes.

Item 7, MD&A, 10-K Jan 29, 2026open_in_new

… cybersecurity threats and incidents which could include unauthorized access to information systems, business email compromise, misconfiguration of assets, exploitation of vulnerabilities, malware (including viruses and other malicious code), ransomware, denial-of-service attacks and other targeted or organized cyber-attacks …

Marked against last year's 10-K

Moreover, Grainger, and or its third-party business partners, may face cybersecurity threats and cybersecurity incidents which can could include unauthorized access to information systems, business email compromise, viruses, misconfiguration of assets, exploitation of vulnerabilities, malware (including viruses and other malicious code, code), ransomware, denial-of-service attacks, attacks and other targeted or organized cyber-attacks. Cybersecurity incidents can may also include team member failures, fraud, phishing or other social engineering attempts or other methods to cause confidential information, payments, account access or access credentials, or other data to be transmitted to an unintended recipient. Cybersecurity threat Threat actors also may attempt to exploit vulnerabilities in software that is commonly used by companies in cloud-based services and bundled software. If successful, those attempting to penetrate Grainger’s or its third-party business partners’ information systems may misappropriate intellectual property or personally identifiable, credit card, confidential, proprietary or other sensitive customer, supplier, team member or business information, or cause systems disruption. Further, cybersecurity Cybersecurity threats or cybersecurity incidents that impact Grainger’s systems, or those of its third-party business partners, could have a material adverse effect on Grainger, including its business strategy, financial condition and results of operations, including operations. Such incidents could result in major disruptions to business operations, alteration or corruption of data or systems, costs related to remediation or the payment of ransom, and litigation including individual claims or consumer class actions, commercial litigation, administrative, and civil or criminal investigations or actions, regulatory intervention and sanctions or fines, investigation and remediation costs and possible prolonged negative publicity. While many of Grainger's agreements with these third parties include indemnification provisions, Grainger may not be able to recover sufficiently, or at all, under such provisions to adequately offset any losses it may incur.

Item 1A, Risk Factors, 10-K Feb 19, 2026open_in_new

For further information regarding Grainger's cybersecurity risk management strategy and the Board's oversight role, see Part I, Item 1C: Cybersecurity of this Form 10-K.

Word for word as last year Item 1A, Risk Factors, 10-K Feb 19, 2026open_in_new

In addition, cybersecurity laws and regulations continue to evolve, and are increasingly demanding, both in the U.S. and globally, which adds compliance complexity and may increase costs of compliance and expose the Company to reputational damage or litigation, monetary …

Word for word as last year Item 1A, Risk Factors, 10-K Feb 24, 2026open_in_new

Despite these efforts, cybersecurity incidents (against the Company or parties with whom the Company contracts), depending on their nature and scope, could potentially result in the misappropriation, disclosure, destruction, corruption or unavailability of critical data and confidential or proprietary information …

Marked against last year's 10-K

Despite these efforts, cybersecurity incidents (against the Company or parties with whom the Company contracts), depending on their nature and scope, could potentially result in the misappropriation, disclosure, destruction, corruption or unavailability of critical data and confidential or proprietary information (the Company's or that of third parties) and the disruption of business operations. Additionally, it is possible for security vulnerabilities or a cybersecurity threat to remain undetected for an extended time period, and the prioritization of decisions with respect to security measures and remediation of known vulnerabilities undertaken by the Company, and the vendors and other third parties upon which it relies, may be inadequate to protect against or fully mitigate cybersecurity threats. The potential consequences of a material cybersecurity incident and its effects include financial loss, reputational damage, litigation with third parties, theft of intellectual property, disclosure of confidential or personal customer, supplier and employee information, fines levied by both U.S. and international government agencies, diminution in the value of the Company's investment in research, development and engineering, and increased cybersecurity protection and remediation costs due to the increasing sophistication and proliferation of threats, which in turn could adversely affect the Company's competitiveness and results of operations. Any of the foregoing can be exacerbated by a delay or failure to detect a cybersecurity incident or the full extent of such incident.

Item 1A, Risk Factors, 10-K Feb 24, 2026open_in_new

• Our business and financial performance depend on continued and substantial investments in our information and operational technology infrastructure, which may not yield anticipated benefits and which may be vulnerable to cyber-attacks.

Word for word as last year Item 1A, Risk Factors, 10-K Feb 5, 2026open_in_new

Our business and financial performance depend on continued and substantial investments in our information and operational technology infrastructure, which may not yield anticipated benefits and which may be vulnerable to cyber-attacks.

Word for word as last year Item 1A, Risk Factors, 10-K Feb 5, 2026open_in_new

… However, our information technology systems and data, and that of our customers and third-party providers, are subject to cybersecurity incidents, such as hacking, computer viruses or other malicious or destructive software, ransomware, denial of service attacks, malicious social engineering …

Marked against last year's 10-K

We are increasingly dependent on sophisticated information technology systems; our business and results of operations are subject to adverse impacts due to the disruption, failure, or breaches of these systems. We and our customers and third-party providers rely on information technology systems, hardware, and software, including third-party “cloud based” systems, to run critical accounting, project management, and financial information systems. We rely upon security measures, systems redundancy, and third-party products and services to attempt to secure our information technology systems and the confidential, proprietary, and sensitive information they contain. However, our information technology systems and data, and that of our customers and third-party providers, are subject to cybersecurity incidents, such as hacking, computer viruses or other malicious or destructive software, ransomware, denial of service attacks, malicious social engineering and other intrusions, encryption, erasure, failure, and damage by individuals (which may include our and our third-party providers’ employees), groups or nation states or state-sponsored threats. Such cybersecurity incidents could result in operational disruption and information misappropriation, such as theft of intellectual property or inappropriate disclosure of customer data or confidential, sensitive, or personal information, or in reputational harm with customers. While we maintain insurance coverage for these types of cybersecurity incidents, such policies may not completely provide coverage for, or completely offset, the costs associated with such incidents, including losses from delays in our ability to provide services to our customers, reputational harm, or the costs to improve security against future similar threats. We are continuously developing and enhancing our controls, processes, and practices designed to protect our systems, computers, software, data, and networks from attack, damage, or unauthorized access. This continued development and enhancement requires us to expend additional resources. However, we may not anticipate or combat all types of potential disruptions or breaches. Threats are continually evolving and threat actors may adopt new or different means of breaching our information technology systems and data, including the potential use of artificial intelligence (“AI”) AI tools to engage in automated, targeted, and coordinated attacks. As cybersecurity threats become more sophisticated and difficult to detect, our ability to promptly prevent, detect and mitigate the effects of cybersecurity incidents may be impacted, potentially resulting in more material adverse effects. As such threats increase in frequency and sophistication, we could be required to expend additional capital and other resources, including costs to deploy additional personnel and protection technologies, train employees, and engage third-party experts and consultants. Additionally, as many of our employees use our information technology systems to collaborate with colleagues in different geographic locations and access our systems and those of our customers remotely, we and our customers may be subject to heightened security risks, including the risks of cyber-attacks. For additional information on our strategy and processes for assessing, identifying, and managing the risks posed by cybersecurity threats, and the management and oversight of such efforts, refer to Part I, Item 1C. Cybersecurity.

Item 1A, Risk Factors, 10-K Feb 26, 2026open_in_new

For additional information on our strategy and processes for assessing, identifying, and managing the risks posed by cybersecurity threats, and the management and oversight of such efforts, refer to Part I, Item 1C. Cybersecurity.

New this year Item 1A, Risk Factors, 10-K Feb 26, 2026open_in_new

The company has experienced and responded to cyber incidents. No event has had a significant impact on the results of our operations. Cyber events, however, could cause us to lose customers and/or revenue and could require us to incur significant expense to remediate, including as a result of legal or regulatory claims, proceedings, fines or penalties, and could also damage our reputation.

Marked against last year's 10-K

As previously disclosed, in 2022, the The company has experienced and responded to a cyber incident that did not have incidents. No event has had a significant impact on the results of our operations. Future cyber Cyber events, however, could cause us to lose customers and/or revenue and could require us to incur significant expense to remediate, including as a result of legal or regulatory claims, proceedings, fines or penalties, and could also damage our reputation.

Item 1A, Risk Factors, 10-K Feb 12, 2026open_in_new

In response to the evolving cyber threat environment, we continue to invest in data security and address these risks and uncertainties by implementing security technologies, internal controls, network and data center resiliency, and redundancy and recovery processes, as well as …

Marked against last year's 10-K

In response to the evolving cyber threat environment, we continue to invest in data security and address these risks and uncertainties by implementing security technologies, internal controls, network and data center resiliency, and redundancy and recovery processes, as well as by securing insurance. Our efforts are intended to reduce the risk of, or moderate the consequences of, potential cyber threats and incidents. Future problems Problems that impair or compromise the company’s information technology infrastructure, or that of our third party service providers, including those due to natural disasters, power outages, major network failures, security breaches or malicious attacks, or those occurring during system upgrades and/or new system implementations could impede our operations. Such impacts could interfere with our ability to record or process orders, manufacture and ship in a timely manner, manage our financial services operations including originating, processing, accounting for and collecting receivables, protect sensitive data of the company, our customers, our suppliers and business partners, or otherwise carry on business in the normal course.

Item 1A, Risk Factors, 10-K Feb 12, 2026open_in_new

Increasing privacy, data security and cybersecurity obligations or a significant data breach may adversely affect the Company's business.

Word for word as last year Item 1A, Risk Factors, 10-K Feb 12, 2026open_in_new

Additionally, the Company must manage the increasing threat of continually evolving cybersecurity risks. Our network, systems and storage applications, and those systems and applications maintained by our third-party commercial partners (such as aircraft and engine suppliers, cloud computing companies …

Word for word as last year Item 1A, Risk Factors, 10-K Feb 12, 2026open_in_new

• Cyberattacks, including computer malware, ransomware, viruses, denial of service attacks, account takeovers, spamming, phishing, and social engineering attacks could harm our reputation, business, and operating results.

Word for word as last year Item 1A, Risk Factors, 10-K Feb 13, 2026open_in_new

Cyberattacks, including computer malware, ransomware, viruses, denial of service attacks, account takeovers, spamming, phishing and social engineering attacks could harm our reputation, business, and operating results.

Word for word as last year Item 1A, Risk Factors, 10-K Feb 13, 2026open_in_new

… In recent periods, the frequency and sophistication of cyber-attacks have increased and are expected to continue to increase, including as a result of state-sponsored cybersecurity attacks during periods of geopolitical conflict.

Marked against last year's 10-K

IT and other systems (ours, as well as those of our franchisees, acquired businesses, and third-party service providers) have been and will continue in the future to be susceptible to damage, disruptions and shutdowns due to programming errors, defects or other vulnerabilities, power outages, hardware failures, misconfigurations, computer viruses, cyber-attacks, encryption caused by ransomware or malware attacks, exfiltration of data, attacks by foreign governments, state-sponsored actors, or criminal groups, theft, misconduct by employees or other insiders, telecommunications failures, misuse, human errors or other catastrophic events. In recent periods, the frequency and sophistication of cyber-attacks have increased and are expected to continue to increase, including as a result of state-sponsored cybersecurity attacks during periods of geopolitical conflict.

Item 1A, Risk Factors, 10-K Feb 17, 2026open_in_new

A significant cybersecurity incident, increased data protection regulations, or other information technology related risks, could materially adversely affect us.

Marked against last year's 10-K

A significant cybersecurity incident, or increased data protection regulations, or other information technology related risks, could materially adversely affect us.

Item 1A, Risk Factors, 10-K Feb 17, 2026open_in_new

… If these third-party vendors, as well as our suppliers and other vendors, experience service interruptions or damage, security incidents, cyber-attacks, computer viruses, ransomware or other similar events or intrusions, our business and our consolidated results of operations may …

Word for word as last year Item 1A, Risk Factors, 10-K Jul 29, 2026open_in_new

… the occurrence of any of the cyber events. Our response to cybersecurity incidents, and our investments in our technology and our controls, processes and practices related to cybersecurity incidents and risks from cybersecurity threats, may not be sufficient to shield …

Word for word as last year Item 1A, Risk Factors, 10-K Jul 29, 2026open_in_new

* Command, control, communications, computers, cyber, intelligence, surveillance and reconnaissance

Word for word as last year Item 7, MD&A, 10-K Jan 30, 2026open_in_new

* Command, control, communications, computers, cyber, intelligence, surveillance and reconnaissance

Word for word as last year Item 7, MD&A, 10-K Jan 30, 2026open_in_new

… Our systems could be compromised by malware (including ransomware), cyber-attacks, and other events, ranging from widespread, non-targeted, global cyber threats to targeted advanced persistent threats. Given our commercial product offerings can be used in critical infrastructure and critical …

Word for word as last year Item 1A, Risk Factors, 10-K Nov 12, 2025open_in_new

Compliance with privacy and cybersecurity laws and regulations (including the emerging European Union Cyber Resiliency Act) could increase our operating costs in managing product compliance and as part of our efforts to protect and safeguard our sensitive data, personal information …

Word for word as last year Item 1A, Risk Factors, 10-K Nov 12, 2025open_in_new

While we have experienced cybersecurity attacks, such attacks have not resulted in a material information security breach and we have not suffered any material losses relating to such attacks. Due to the evolving nature of security threats, the possibility of …

Word for word as last year Item 1A, Risk Factors, 10-K Feb 11, 2026open_in_new

Our business could be negatively impacted by cybersecurity threats and other disruptions.

Word for word as last year Item 1A, Risk Factors, 10-K Feb 11, 2026open_in_new

… Our information technology systems, devices, storage, and applications, as well as those maintained by third-party providers, are vulnerable to damage, disruptions, and shutdowns due to cyberattacks, ransomware, malware, phishing, denial of service attacks, and other unauthorized access attempts. These …

Word for word as last year Item 1A, Risk Factors, 10-K Feb 13, 2026open_in_new

Given the interconnected nature of the supply chain and our significant industry presence, we may be an attractive target for cyberattacks. Many aspects of our operations depend on third-party networks and systems, which are also susceptible to cyber risks. While we have dedicated resources for security, privacy, and incident response, our processes may not be adequate to prevent or limit harm or to remediate incidents promptly.

Word for word as last year Item 1A, Risk Factors, 10-K Feb 13, 2026open_in_new

… While we maintain insurance coverage that is intended to address certain aspects of cybersecurity risks, such insurance coverage may not cover all losses or all types of claims that arise. As cyber threats continue to evolve, cybersecurity and data protection …

Marked against last year's 10-K

These trends increase the likelihood of such events occurring as well as the costs associated with protecting against such events. It is possible for vulnerabilities in our systems to remain undetected for an extended period of time up to and including several years. We attempt to mitigate these risks by employing a number of measures, including employee training, systems monitoring and other technical security controls, vulnerability scanning, risk assessments, a breach response plan, maintenance of backup and protective systems, and security personnel. Notwithstanding those measures, our systems, networks, products and services remain potentially vulnerable to known or unknown cybersecurity attacks and other threats, any of which could have a material adverse effect on our consolidated results of operations, financial condition and cash flows. We continuously monitor and develop our systems to protect our technology infrastructure and data from misappropriation or corruption. However, a cybersecurity attack could persist for an extended period of time before being detected, and, following detection, it could take considerable time for us to obtain full and reliable information about the extent, amount and type of information compromised. During the course of an investigation, we may not know the full impact of the event and how to remediate it, and actions, decisions and mistakes that are taken or made may further increase the negative effects of the event on our business, results of operations and reputation. While we maintain insurance coverage that is intended to address certain aspects of cybersecurity risks, such insurance coverage may not cover all losses or all types of claims that arise. As cyber threats continue to evolve, cybersecurity and data protection laws and regulations continue to develop in the U.S. and globally, and our business continues to move toward increased online connectivity within our information systems and through more Internet-enabled and automated or AI-embedded products and offerings, we expect to expend additional resources to continue to build out our compliance programs, strengthen our information security, data protection and business continuity measures, and investigate and remediate vulnerabilities. For additional information on our cybersecurity risk management, strategy and governance, see Item 1C. "Cybersecurity."

Item 1A, Risk Factors, 10-K Feb 13, 2026open_in_new

o access to or control of networks and confidential information due to local government controls and vulnerability of local networks to cyber risks.

Word for word as last year Item 1A, Risk Factors, 10-K Feb 13, 2026open_in_new

The Company’s cybersecurity defenses may be insufficient to fully mitigate cyber risks and losses related to cybersecurity events, any of which may result in a material adverse effect on the Company and its financial condition or results of operations …

Word for word as last year Item 1A, Risk Factors, 10-K Feb 19, 2026open_in_new

There has been a rise in the number of cyberattacks targeting confidential business information generally and in the manufacturing industry specifically by both state-sponsored and criminal organizations. These may include such things as denial of service attacks, introduction of ransomware or other malicious software programs, and other disruptive problems. In

Word for word as last year Item 1A, Risk Factors, 10-K Feb 19, 2026open_in_new

… We face numerous and evolving cybersecurity risks that threaten the confidentiality, integrity and availability of our information technology systems and confidential information as well as the systems and information of key third parties and information technology vendors upon whom we …

Marked against last year's 10-K

We rely on information technology systems to manage our operations and other business processes and to protect sensitive company information. We also collect and retain information about our customers, stockholders, vendors, employees, contractors, business partners and other parties, all of whom expect that we will adequately protect such information. We face numerous and evolving cybersecurity risks that threaten the confidentiality, integrity and availability of our information technology systems and confidential information as well as the systems and information of key third parties and information technology vendors upon whom we rely. Certain of our vendors have experienced cyber-attacks that exploited vulnerabilities in their systems and have resulted in disruptions to their systems. While these events have not resulted in any known material impacts to our systems, we expect such attacks will continue in the future. Furthermore, the energy infrastructure systems and facilities on which we work are strategic targets that are at greater risk of cyber-attacks or acts of terrorism than other targets. Additionally, an intrusion into the information systems of a business we acquire may also ultimately compromise our systems. Our operations are decentralized with operating companies maintaining some of their own information systems, data and service providers. While our cybersecurity risk management program and processes, providers, including policies, some of their own security controls and procedures, are designed to cover our operating companies, there processes. There can be no assurance that these will be fully implemented, complied with or effective in protecting all information systems and operations. our cybersecurity

Item 1A, Risk Factors, 10-K Feb 19, 2026open_in_new

• acts or omissions that adversely affect our business such as a crime, scandal, cyber-related incident, litigation or other negative publicity;

Word for word as last year Item 1A, Risk Factors, 10-K Feb 19, 2026open_in_new

… These uses give rise to cybersecurity risks, including security breach, ransomware, espionage, system disruption, theft and/or inadvertent, accidental, unlawful, unauthorized access, loss, alteration, destruction and/or disclosure or release of information. Our business necessitates the processing, collection, use, storage …

Marked against last year's 10-K

Substantially all aspects of our business operations rely on digital technology. We use computers, mobile devices, social networking and other online platforms to connect with our employees, customers, vendors, as well as other individuals and third parties. These uses give rise to cybersecurity risks, including security breach, ransomware, espionage, system disruption, theft and/or inadvertent, accidental, unlawful, unauthorized access, loss, alteration, destruction and/or disclosure or release of information. Our business necessitates the processing, collection, use, storage and transmission of numerous classes of sensitive and/or confidential information and intellectual property, including individuals’ personal information, private and sensitive employment-related personal information, data, and financial and strategic information about the Company and other businesses. In addition to our own safeguarding efforts, we also rely on third parties to process, collect and store sensitive data, including a Payment Card Industry compliant third-party to protect our customers’ credit card information. We are regularly the target of attempted cyber intrusions, have experienced cyber intrusions, and we anticipate continuing to be subject to such attempts as cyber intrusions become increasingly sophisticated and more difficult to predict and protect against. Geopolitical conflicts Technological advancements, including the progression of the capabilities of artificial intelligence, also increase the risk, likelihood and developments precision of cyber incidents. As such, we must commit substantial resources to continuously monitor and technological advancements further enhance our networks and infrastructure to prevent, detect, and address the risk of unauthorized access, misuse, computer malware and other events. These protections and other systems designed to mitigate cybersecurity risks may not fully defend against an attack or future cybersecurity incident, which can be unpredictable in nature. Data security measures that our third-party service providers have implemented may not be effective against all current or future security threats. We also cannot guarantee that the systems, networks, equipment or software used by us or our third-party service providers have not been breached or otherwise compromised.

Item 1A, Risk Factors, 10-K Feb 9, 2026open_in_new

Although we believe that the probability of occurrence of a significant cybersecurity incident is less than likely, if such an incident were to occur, the impact on the Company could be substantial. The magnitude of future cyber intrusions that result …

Marked against last year's 10-K

Although we believe that the probability of occurrence of a significant cybersecurity incident is less than likely, if such an incident were to occur, the impact on the Company could be substantial. The magnitude of future cyber intrusions that result in a theft, destruction, loss, misappropriation, or release of sensitive and/or confidential information (belonging to us or third parties) or intellectual property, or material interference with our information technology systems or the technology systems of third parties on which we rely cannot be predicted, such incidents could result in material business disruption, direct financial loss, remediation costs, negative publicity, reputational harm, brand damage, alleged violation of privacy laws, loss of customers, potential regulatory investigations and enforcement or private litigation liability and competitive disadvantage. To mitigate these risks, we maintain a cybersecurity insurance policy; however, due to policy terms, limits and exclusions, such insurance may not apply in all cases, and it may not be adequate to cover all liabilities incurred. Regulatory enforcement action concerning privacy infringement and security incidents is generally increasing, including significant fines recently imposed by U.K. and European regulators. With the acquisition of Stericycle, we Our Healthcare Solutions operations in Western Europe may be subject us to short notification deadlines in international jurisdictions in the event of a significant cybersecurity incident that impacts us globally; it may not be possible for us to comply with such notification deadlines due to the time required to conduct investigations and assess the impact of such incident. Failure to comply with applicable laws and regulatory deadlines could attract enforcement action, penalties, litigation, investigations, proceedings, reputational harm and brand damage.

Item 1A, Risk Factors, 10-K Feb 9, 2026open_in_new

… As such, our IT environment faces information technology security threats, such as security breaches, computer malware, ransomware attacks and other "cyber attacks," which are increasing in both frequency and sophistication, along with power outages or hardware failures. Increasing use of …

Marked against last year's 10-K

The data handled by our technologies is vulnerable to security threats. Our operations routinely involve receiving, storing, processing and transmitting sensitive information pertaining to our business, customers, dealers, suppliers, employees and other sensitive matters. As such, our IT environment faces information technology security threats, such as security breaches, computer malware, ransomware attacks and other "cyber attacks," which are increasing in both frequency and sophistication, along with power outages or hardware failures. Increasing use of artificial intelligence AI may increase these risks. These threats could result in unauthorized public disclosures of information, create financial liability, subject us to legal or regulatory sanctions, disrupt our ability to conduct our business, result in the loss of intellectual property or damage our reputation with customers, dealers, suppliers and other stakeholders. As the result of changing market conditions, a large percentage of our salaried employees continue to work remotely full or part-time. This remote working environment may pose a heightened risk for security breaches or other disruptions of our IT environment.

Item 1A, Risk Factors, 10-K Feb 10, 2026open_in_new

In addition, our products, including our engines, contain interconnected and increasingly complex technologies that control various processes, and these technologies are potentially subject to "cyber attacks" and disruption. The impact of a significant IT event on either our IT environment or our products could have a material adverse effect on our competitive position, reputation, results of operations, financial condition and cash flows.

Marked against last year's 10-K

In addition, our products, including our engines, contain interconnected and increasingly complex technologies that control various processes processes, and these technologies are potentially subject to "cyber attacks" and disruption. The impact of a significant IT event on either our IT environment or our products could have a material adverse effect on our competitive position, reputation, results of operations, financial condition and cash flows.

Item 1A, Risk Factors, 10-K Feb 10, 2026open_in_new

… cyber-attack as a result of being a component of the critical U.S. infrastructure. If such an event takes place, the Company may be required to incur significant expenses in excess of existing cybersecurity insurance coverage. As cybersecurity threats …

Marked against last year's 10-K

The Company, its third-party vendors and other companies in the rail and transportation industries have been subject to, and are likely to continue to be the target of, data breaches, cyber-attacks and other similar incidents. These incidents may include, among other things, malware, ransomware, distributed denial of service attacks, social engineering, phishing, theft, malfeasance or improper access by employees or third-party vendors, software bugs, server malfunctions, software or hardware failures, human error, fraud, or other modes of attack or disruption. Attacks of these nature are increasing in frequency, levels of persistence, intensity and sophistication, including by nation-state threat actors or those associated with nation-states. Further, the Company may be at increased risk of experiencing a cyber-attack as a result of being a component of the critical U.S. infrastructure. If such an event takes place, the Company may be required to incur significant expenses in excess of existing cybersecurity insurance coverage. As cybersecurity threats continue to evolve, including the increased maturity of artificial intelligence leveraged by threat actors, the Company may be required to expend significant additional resources to continue to modify or enhance its protective measures or to investigate and remediate any information security vulnerabilities, data breaches, cyber-attacks or other similar incidents. The Company or its third-party vendors may also experience cybersecurity incidents as a result of employees, third-party vendors and other third parties with which they interact working remotely on less secure systems and environments.

Item 1A, Risk Factors, 10-K Feb 12, 2026open_in_new

… The Company also takes proactive measures to advise CSX employees of how they can assist the Company in its cybersecurity practices. CSX informs employees on cybersecurity best practices, including how to identify cyber-related suspicious activity, how to report such …

Marked against last year's 10-K

Strong performance and reliability of the Company's technology systems are critical to operating safely and effectively, and protecting personal and customer data is essential to maintaining stakeholder trust. The Company has implemented processes designed to assess, identify, and manage material cybersecurity risks, as described further below. CSX maintains a cybersecurity framework that is integrated across the organization through people, processes and technology to help protect the personal information of its customers, its contractors and its suppliers as well as protect the integrity of its own operations. Cybersecurity is also integrated into the Company’s Enterprise Risk Management (“ERM”) program. The Company equips CSX systems with various cybersecurity tools, conducts vulnerability scans and provides critical cybersecurity information to application users, as appropriate. The Company also takes proactive measures to advise CSX employees of how they can assist the Company in its cybersecurity practices. CSX informs employees on cybersecurity best practices, including how to identify cyber-related suspicious activity, how to report such activity and, as appropriate, proactive measures employees can take to safeguard company information and devices. The Company also provides cybersecurity awareness training to employees and conducts cybersecurity testing exercises to help maintain cybersecurity vigilance. With the assistance of third-party consultants, the Company conducts an annual cybersecurity exercise, which is often a "tabletop" scenario involving a cross-functional group responding to a hypothetical cybersecurity threat.

Item 1A, Risk Factors, 10-K Feb 12, 2026open_in_new

We face numerous and evolving cybersecurity risks that threaten the confidentiality, integrity and availability of our IT Systems and Confidential Information, including from diverse threat actors, such as state-sponsored organizations, opportunistic hackers and hacktivists, as well as through diverse …

New this year Item 1A, Risk Factors, 10-K Feb 19, 2026open_in_new

Information technology system failures, network disruptions or cybersecurity breaches could adversely affect our business.

Word for word as last year Item 1A, Risk Factors, 10-K Feb 19, 2026open_in_new

… be compromised by a cyber attack. In addition, the rapid evolution and increased adoption of AI technologies may intensify our cybersecurity risks, including risks from malicious or misuse of AI to craft increasingly sophisticated cybersecurity attacks against us, our business …

Marked against last year's 10-K

Our information technology systems, networks, connected services, and infrastructure and technology, including artificial intelligence (AI) technology, embedded in certain of our control products have been and are at risk to cyber attacks and unauthorized access. From time to time, vulnerabilities in our products are discovered and updates are made available, but customers are at risk until those updates are applied or other mitigating actions are taken by customers to protect their systems and networks. Like Although we maintain processes and procedures designed to mitigate cybersecurity risk, like other large companies, certain of our information technology systems and the systems of our vendors have been subject to computer viruses, malicious code, unauthorized access, phishing attempts, denial-of-service attacks and other cyber attacks and we expect that we and our vendors will be subject to similar attacks in the future. We and some of our third-party suppliers have experienced cyber attacks, and, due to the evolving threat landscape, may continue to experience attacks, potentially with more frequency and severity. Certain of our business partners and third-party vendors may be granted access to our confidential information as well as confidential information about our customers, suppliers, employees, and others, which may be compromised by a cyber attack. We In addition, the rapid evolution and increased adoption of AI technologies may intensify our cybersecurity risks, including risks from malicious or misuse of AI to craft increasingly sophisticated cybersecurity attacks against us, our business partners, or our third-party vendors. While we continue to make investments and adopt measures designed to enhance our protection, detection, response, and recovery capabilities, and to mitigate potential risks to our technology, products, services and operations from potential cyber attacks. attacks, insufficient controls or other vulnerabilities in our systems and those of our business partners or third-party vendors could result in misappropriation, destruction, exfiltration, or unauthorized disclosure of our information.

Item 1A, Risk Factors, 10-K Feb 5, 2026open_in_new

… Our insurance coverage may not be adequate to cover all the costs related to a cyber attack or disruptions resulting from such attacks. Customers are increasingly requiring cybersecurity protections and mandating cybersecurity standards in our products, and we may incur …

Marked against last year's 10-K

The methods used to obtain unauthorized access, disable or degrade service, or sabotage information technology systems are constantly changing and evolving. Despite having instituted security policies and enhancing business continuity plans, and implementing and regularly reviewing and updating security controls and related processes and procedures to protect against unauthorized access and requiring similar protections from our vendors, the ever-evolving threats mean we are continually evaluating and adapting our systems and processes and ask our vendors to do the same, and there is no guarantee that such systems and processes will be adequate to safeguard against all data security breaches or misuses of data. Hardware, software, artificial intelligence AI technology, or applications we develop or obtain from third parties sometimes contain defects in design or deployment or other problems that could unexpectedly result in security breaches or disruptions. Open source software components embedded into certain software that we use have in the past contained vulnerabilities and others may be discovered in the future. Such vulnerabilities can expose our systems to malware or allow unauthorized third-party access to data, including confidential information about our business, customers, dealers, and suppliers; personally identifiable data related to employees, customers, and other business partners; as well as other sensitive matters. While these issues are not specific to our Company, we are required to take action when such vulnerabilities are identified including patching and modification to certain of our products and enterprise systems. To date, there has been no material business impact from such vulnerabilities, but we continue to monitor these issues and our responses are ongoing. Our systems, networks and certain of our control products and those of our vendors are at risk to system damage, cyber attacks, human errors or misconduct, malware, power and utility outages, and other catastrophic events. Any of these incidents could cause significant harm to our business by negatively impacting our business operations, compromising the security of our proprietary information or the personally identifiable information of our customers, employees and business partners which may be subject to privacy and security laws, regulations and other controls. These events potentially expose us to litigation or other legal actions against us or the imposition of penalties, fines, fees or liabilities. Such events could have a material adverse impact on our results of operations, financial condition and cash flows and could damage our reputation which could adversely affect our business. Our insurance coverage may not be adequate to cover all the costs related to a cyber attack or disruptions resulting from such attacks. Customers are increasingly requiring cybersecurity protections and mandating cybersecurity standards in our products, and we may incur additional costs to comply with such demands.

Item 1A, Risk Factors, 10-K Feb 5, 2026open_in_new

… ransomware or as a result of human error or other cyber-attack methods, from materially affecting our systems or the systems of third-parties upon which we rely. The rapid evolution and increased availability of artificial intelligence may intensify cybersecurity …

Word for word as last year Item 1A, Risk Factors, 10-K Feb 6, 2026open_in_new

… 1, which was enacted on July 4, 2025; expectations that claims, litigation, environmental costs, commitments, contingent liabilities, labor negotiations or agreements, cyber-attacks, or other matters will not have a material adverse effect on our consolidated results of operations, financial …

Marked against last year's 10-K

Certain statements in this report, and statements in other reports or information filed or to be filed with the SEC (as well as information included in oral statements or other written statements made or to be made by us), are, or will be, forward-looking statements as defined by the Securities Act of 1933 and the Securities Exchange Act of 1934. These forward-looking statements and information include, without limitation, statements in the CEO’s letter preceding Part I; statements regarding planned capital expenditures under the caption “2025 “2026 Capital Plan” in Item 2 of Part I; and statements and information set forth under the captions “2025 “2026 Outlook”; “Liquidity and Capital Resources” in Item 7 of Part II regarding our capital plan, share repurchase programs, contractual obligations, "Pension Benefits", and "Other Matters" in this Item 7 of Part II. Forward-looking statements and information also include any other statements or information in this report (including information incorporated herein by reference) regarding: the merger agreement and the transactions contemplated therein (described in Note 20 to the Financial Statements and Supplementary Data, Item 8), potential impacts of public health crises, including pandemics, epidemics, and the outbreak of other contagious disease, such as COVID; such as the coronavirus and its variant strains (COVID); the Russia-Ukraine and Israel-Hamas wars and other geopolitical tensions in the Middle East, East and elsewhere, and any impacts on our business operations, financial results, liquidity, and financial position, and on the world economy (including customers, employees, and supply chains), including as a result of fluctuations in volumes volume and carloadings; closing of customer manufacturing, distribution distribution, or production facilities; expectations as to operational or service improvements; expectations as to hiring challenges; availability of employees; expectations regarding the effectiveness of steps taken or to be taken to improve operations, service, infrastructure improvements, and transportation plan modifications (including those discussed in response to increased traffic); expectations as to cost savings, revenue growth, and earnings; the time by which goals, targets, aspirations, or objectives will be achieved; projections, predictions, expectations, estimates, or forecasts as to our business, financial, and operational results, future economic performance, and general economic conditions; proposed new products and services; estimates of costs relating to environmental remediation and restoration; estimates and expectations regarding tax matters; estimates and expectations regarding potential tariffs; potential impacts of H.R. 1, which was enacted on July 4, 2025; expectations that claims, litigation, environmental costs, commitments, contingent liabilities, labor negotiations or agreements, cyber-attacks, or other matters will not have a material adverse effect on our consolidated results of operations, financial condition, or liquidity and any other similar expressions concerning matters that are not historical facts. Forward-looking statements may be identified by their use of forward-looking terminology, such as “believes,” “expects,” “may,” “should,” “would,” “will,” “intends,” “plans,” “estimates,” “anticipates,” “projects” “projects,” and similar words, phrases, or expressions.

Item 7, MD&A, 10-K Feb 6, 2026open_in_new

… A significant cyber incident, including system failure, security breach, disruption by malware or ransomware, or other damage, could interrupt or delay our operations, damage our reputation and brand, cause a loss of customers, expose us to a risk of loss …

Marked against last year's 10-K

We have security processes, protocols and standards in place to protect our information systems, including through physical and software safeguards, as well as redundant systems, network security measures and backup systems. Nevertheless, it is difficult to fully protect against the possibility of power loss, telecommunications failures, cyber-attacks, and other cyber incidents in every potential circumstance that may arise. The rapid ongoing evolution and increased adoption of emerging technologies such as artificial intelligence (“AI”) AI and machine learning may make it more difficult to anticipate and implement protective measures to recognize, detect, and prevent the occurrence of any of these events. A significant cyber incident, including system failure, security breach, disruption by malware or ransomware, or other damage, could interrupt or delay our operations, damage our reputation and brand, cause a loss of customers, expose us to a risk of loss or litigation, result in regulatory scrutiny, investigations, actions, fines or penalties and/or cause us to incur significant time and expense to remedy such an event, any of which could have a material adverse impact on our results of operations and financial position. Furthermore, we are subject to an increasing number of cybersecurity reporting obligations in different jurisdictions that vary in their scope and application, creating conflicting reporting requirements. These factors and the time spent to investigate and evaluate the full impact of incidents and to comply may inhibit our ability to quickly provide complete and reliable information about the cybersecurity incident to customers, counterparties, and regulators, as well as the public. Additionally, any failure to comply with data privacy, security or other laws and regulations, such as the California Consumer Privacy Act and other similar laws that have been or are expected to be enacted in the United States, at both the federal and state level, could result in claims, legal or regulatory proceedings, inquiries or investigations. As cyber threats are continually evolving, our controls and procedures may become inadequate and we may be required to devote additional resources to modifying or enhancing our systems in the future. Furthermore, while we maintain insurance intended to address costs associated with aspects of cyber incidents, network failures and data privacy-related concerns, we cannot be certain that we will continue to be able to obtain excess insurance coverage in amounts we deem sufficient, our insurance carriers will pay on our insurance claims, or we will not experience a claim for which coverage is not provided.

Item 1A, Risk Factors, 10-K Feb 24, 2026open_in_new

Our information technology systems are subject to cyber and other risks, some of which are beyond our control, which could have a material adverse effect on our business, results of operations and financial position.

Word for word as last year Item 1A, Risk Factors, 10-K Feb 24, 2026open_in_new

… cybersecurity incidents) and we suffer any resulting interruption in our ability to manage and operate our business or if our products are affected, our results of operations and financial condition could be materially adversely affected. The sophistication of cyber threats …

Marked against last year's 10-K

We rely extensively on information technology systems to manage and operate our business, some of which are managed or accessible by third parties. The security and functionality of these information technology systems, and the processing of data by these systems, are critical to our business operations. If these systems, or any part of the systems, are damaged, intruded upon, attacked, shutdown shut down or cease to function properly (whether by planned upgrades, force majeure, telecommunications failures, criminal acts, including hardware or software break-ins or extortion attempts, or viruses, or other cybersecurity incidents) and we suffer any resulting interruption in our ability to manage and operate our business or if our products are affected, our results of operations and financial condition could be materially adversely affected. The sophistication of cyber threats continues to evolve and grow, including the risk associated with the use of artificial intelligence and quantum computing by threat actors to conduct more targeted and evasive attacks. There can be no guarantee that the actions and controls we have implemented and are implementing, or which we cause or have caused third-parties third parties with access to our systems to implement, will be sufficient to protect and mitigate risks associated with our information technology systems. Additionally, our increasing use of digital technologies within our operations as well as other evolving practices such as certain of our employees working remotely at times and the increased adoption of generative artificial intelligence may increase our vulnerability to cyber and data protection risks. In addition to existing risks, any adoption or deployment of or exposure to new technologies via acquisitions or internal initiatives or changes to our information technology systems as a result of divestitures may increase our exposure to risks, breaches, or failures, which could materially adversely affect our results of operations or financial condition. Furthermore, the Company has access to sensitive, confidential, or personal data or information that is subject to privacy and security laws, regulations, or other contractually-imposed controls. Despite our use of reasonable and appropriate controls, security breaches, theft, misplaced, lost or corrupted data, programming, or employee errors and/or malfeasance have led and could in the future lead to the compromise or improper use of such sensitive, confidential, or personal data or information. Such events may result in possible negative consequences, such as fines, ransom demands, penalties, failure to comply with laws governing sensitive data, loss of reputation, intellectual property, competitiveness or customers, increased security and compliance costs or other negative consequences. Further, the amount of insurance coverage that we maintain may be inadequate to cover claims or liabilities relating to a cybersecurity incident. Depending on the nature and magnitude of these events, they may have an adverse impact on our results of operations or financial condition.

Item 1A, Risk Factors, 10-K Aug 21, 2026open_in_new

• threats associated with international conflicts, including geopolitical tensions in the Middle East, and cybersecurity risks and risks associated with protecting our intellectual property;

Marked against last year's 10-K

• threats associated with international conflicts conflicts, including geopolitical tensions in the Middle East, and cybersecurity risks and risks associated with protecting our intellectual property;

Item 7, MD&A, 10-K Aug 21, 2026open_in_new

… be vulnerable to: (i) intrusion, (ii) exfiltration of data, (iii) damage, (iv) disruptions or shutdowns due to attacks by cyber criminals or foreign state actors, (v) employees’, suppliers’, or dealers’ error or malfeasance, (vi) supply chain compromise, (vii) disruptions during …

Marked against last year's 10-K

Despite security measures, including exercises, tests, incident simulations, and system assessments measures designed to discover and address potential vulnerabilities, our information technology networks and infrastructure have been and may continue to be vulnerable to to: (i) intrusion, (ii) exfiltration of data, (iii) damage, disruptions, (iv) disruptions or shutdowns due to attacks by cyber criminals, criminals or foreign state actors, (v) employees’, suppliers’, or dealers’ error or malfeasance, (vi) supply chain compromise, (vii) disruptions during the process of upgrading or replacing computer software or hardware, (viii) power and systems outages, (ix) computer viruses, (x) ransomware or other malware, (xi) telecommunication or utility failures, (xii) terrorist acts, (xiii) natural disasters, or (xiv) and other events. Although we have not suffered any significant cyber incidents that resulted in material business impact, we have from time to time been, and expect to continue to be, the target of malicious cyber threat actors. The occurrence of any significant event could compromise our networks, and the information stored there could be accessed, obtained, publicly disclosed, lost, altered, misused, or stolen. Any such access, acquisition, disclosure, alteration, misuse, or other loss of information could result in legal claims or proceedings, government investigations, liability or regulatory penalties, disruption or shut down of our operations, disruption or shut down of our dealers’ and customers’ operations, and damage to our reputation, which could adversely affect our business, results of operations, and financial condition. Furthermore, as security threats continue to evolve and increase in frequency and sophistication, we may need to invest additional resources to enhance information security.

Item 1A, Risk Factors, 10-K Dec 18, 2025open_in_new

Although we have not suffered any significant cyber incidents that have resulted in material business impact, we have from time to time been, and expect to continue to be, the target of malicious cyber threat actors. The occurrence of any …

Marked against last year's 10-K

Despite security measures, including exercises, tests, incident simulations, and system assessments designed to discover and address potential vulnerabilities, our information technology networks and infrastructure have been and may be vulnerable to intrusion, damage, disruptions, or shutdowns due to attacks by cyber criminals, employees’, suppliers’, or dealers’ error or malfeasance, supply chain compromise, disruptions during the process of upgrading or replacing computer software or hardware, power outages, computer viruses, ransomware or other malware, telecommunication or utility failures, terrorist acts, natural disasters, or other events. Although we have not suffered any significant cyber incidents that have resulted in material business impact, we have from time to time been, and expect to continue to be, the target of malicious cyber threat actors. The occurrence of any significant event could compromise our networks, and the information stored there could be accessed, obtained, publicly disclosed, lost, altered, misused, or stolen. Any such access, acquisition, disclosure, alteration, misuse, or other loss of information could result in legal claims or proceedings, government investigations, liability or regulatory penalties, disruption or shut down of our operations, disruption or shut down of our dealers’ and customers’ operations, and damage to our reputation, which could adversely affect our business, results of operations, and financial condition. Furthermore, as security threats continue to evolve and increase in frequency and sophistication, we may need to invest additional resources to enhance information security.

Item 1A, Risk Factors, 10-K Dec 18, 2025open_in_new

… Any significant disruptions or unapproved third-party access to our global systems or the internet for any reason, which could include equipment or network failures; co-location facility failures; power outages; sabotage; government interference, employee error or other actions; cyber …

Marked against last year's 10-K

As our employees, our customers and suppliers continue to increase reliance on systems, and as additional features are added, the risks also increase. Any significant disruptions or unapproved third-party access to our global systems or the internet for any reason, which could include equipment or network failures; co-location facility failures; power outages; sabotage; government interference, employee error or other actions; cyber-attacks or other security breaches; reliance on third party technology; geo-political activity or natural disasters; all of which could have a material negative effect on our results. Significant disruptions to, or unapproved third‑party access into our networks and systems could materially harm our business and financial results by interrupting critical operations and degrading systems continuity. Potential disruption vectors include equipment or network failures, co‑location facility outages, power interruptions, sabotage, government interference, employee error, cyber‑attacks or other security breaches, dependencies on third‑party technologies, geopolitical events, and natural disasters, any of which could sever connectivity to our global systems or the internet and impede execution of core processes. In such circumstances, we may be compelled to shut down systems to protect the environment, as we did during a cyber-attack in February 2022, we were the subject of a targeted cyber-attack. Upon discovering the incident, we shut down most of our operating systems globally leading to manage the safety of our overall global systems environment. This shutdown lost revenue; shipment‑processing delays and any such future events are likely to result in loss of revenue; other business disruptions (such as the inability to timely process shipments); and interruptions; significant remediation costs. This cyber-attack, or any future cyber-attack could also result in increased vulnerability and incremental security costs; heightened exposure to attempts of fraud, fraud; legal claims and proceedings including (including potential breach of contract claims, breach‑of‑contract assertions); reporting delays or errors; errors, including interference with regulatory reporting; an increase in costs to protect our systems and technology; or damage to our reputation. regulators. A future cyber-attack may also result in the destruction or exfiltration of our data as well as that of our customers and service providers.

Item 1A, Risk Factors, 10-K Feb 25, 2026open_in_new

A disruption or failure of Expeditors' systems or operations in the event of a major earthquake, weather event, cyber-attack, terrorist attack, strike, civil unrest, mass population dislocation, pandemic or other catastrophic event could cause delays in providing services or …

Word for word as last year Item 1A, Risk Factors, 10-K Feb 25, 2026open_in_new

… Consequently, despite our efforts, the possibility of cybersecurity incidents cannot be eliminated entirely. There can be no assurance that we will not experience a cybersecurity incident that may materially impact our business. While we also seek to obtain assurances that …

Word for word as last year Item 1A, Risk Factors, 10-K Feb 5, 2026open_in_new

… Union, the General Data Protection Regulation 2016, with interpretations varying from state to state and country to country) and cybersecurity requirements (including protection of information and incident responses), regulations on suppliers regarding the sources of supplies or products, labor and …

Word for word as last year Item 1A, Risk Factors, 10-K Feb 5, 2026open_in_new

… Despite these efforts, systems we utilize have been and may in the future be damaged, disrupted, ransomed or shut down due to cybersecurity attacks by unauthorized access, malware, ransomware, undetected intrusion, hardware failures, or other events, and in these circumstances …

Marked against last year's 10-K

Global cybersecurity vulnerabilities, threats and more frequent, sophisticated and targeted attacks attacks, which may be increasingly exacerbated by the proliferation of and advance in artificial intelligence, pose a risk to our information technology systems and to critical third-party information technology platforms we utilize. We have implemented security policies, processes and layers of defense designed to help identify and protect against misappropriation or corruption of our systems and information and disruption of our operations. Despite these efforts, systems we utilize have been and may in the future be damaged, disrupted, ransomed or shut down due to cybersecurity attacks by unauthorized access, malware, ransomware, undetected intrusion, hardware failures, or other events, and in these circumstances our disaster recovery plans may be ineffective or inadequate.

Item 1A, Risk Factors, 10-K Feb 10, 2026open_in_new

We are subject to cybersecurity attacks, which could adversely impact our results of operations and financial position.

Word for word as last year Item 1A, Risk Factors, 10-K Feb 10, 2026open_in_new

… At the same time, the continued occurrence of high-profile cyber and ransomware attacks and data breaches provides evidence of an external environment increasingly hostile to information security. We may be particularly targeted for cyberattack because of the amount and …

Marked against last year's 10-K

Data Security and Privacy Leaks: We collect, use, and retain increasingly large amounts of personal information about our clients, customers, employees of our clients, customers, our employees, and other third parties, including: bank account, credit card, and social security numbers, tax return information, health care information, retirement account information, payroll information, system and network passwords, and other sensitive personal and business information. At the same time, the continued occurrence of high-profile cyber and ransomware attacks and data breaches provides evidence of an external environment increasingly hostile to information security. We may be particularly targeted for cyberattack because of the amount and type of personal and business information that we collect, use, and retain, as well as during and after periods in which we acquire other companies. Vulnerabilities, threats, and more sophisticated and targeted computer crimes pose a risk to the security of our systems and networks, and the confidentiality, availability, and integrity of our data. Furthermore, if any of our solutions contain a software vulnerability, the vulnerability may be exploited to obtain access to our data or our clients’ customers’ data.

Item 1A, Risk Factors, 10-K Jul 17, 2026open_in_new

… As cyber threats continue to evolve, we are focused on ensuring that our operating environments safeguard and protect personal and business information. We may be required to invest significant additional resources to comply with evolving cybersecurity regulations and to modify …

Marked against last year's 10-K

Our service platforms enable our clients customers to store and process personal data on premises or, increasingly, in a cloud-based environment that we host. The security of our IT infrastructure is an important consideration in our customers’ purchasing decisions. Because the techniques used to obtain unauthorized access, disable or degrade service or sabotage systems change frequently, are increasingly more complex and sophisticated and may be difficult to detect for long periods of time, we may be unable or fail to anticipate these techniques or implement adequate or timely preventative or responsive measures. As cyber threats continue to evolve, we are focused on ensuring that our operating environments safeguard and protect personal and business information. We may be required to invest significant additional resources to comply with evolving cybersecurity regulations and to modify and enhance our information security and controls, and to investigate and remediate any security vulnerabilities. While we have security systems and IT infrastructure in place designed to detect and protect against unauthorized access to such information, including our Cyber Fusion Center, if our security measures are breached, either internally or externally, our business could be substantially harmed, and we could incur significant liabilities. Any such breach or unauthorized access could negatively affect our ability to attract new clients, customers, cause existing clients customers to terminate their agreements with us, result in reputational damage, and subject us to lawsuits, regulatory fines, or other actions or liabilities which could materially and adversely affect our business and operating results. Third-parties, including vendors that provide services for our operations, could also be a source of security and reputational risk to us in the event of a failure of their own security systems and infrastructure.

Item 1A, Risk Factors, 10-K Jul 17, 2026open_in_new

… Our evolution into smart and connected products subjects us to increased cyber and technology risks. The secure operation of our information technology systems and networks is critical to our business operations and strategy. Cybersecurity threats designed to gain unauthorized access …

Marked against last year's 10-K

We rely upon information technology systems and networks in connection with a variety of business activities, some of which are managed by third parties. As our business increasingly interfaces with employees, customers, dealers and suppliers using information technology systems and networks, we are subject to an increased risk to the secure operation of these systems and networks. Our evolution into smart and connected products subjects us to increased cyber and technology risks. The secure operation of our information technology systems and networks is critical to our business operations and strategy. Cybersecurity threats designed to gain unauthorized access to our systems, networks and data are increasing in frequency and sophistication. sophistication, including the risk that threat actors will leverage emerging technology, such as artificial intelligence, to exploit vulnerabilities. These threats pose a risk to the security of our systems and networks and the confidentiality, availability and integrity of the data we process and maintain. Establishing systems and processes to address these threats may increase our costs. We have experienced cybersecurity incidents, and, although we have determined these cybersecurity incidents to be immaterial and to have had no material adverse effect on our business strategy, financial condition, results of operations or cash flows, there can be no assurance of similar results in the future. Should future attacks succeed, it could expose us and our employees, customers, dealers and suppliers to the theft of assets, misuse of information or systems, compromises of confidential information, manipulation and destruction of data, product failures, production downtimes and operations disruptions. The occurrence of any of these events could have a material adverse effect on our reputation, business, financial condition, results of operations and cash flows. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or incidents may not be fully insured, and future cybersecurity coverage may become more expensive if we experience a cybersecurity incident. In addition, such cybersecurity incidents could result in litigation, reputational impacts, regulatory action and potential liability, and additional costs and operational consequences of implementing further data protection measures. For information on our cybersecurity risk management, strategy and governance, see ITEM 1C.- Cybersecurity.

Item 1A, Risk Factors, 10-K Feb 24, 2026open_in_new

such cybersecurity incidents could result in litigation, reputational impacts, regulatory action and potential liability and additional costs and operational consequences of implementing further data protection measures. For information on our cybersecurity risk management, strategy and governance, see ITEM 1C.- Cybersecurity.

New this year Item 1A, Risk Factors, 10-K Feb 24, 2026open_in_new

We have experienced cybersecurity threats and vulnerabilities in our systems and those of our third party providers, and we have experienced viruses and attacks targeting our information technology systems and networks. Such prior events, to date, have not had a …

Word for word as last year Item 1A, Risk Factors, 10-K Feb 13, 2026open_in_new

… Information technology security threats -- from user error to cybersecurity attacks designed to gain unauthorized access to our systems, networks and data -- are increasing in frequency and sophistication. Cybersecurity attacks from threat actors globally range from random attempts to coordinated and …

Word for word as last year Item 1A, Risk Factors, 10-K Feb 13, 2026open_in_new

… service providers, including through fraud or other means of deception, or introduction of malicious code, such as malware and ransomware. If successful, these actions could cause harm to our computer systems or compromise data stored on our computer networks or …

Word for word as last year Item 1A, Risk Factors, 10-K Feb 11, 2026open_in_new

… These networks and systems are subject to high levels of threat of continually evolving cybersecurity risks, which we must manage.

Marked against last year's 10-K

As a regular part of our ordinary business operations, we process a high volume of information, including personal information about individuals we have a relationship with and other sensitive business information. The secure operation of our networks and systems, and those of our business partners and third-party service providers, on which this type of information is processed is critical to our business operations and strategy. These networks and systems are subject to an increasing high levels of threat of continually evolving cybersecurity risks, which we must manage.

Item 1A, Risk Factors, 10-K Feb 11, 2026open_in_new

Like other major corporations, DuPont is the target of cyber-attacks, from time to time, which include phishing, spam emails, hacking, social engineering, industrial espionage and malicious software. DuPont has determined that these attacks have resulted, and could result in …

Marked against last year's 10-K

Like other major corporations, DuPont is the target of cyber-attacks, from time to time, which include phishing, spam emails, hacking, social engineering, industrial espionage and malicious software. DuPont has determined that these attacks have resulted, and could result in the future, in unauthorized parties gaining access to certain confidential business information. However, risks from previous cybersecurity incidents, incidents have not materially affected the Company, including its strategy, results of operations or financial condition. Although, there can be no assurance that DuPont will not suffer such losses in the future.

Item 1A, Risk Factors, 10-K Feb 17, 2026open_in_new

… cybersecurity risk threat assessment and when evidence of a breach is uncovered, conducts additional due diligence; (ii) based on the assessment, the Company develops and implements risk mitigation plans if needed and brings the acquisition under the Company’s cyber …

Word for word as last year Item 1A, Risk Factors, 10-K Feb 17, 2026open_in_new

Our Products and Services are Highly Sophisticated and Specialized, and a Major Product Failure or Similar Event Caused by Defects, Cybersecurity Incidents or Other Failures Could Adversely Affect Our Business, Reputation, Financial Position and Results of Operations

Word for word as last year Item 1A, Risk Factors, 10-K Nov 9, 2026open_in_new

… The potential consequences of a material cybersecurity incident include financial loss, reputational damage, litigation with third parties, diminution in the value of our investment in research, development and engineering, and increased cybersecurity protection and remediation costs due to the increasing …

Marked against last year's 10-K

We produce highly sophisticated products and provide specialized services that incorporate or use complex or leading-edge technology, including both hardware and software. Many of our products and services, including measurement and analytical instrumentation, industrial valves and equipment, and process control systems, are integrated and used in complex process, hybrid and discrete manufacturing environments. As a result, the impact of a catastrophic product failure or similar event could be significant. While we have built operational processes to ensure that our product design, manufacture, performance and servicing meet rigorous quality standards, there can be no assurance that we or our customers or other third parties will not experience operational process or product failures and other problems, including through manufacturing or design defects, process or other failures of contractors or third-party suppliers, cybersecurity incidents or other intentional acts, that could result in potential product, safety, regulatory or environmental risks. Cybersecurity incidents aimed at our software offerings and the software embedded in our products could lead to third-party claims resulting from damages caused by our product failures, and this risk is enhanced by the increasingly connected nature of our products. The potential consequences of a material cybersecurity incident include financial loss, reputational damage, litigation with third parties, diminution in the value of our investment in research, development and engineering, and increased cybersecurity protection and remediation costs due to the increasing sophistication and proliferation of threats, which in turn could adversely affect our competitiveness and results of operations.

Item 1A, Risk Factors, 10-K Nov 9, 2026open_in_new

… have warned about growing risks of hackers, cyber-criminals, malicious insiders and other actors targeting confidential information and all types of IT systems. These actors may engage in fraudulent activities, theft of confidential or proprietary information and sabotage or ransomware.

Marked against last year's 10-K

We rely heavily on information technology (IT) both in our products and services for customers and in our IT systems used to run our business. Further, we collect and store sensitive information in cloud-based data centers and on our networks. Government agencies and security experts have warned about growing risks of hackers, cyber-criminals, malicious insiders and other actors targeting confidential information and all types of IT systems. These actors may engage in fraudulent activities, theft of confidential or proprietary information and sabotage or ransomware.

Item 1A, Risk Factors, 10-K Feb 18, 2026open_in_new

See "Item 1C. Cybersecurity" of this Annual Report on Form 10-K for additional information related to cybersecurity risks.

Word for word as last year Item 1A, Risk Factors, 10-K Feb 18, 2026open_in_new

Increased global cybersecurity vulnerabilities, threats, and more sophisticated and targeted cyberattacks pose a risk to the security of our systems and networks, and the confidentiality, availability, and integrity of our data, as well as those of our customers, suppliers, and …

Marked against last year's 10-K

Increased global cybersecurity vulnerabilities, threats, and more sophisticated and targeted cyberattacks pose a risk to the security of our systems and networks, and the confidentiality, availability, and integrity of our data, as well as those of our customers, suppliers, and other counterparties. The Company believes that it faces threats of cyberattacks due to the industries it serves, the locations of its operations, and its technological innovations. The Company has experienced cybersecurity attacks in the past, including breaches of its information technology systems in which information was taken, and may experience them in the future, potentially with more frequency or sophistication. Although past attacks did not result in known losses of any critical data or have a material impact on Howmet’s financial condition or results of operations, the scope and impact of any future incident cannot be predicted. The use of new and evolving technologies, such as artificial intelligence, or AI, presents risks and challenges that can impact our business. Unauthorized use or misuse of AI by the Company's employees, vendors or others may result in the disclosure of confidential company or customer data, reputational harm, privacy law violations, cybersecurity risks, and legal liability.

Item 1A, Risk Factors, 10-K Feb 12, 2026open_in_new

… Unauthorized use or misuse of AI by the Company's employees, vendors or others may result in the disclosure of confidential Company or customer data, reputational harm, privacy law violations, cybersecurity risks, and legal liability. Additionally, while the use of …

New this year Item 1A, Risk Factors, 10-K Feb 12, 2026open_in_new

… Increasingly sophisticated cyber-attacks such as ransomware and AI-powered phishing scams could compromise the confidentiality, integrity, or availability of these systems, disrupt network and terminal operations, delay freight movements, or result in data loss or exfiltration. We have in …

Marked against last year's 10-K

We rely on information technology throughout all areas of our business to initiate, track, and complete customer orders; process financial and nonfinancial data; compile results of operations for internal and external reporting; and achieve operating efficiencies and growth. We have also invested significantly in the development of our Marketplace for J.B. Hunt 360 online freight matching platform. Each of our information technology systems may be susceptible to various interruptions, including equipment or network failures, failed upgrades or replacement of software, user error, power outages, natural disasters, cyber-attacks, theft or misuse of data, terrorist attacks, computer viruses, hackers, or other security breaches. Increasingly sophisticated cyber-attacks such as ransomware and AI-powered phishing scams could compromise the confidentiality, integrity, or availability of these systems, disrupt network and terminal operations, delay freight movements, or result in data loss or exfiltration. We have in the past experienced security breaches and other interruptions of our information technology systems and may in the future experience such breaches or interruptions despite our best efforts to prevent them. We have mitigated our exposure to these risks through the establishment and maintenance of technology security programs and disaster recovery plans, but these mitigating activities may not be sufficient. anticipate or prevent every attack or failure, particularly as threat actors and technologies evolve, nor may they fully prevent or mitigate all adverse impacts. A significant disruption, failure or security breach in our information technology systems could have a material adverse effect on our business, which could include operational disruptions, loss of confidential information, external reporting delays or errors, legal claims, or damage to our business reputation. We also could experience an inability to keep pace with technological advances, resulting in our information technology platforms becoming obsolete or our competitors developing related or similar service offerings more effective than ours.

Item 1A, Risk Factors, 10-K Feb 24, 2026open_in_new

… The rapid evolution and adoption of artificial intelligence(AI) and any efforts we may make to incorporate it into our business may amplify cyber, legal, and operational risks. AI adoption may introduce or amplify risks, including inaccurate or biased outputs …

New this year Item 1A, Risk Factors, 10-K Feb 24, 2026open_in_new

… If we fail to assess and identify cybersecurity threats associated with acquisitions and new initiatives, we may become increasingly vulnerable to such threats. Additionally, while we have implemented measures to prevent security breaches and cyber incidents, like many companies we …

Marked against last year's 10-K

We use information technology and operational technology assets, including computer and information networks, networks and artificial intelligence technologies and services in substantially all aspects of our business operations. We also use mobile devices, social networking and other online activities to connect with our employees employees, customers and our customers. vendors. Such uses give rise to cybersecurity risks, including security breach, espionage, system disruption, theft and inadvertent release of information. Our business involves the storage and transmission of numerous classes of sensitive and/or confidential information and intellectual property, including customers’ personal information, private information about employees and financial and strategic information about us and our business partners. We also rely on a Payment Card Industry compliant third party to protect our customers’ credit card information. In connection with our strategy to grow through acquisitions and to pursue new initiatives that improve our operations and cost structure, we are also expanding and improving our information technologies, resulting in a larger technological presence and corresponding exposure to cybersecurity risk. If we fail to assess and identify cybersecurity threats associated with acquisitions and new initiatives, we may become increasingly vulnerable to such threats. Additionally, while we have implemented measures to prevent security breaches and cyber incidents, like many companies we have periodically experienced cyber incidents, and our preventive measures and incident response efforts may not be entirely effective. Also, the regulatory environment surrounding information security and privacy is increasingly demanding, with the frequent imposition of new and constantly changing requirements. This changing regulatory landscape may cause increasingly complex compliance challenges, which may increase our compliance costs. Any failure to comply with these changing security and privacy laws and regulations could result in significant penalties, fines, legal challenges and reputational harm. The theft, destruction, loss, misappropriation, or release of sensitive and/or confidential information or intellectual property, or interference with our information technology systems or the technology systems of third parties on which we rely, could result in business disruption, negative publicity, brand damage, violation of privacy laws, loss of customers, potential liability and competitive disadvantage.

Item 1A, Risk Factors, 10-K Feb 18, 2026open_in_new

• the negative impact that a significant cyber-security incident could have on our business and our relationships with our employees, customers and vendors; and

Marked against last year's 10-K

• the negative impact that a significant cyber-security incident could have on our business and our relationships with our employees, customers and employees; vendors; and

Item 1A, Risk Factors, 10-K Feb 18, 2026open_in_new

… Like most multinational corporations, our information technology systems and data have been subject to computer viruses, malicious codes, unauthorized access and other cyber-attacks and we expect the sophistication and frequency of such attacks to continue to increase. Unauthorized tampering …

Marked against last year's 10-K

We rely on information technology systems, some of which are provided and/or managed by third parties, to process, transmit and store electronic information (including sensitive data such as confidential business information and personal data relating to employees, customers and other business partners), and to manage or support a variety of critical business processes and activities (such as receiving and fulfilling orders, billing, collecting and making payments, shipping products, providing services and support to customers and fulfilling contractual obligations). In addition, some of our remote monitoring products and services incorporate software and information technology that house personal data and some products or software we sell to customers connect to our systems for maintenance or other purposes. These systems, products and services (including those we acquire through business acquisitions) can be damaged, disrupted or shut down due to attacks by computer hackers, computer viruses, ransomware, human error or malfeasance (including by employees), power outages, hardware failures, telecommunication or utility failures, catastrophes or other unforeseen events, and in any such circumstances our system redundancy and other disaster recovery planning may be ineffective or inadequate. Attacks can also target hardware, software and information installed, stored or transmitted in our products after such products have been purchased and incorporated into third-party products, facilities or infrastructure. Security breaches of systems provided or enabled by us, regardless of whether the breach is attributable to a vulnerability in our products or services, or security breaches of third-party suppliers we rely on to process, store or transmit electronic information, can result in the misappropriation, destruction or unauthorized disclosure of confidential information or personal data belonging to us or to our employees, partners, customers or suppliers. Like most multinational corporations, our information technology systems and data have been subject to computer viruses, malicious codes, unauthorized access and other cyber-attacks and we expect the sophistication and frequency of such attacks to continue to increase. Unauthorized tampering, adulteration or interference with our products may also adversely affect product functionality and result in loss of data, risk to customer safety and product recalls or field actions. The attacks, breaches, misappropriations and other disruptions and damage described above can interrupt our operations or the operations of our customers and partners, delay production and shipments, result in theft of our and our customers’ intellectual property and trade secrets, result in disclosure of personal data, damage customer, business partner and employee relationships and our reputation and result in defective products or services, legal claims and proceedings, liability and penalties under privacy and other laws and increased costs for security and remediation, in each case resulting in an adverse effect on our business and financial statements. Our liability insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches.

Item 1A, Risk Factors, 10-K Feb 20, 2026open_in_new

The legal and regulatory landscape surrounding AI technologies is rapidly evolving and uncertain, including in the areas of intellectual property, cybersecurity and privacy and data protection. Compliance with new or changing laws, regulations or industry standards relating to AI may …

New this year Item 1A, Risk Factors, 10-K Feb 20, 2026open_in_new

… Our information systems are susceptible to outages due to system failures, cybersecurity threats, failures on the part of third-party information system providers, natural disasters, power loss, telecommunications failures, viruses, fraud, theft, malicious actors or breaches of security. Like many …

Marked against last year's 10-K

In the ordinary course of business, we utilize information systems for day-to-day operations, to collect and store sensitive data and information, including our proprietary and regulated business information and personally identifiable information of our customers, suppliers and business partners, as well as personally identifiable information about our employees. Our information systems are susceptible to outages due to system failures, cybersecurity threats, failures on the part of third-party information system providers, natural disasters, power loss, telecommunications failures, viruses, fraud, theft, malicious actors or breaches of security. Like many companies, we, and some third parties upon which we rely, have experienced cybersecurity incidents and attacks on information technology networks and systems, products and services in the past but, to date, none have resulted in a material breach or had a material adverse impact on our financial condition, results of operations, or cash flows. We may experience such incidents and attacks in the future, potentially with increasing frequency from increasingly sophisticated cyber threats. In addition, remote work and remote access to our systems have increased in recent years, which may heighten these risks. Use of artificial intelligence software may also create risks from unintentional disclosure of proprietary, confidential, personal or otherwise sensitive information. Although we have a response plan in place in the event of a data breach and we have an active program to maintain and improve data security and address these risks and uncertainties by implementing and improving internal controls, security technologies, insurance programs, network and data center resiliency and recovery processes, a successful attack in the future could result in operations failure or breach of security that could lead to disruptions of our business activities and the loss or disclosure of both our and our customers’ financial, product and other confidential information and could result in regulatory actions, significant expense and litigation and have a material adverse effect on our financial condition, results of operations and cash flows and our reputation.

Item 1A, Risk Factors, 10-K Feb 10, 2026open_in_new

A team of senior executives prioritizes identified risks, including decarbonization, new technologies and cyber threats among others, and assigns an executive to address each major identified risk area and lead action plans to manage risks. Our Board of Directors provides …

Word for word as last year Item 7, MD&A, 10-K Feb 10, 2026open_in_new

Information systems failure or disruption, due to cyber terrorism or other actions, may adversely impact our business and result in financial loss to the Company or liability to our customers.

Word for word as last year Item 1A, Risk Factors, 10-K Feb 17, 2026open_in_new

… If any of these systems fail, whether caused by fire, other natural disaster, power or telecommunications failure, acts of cyber terrorism, war, ransomware, misuse or malicious use of artificial intelligence (“AI”) or otherwise, or they do not function correctly, we …

Marked against last year's 10-K

Our business is highly dependent on financial, accounting and other data-processing systems and other communications and information systems, including our enterprise resource planning tools. We process a large number of transactions on a daily basis and rely upon the proper functioning of computer systems. If any of these systems fail, whether caused by fire, other natural disaster, power or telecommunications failure, acts of cyber terrorism, war, ransomware ransomware, misuse or malicious use of artificial intelligence (“AI”) or otherwise, or they do not function correctly, we could suffer financial loss, business disruption, liability to our customers, regulatory intervention or damage to our reputation. If our systems are unable to accommodate an increasing volume of transactions, our ability to grow could be limited. Although we have backup systems, procedures and capabilities in place, they may also fail or be inadequate. Further, to the extent that we may have customer information in our databases or access to customer systems through connected devices, any unauthorized disclosure of, or access to, such information, databases or systems could result in an adverse impact to us or our customer including claims under data protection laws and regulations. If any of these risks materialize, our reputation and our ability to conduct our business may be materially adversely affected.

Item 1A, Risk Factors, 10-K Feb 17, 2026open_in_new

If the Company is unable to protect its information technology infrastructure against service interruptions, data corruption, cyber-based attacks or network security breaches, or if there is a violation of data privacy laws, there could be a negative impact on operating results or the Company may suffer financial or reputational damage.

Word for word as last year Item 1A, Risk Factors, 10-K Feb 13, 2026open_in_new

In addition, cybersecurity laws and regulations continue to evolve, and are increasingly demanding, both in the U.S. and globally, which adds compliance complexity and may increase costs of compliance and expose the Company to reputational damage or litigation, monetary damages, regulatory enforcement actions or fines in one or more jurisdictions.

Word for word as last year Item 1A, Risk Factors, 10-K Feb 13, 2026open_in_new

• our policies and procedures that are designed to identify, assess, and manage material risks arising from cybersecurity incidents and AI technologies;

Marked against last year's 10-K

• our policies and procedures that are designed to identify, assess, and manage material risks arising from cybersecurity incidents; incidents and AI technologies;

Item 7, MD&A, 10-K Feb 12, 2026open_in_new

The Company has assigned responsibility for Board oversight of cybersecurity risk to the Audit Committee, which monitors the cybersecurity risk management and cyber control functions, including external security audits, and receives periodic updates from the CISO and other experienced senior …

New this year 10-K, 10-K Feb 12, 2026open_in_new

… by planned upgrades, force majeure, telecommunications failures, criminal acts, including hardware or software break-ins, ransomware attacks or extortion attempts, or viruses, or other cybersecurity incidents) and we suffer any resulting interruption in our ability to manage and operate our …

Word for word as last year Item 1A, Risk Factors, 10-K Nov 10, 2026open_in_new

The risks in this area continue to grow, and we expect cyber events will continue to accelerate in frequency and impact as threat actors increasingly use AI and other techniques to circumvent security controls, evade detection and remove forensic evidence.

Word for word as last year Item 1A, Risk Factors, 10-K Nov 10, 2026open_in_new

… In addition, human error or negligence or accidental technological failure could make us vulnerable to information technology system disruptions and/or cyber-attacks, including the introduction of malicious computer viruses or code into systems, phishing attacks, ransomware attacks, or other …

Marked against last year's 10-K

Information availability and security risks for online commerce companies have significantly increased in recent years because of, in addition to other factors, the proliferation of new technologies, the use of the internet and telecommunications technologies to conduct financial transactions, and the increased sophistication and activities of organized crime, hackers, terrorists, and other external parties. These threats may derive from fraud or malice on the part of third parties or current or former employees. In addition, human error or negligence or accidental technological failure could make us vulnerable to information technology system disruptions and/or cyber-attacks, including the introduction of malicious computer viruses or code into our system, systems, phishing attacks, ransomware attacks, or other cyber security incidents. breaches or incidents suffered by ourselves or those processing data or performing services for us. For example, in March 2023, one of our immaterial subsidiaries suffered a ransomware attack. Although the impacted subsidiary successfully maintained its operations during this event and the attack did not affect the rest of our business, future cyber-attacks could result in material adverse impacts to our business and our consolidated results of operations.

Item 1A, Risk Factors, 10-K Sep 29, 2026open_in_new

Information technology system disruptions, cyber-attacks, ransomware attacks, or other security breaches or incidents could materially and adversely affect our reputation, operating results, or financial condition by, among other things, making our auction platform inoperable or with reduced functionality for …

Marked against last year's 10-K

Information technology system disruptions, cyber-attacks, ransomware attacks, or other cyber security breaches or incidents could materially and adversely affect our reputation, operating results, or financial condition by, among other things, making our auction platform inoperable or with reduced functionality for a period of time, damaging data loss, corruption, or unavailability, unauthorized access to or use of the systems or networks used in our business and operations, and unauthorized, accidental, or unlawful access to, or disclosure, modification, misuse, loss, unavailability, destruction, or other unauthorized processing of our or our customers’ information. Any of these, or the belief or perception they have occurred, may damage our reputation with buyers, sellers, and insurance companies as a result of the unauthorized disclosure of confidential information (including account data information), result in harm to our market position and our ability to retain customers and attract new customers, result in claims, demands, and litigation by private parties or resulting in governmental actors, governmental investigations, litigation, liability, fines, and other actions and proceedings, fines or penalties against us. If such attacks penalties, severe reputational damage adversely affecting customer or investor confidence and causing damage to our brand, indemnity obligations, disruption to our operations, damages for contract breach, and other liabilities. We and our service providers may face difficulties or delays in detecting and responding to any actual or perceived incident, and if any cyber-attacks or breaches or incidents are not detected immediately, their effect effects could be compounded. While we maintain insurance coverage that may, subject to policy terms and conditions, cover certain aspects of these cyber risks, an insurer may deny or exclude from coverage certain types of claims or our insurance coverage may be insufficient to cover all losses and would not remedy damage to our reputation.

Item 1A, Risk Factors, 10-K Sep 29, 2026open_in_new

… Cybersecurity incidents and similar attacks vary in their form and can include the deployment of harmful malware or ransomware, denial-of-services attacks, and other attacks, which may affect business continuity and threaten the availability, confidentiality and integrity of our …

Word for word as last year Item 1A, Risk Factors, 10-K Dec 17, 2025open_in_new

Increased information technology threats and cybersecurity incidents and threats could pose a risk to our systems, networks, products, solutions and services and those of our business partners.

Word for word as last year Item 1A, Risk Factors, 10-K Dec 17, 2025open_in_new

Fraudulent or unpermitted data access and other cyber-security or privacy breaches may negatively impact our business and harm our reputation.

Word for word as last year Item 1A, Risk Factors, 10-K Feb 18, 2026open_in_new

… As with other global companies, our systems are regularly subject to cyber-attacks, cyber-threats, attempts at fraudulent access, physical break-ins, computer viruses, attacks by hackers and similar disruptive problems. As cyber-threats continue to evolve, we are required …

Word for word as last year Item 1A, Risk Factors, 10-K Feb 18, 2026open_in_new

We face cyber-security and data protection risks relating to cyber-attacks and information technology failures that could cause loss of confidential information and other business disruptions.

Word for word as last year Item 1A, Risk Factors, 10-K Feb 13, 2026open_in_new

We also provide technological products integral to train operation. Accordingly, our business may be adversely impacted by disruptions to our own or third-party information technology infrastructure, which could result from cybersecurity incidents, including, but not limited to, unauthorized access to the Company’s information technology systems, data access or acquisition, and/or encryption of the Company’s environment.

Word for word as last year Item 1A, Risk Factors, 10-K Feb 13, 2026open_in_new

Our customers, including governmental agencies, are increasingly requiring cybersecurity protections and mandating cybersecurity standards, which may result in additional operating or production costs. Our cybersecurity program aligns with well-known industry-wide security control frameworks. Despite these efforts, cybersecurity incidents …

Marked against last year's 10-K

Eaton’s Our customers, including governmental agencies, are increasingly requiring cybersecurity protections and mandating cybersecurity standards standards, which may result in additional operating or production costs. Our cybersecurity program aligns with well-known industry-wide security control frameworks. Despite these efforts, cybersecurity incidents could potentially result in the misappropriation, destruction, corruption or unavailability of critical data and confidential or proprietary information and the disruption of business operations. The potential consequences of a material cybersecurity incident include theft of intellectual property, disruption of operations, reputational damage, adverse health and safety consequences, the loss or misuse of confidential information, product failure, as well as exposure to fines, legal claims or enforcement actions.

Item 1A, Risk Factors, 10-K Feb 26, 2026open_in_new

… Because of this, cybersecurity threats pose a material risk to our business operations.

Marked against last year's 10-K

Eaton relies on information technology networks and systems, including the Internet, to process, transmit and store electronic information, and to manage or support a variety of business processes and activities, including procurement, manufacturing, distribution, invoicing and collection. Some of this information may be stored in the cloud or on networks not managed by Eaton. us. Additionally, many of our products and services include, and we utilize and rely on on, third-party service-providers service-providers, whose products include integrated software and information technology that collects data or connects to external and internal systems. Because of this, cybersecurity threats pose a material risk to our business operations.

Item 1A, Risk Factors, 10-K Feb 26, 2026open_in_new

• Failure of information technology systems, cybersecurity breaches, cyber threats, malware, phishing attacks, break-ins and similar events resulting in unauthorized disclosure of confidential information or disruptions or damage to information technology systems that could cause interruptions to our operations or adversely affect our internal control over financial reporting.

Word for word as last year Item 7, MD&A, 10-K Feb 12, 2026open_in_new

… AI‑enabled systems may also increase the Company’s exposure to cybersecurity, data privacy, and intellectual property risks.

New this year Item 1A, Risk Factors, 10-K Feb 12, 2026open_in_new

… We also face cybersecurity risks due to our reliance on internet technology and hybrid work arrangements, which could strain our technology resources or create additional opportunities for cybercriminals to exploit vulnerabilities. Cyber threats are constantly evolving, especially given the advances …

Marked against last year's 10-K

We depend on the security of our information technology systems, and those of our third-party vendors’ information technology systems vendors, to support numerous business processes and activities, including our online ordering system. There are numerous cybersecurity risks applicable to these systems, including individual and group criminal hackers, industrial espionage, man-in-the-middle and denial of service attacks, viruses, malicious software (malware), employee error or malfeasance and phishing attacks. We also face cybersecurity risks due to our reliance on internet technology and hybrid work arrangements, which could strain our technology resources or create additional opportunities for cybercriminals to exploit vulnerabilities. Cyber threats are constantly evolving, especially given the advances in, and the rise of the use of, artificial intelligence, thereby increasing the difficulty of preventing, detecting and successfully defending against them. Successful breaches could, among other things, disrupt our operations, jeopardize the security of information stored in or transmitted by the sites, networks and systems, which include cloud-based networks and data center storage, or result in the unauthorized access, disclosure, theft and misuse of company, customer, and employee sensitive and confidential information. If this were to occur, we could be in violation of applicable privacy, data security and other laws, subjected to regulatory enforcement actions and private litigation, and our reputation and financial performance may be adversely affected.

Item 1A, Risk Factors, 10-K Jan 28, 2026open_in_new

Our financial performance and our reputation could be adversely affected, and we could be subject to legal liability or regulatory enforcement actions, if we are unable to protect against, or effectively respond to, cyberattacks or other cyber incidents.

Word for word as last year Item 1A, Risk Factors, 10-K Jan 28, 2026open_in_new

Cyber Attacks and Other Disruptions or Misuse of Information Systems We Rely Upon Could Affect Our Ability to Conduct Our Business Effectively.

Word for word as last year Item 1A, Risk Factors, 10-K Feb 17, 2026open_in_new

… Despite our security measures as well as those of our business partners and third-party service providers, the information systems we rely upon may be vulnerable to interruption or damage from cyber attacks, computer viruses, worms or other destructive or …

Marked against last year's 10-K

Our information systems and those of our business partners are important to our business activities. We also outsource various information systems, including data management, to third-party service providers. Despite our security measures as well as those of our business partners and third-party service providers, the information systems we rely upon may be vulnerable to interruption or damage from cyber attacks, computer viruses, worms or other destructive or disruptive software, process breakdowns, denial of service attacks, malicious social engineering or other malicious activities, or any combination thereof. Further, as AI technologies advance, new and increasingly sophisticated attack methods are emerging, including fraud involving impersonation technologies or other forms of generative AI that enhance the scale, frequency, and effectiveness of cyber threats. Attempts have been made to attack our information systems, but we do not believe that material harm has resulted. While we have implemented controls and taken other preventative actions to strengthen these systems against future attacks, we can give no assurance that these controls and preventative actions will be effective. Any breach of data security could result in a disruption of our services or improper disclosure of personal data or confidential information, which could harm our reputation, require us to expend resources to remedy such a security breach or defend against further attacks or subject us to liability under laws that protect personal data, resulting in increased operating costs or loss of revenue.

Item 1A, Risk Factors, 10-K Feb 17, 2026open_in_new

… Additionally, the Company collects and stores certain data, including proprietary business information, and has access to confidential or personal information in certain of our businesses that is subject to artificial intelligence, privacy and cybersecurity laws, regulations, and customer-imposed controls …

Marked against last year's 10-K

In the ordinary course of business, the Company relies on centralized and local information technology networks and systems, some of which are provided, hosted, or managed by vendors and other third parties, to process, transmit, and store electronic information, and to manage or support a variety of businesses. Additionally, the Company collects and stores certain data, including proprietary business information, and has access to confidential or personal information in certain of our businesses that is subject to artificial intelligence, privacy and cybersecurity laws, regulations, and customer-imposed controls. Third parties and threat actors, including organized criminals, nation-state entities, and/or nation-state supported actors, regularly attempt to gain unauthorized access to the Company’s information and operational technology networks and infrastructure, data, and other information, and many such attempts are becoming increasingly sophisticated. Despite our cybersecurity and business continuity counter measures (including employee and third-party training, monitoring of networks and systems, patching, maintenance, and backup of systems and data), the Company’s information and operational technology systems, networks and infrastructure have experienced and are expected to experience cyberattacks of various degrees of sophistication, and are susceptible to insider threat, compromise, damage, disruption, or shutdown, including as a result of the exploitation of known or unknown hardware or software vulnerabilities, or zero day attacks, in our systems or the systems of our vendors and third-party service providers, the introduction of computer viruses, malware or ransomware, service or cloud provider disruptions or security breaches, phishing attempts, employee error or malfeasance, power outages, telecommunication or utility failures, systems failures, natural disasters, or other catastrophic events. The Company’s increased adoption of remote working, initially driven by the COVID-19 health pandemic, also introduces additional threats and risk of disruptions to our information technology systems, networks and infrastructure. Despite the Company's cybersecurity counter measures, it is possible for security vulnerabilities or a cyberattack to remain undetected for an extended time, up to and including several months, and the prioritization of decisions with respect to security measures and remediation of known vulnerabilities that we and the vendors and other third parties upon which we rely make may prove inadequate to protect against these attacks. While we and third parties we utilize have experienced, and expect to continue to experience, cybersecurity incidents that could lead to other disruptions of the Company’s and the third parties' information and operational technology systems and infrastructure, we do not believe that any such cybersecurity incidents to date have had a material impact on the Company. Any cybersecurity incident or information or operational technology network disruption could result in numerous negative consequences, including the risk of: legal claims or proceedings, investigations or enforcement actions by U.S., state, or foreign regulators; liabilities or penalties under applicable laws and regulations, including privacy laws and regulations in the U.S. and other jurisdictions; interference with the Company’s operations; the incurrence of remediation costs; loss of intellectual property protection; the loss of customer, supplier, or employee relationships; and damage to the Company’s reputation, any of which could have a material adverse effect the Company’s business. Although the Company maintains insurance coverage for various cybersecurity and business continuity risks, there can be no guarantee that all costs, damages, expenses or losses incurred will be fully insured nor reimbursed through insurance recoveries.

Item 1A, Risk Factors, 10-K Feb 3, 2026open_in_new

… Network disruptions, security and data breaches, cyberattacks, and other cybersecurity incidents involving the Company’s information technology systems, networks and infrastructure could: disrupt or interfere with the Company’s operations; result in the compromise and misappropriation of proprietary and confidential …

Marked against last year's 10-K

* The Company employs information including operational technology systems to support its business and to collect, store, and/or use proprietary and confidential information, including ongoing phased implementation of an enterprise resource planning (ERP) system as part of its business transformation on a worldwide basis over the next several years. Network disruptions, security and data breaches, cyberattacks, and other cybersecurity incidents involving the Company’s information technology systems, networks and infrastructure could could: disrupt or interfere with the Company’s operations; result in the compromise and misappropriation of proprietary and confidential information belonging to the Company or its customers, suppliers, and employees; and expose the Company to numerous expenses, liabilities, and other negative consequences, any or all of which could have a material adverse effect on the Company’s business, reputation, and results of operations.

Item 1A, Risk Factors, 10-K Feb 3, 2026open_in_new

… reliance on internet technology and use of hybrid work arrangements, which could strain our technology resources or create additional opportunity for cyber-attackers to exploit vulnerabilities. Moreover, the rapid evolution and adoption of artificial intelligence may increase our cybersecurity risks.

Marked against last year's 10-K

We rely on information technology systems, some of which are managed by third-parties, to process, transmit and store electronic information (including sensitive data such as confidential business information and personally identifiable data relating to employees, customers, other business partners and patients), and to monitor, manage, and support a variety of critical business processes and activities including receiving and fulfilling orders, billing, collecting and making payments, shipping products, providing services and support to customers and fulfilling contractual obligations. Despite our implementation of certain controls to protect our systems and sensitive, confidential or personal data or information, these systems, products, data and services may be damaged, compromised, disrupted or shut down due to attacks by computer hackers, computer viruses, ransomware, misuse of artificial intelligence, human error or malfeasance, power outages, hardware failures, telecommunication or utility failures, catastrophes or other unforeseen events. In any such circumstances, our system redundancy and other disaster recovery planning may be ineffective or inadequate. Further, we also face information security risks due to our reliance on internet technology and use of hybrid work arrangements, which could strain our technology resources or create additional opportunity for cyber-attackers to exploit vulnerabilities. Moreover, the rapid evolution and adoption of artificial intelligence may increase our cybersecurity risks.

Item 1A, Risk Factors, 10-K Feb 17, 2026open_in_new

… result in us being required to disclose information about a material cybersecurity incident before it has been mitigated or resolved, or even fully investigated. Although we maintain cyber risk insurance, damages and claims arising from such incidents may not be …

Word for word as last year Item 1A, Risk Factors, 10-K Feb 17, 2026open_in_new

Information Technology, Cybersecurity and AI. The Company relies on information technology systems and networks, some of which are managed by third parties, to process, transmit and store electronic information, and to manage or support a variety of its business processes …

Marked against last year's 10-K

Information Technology Technology, Cybersecurity and Cybersecurity. AI. The Company relies on information technology systems and networks, some of which are managed by third parties, to process, transmit and store electronic information, and to manage or support a variety of its business processes and activities. Some of the Company’s products include telematics which provide over-the-air software updates, advanced fleet management tools and real-time data analytics on driver and vehicle performance. These computer systems and networks may be subject to disruptions during the process of upgrading or replacing software, databases or components; power outages; hardware failures; computer viruses/malware; or outside parties attempting to disrupt the Company’s business or gain unauthorized access to the Company’s electronic data. The Company maintains a cybersecurity insurance policy and continues to invest in protections to guard against such events. Despite these safeguards, there remains a risk of system disruptions, unauthorized access and data loss.

Item 1A, Risk Factors, 10-K Feb 18, 2026open_in_new

The Company maintains a cybersecurity insurance policy and continues to invest in protections to guard against such events. Despite these safeguards, there remains a risk of system disruptions, unauthorized access and data loss. If the Company’s computer systems were …

Marked against last year's 10-K

The Company maintains a cybersecurity insurance policy and continues to invest in protections to guard against such events. Despite these safeguards, there remains a risk of system disruptions, unauthorized access and data loss. If the Company’s computer systems were to be damaged, disrupted or breached, it could impact data availability and integrity, result in a theft of the Company’s intellectual property or lead to unauthorized disclosure of confidential information of the Company’s customers, suppliers and employees. Security breaches could also result in a violation of U.S. and international privacy and other laws and subject the Company to various litigations and governmental proceedings. These events could have an adverse impact on the Company’s results of operations and financial condition, damage its reputation, disrupt operations and negatively impact competitiveness in the marketplace.

Item 1A, Risk Factors, 10-K Feb 18, 2026open_in_new

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.

Not mentioned in the latest 10-K.