Compare peers

… However, because technology is increasingly complex and cyber-attacks are increasingly sophisticated and more frequent, there can be no assurance that such incidents will not have a material adverse effect on us in the future. In addition, the rapid evolution …

… As information security laws and regulations change and cyber risks evolve, we may be required to make significant capital investments and other expenditures to comply with new legal requirements, investigate security incidents, remedy cybersecurity issues, recuperate lost data, prevent future …

Our information systems and records, including those we maintain with third-party service providers, may be subject to cyber-attacks and information security breaches. We have experienced a sophisticated criminal cybersecurity attack in the past and in the future we …

… Non-compliance by us, or potentially by third parties with which we share information, with any applicable privacy and cybersecurity law or regulation or a cyber breach, including accidental loss,

While we maintain cybersecurity insurance to assist in the cost of recovery from a significant cyber event, such coverage may not be sufficient to cover any losses resulting from such incidents. A cybersecurity incident also could require that we expend significant additional resources on remediation, restoration, and enhancement of our information technology and other systems.

By way of example, in September 2023, we experienced a cybersecurity issue affecting certain of our systems, in which criminal actors may have accessed certain personal information of some of our customers (the “Cybersecurity Issue”). Among other things, this issue …

For more information about our cybersecurity risk management, governance and oversight, see “Item 1C: Cybersecurity.”

For more information about our cybersecurity risk management, governance and oversight, see “It em 1C: Cybersecurity.”

Refer to Item 1C. Cybersecurity of this Annual Report on Form 10-K for further information on the Company’s risk management, strategy and governance over cybersecurity matters.

We face risks related to cybersecurity for both our infrastructure and products and any cybersecurity breach or failure of one or more key information technology systems, or those of third-parties with which we do business could have a material adverse impact on our business or reputation.

We are subject to cybersecurity attacks. These attacks can vary in scope and intent from attacks with the objective of compromising our systems, networks, and communications for economic gain or with the objective of disrupting, disabling or otherwise compromising our …

We are exposed to cybersecurity attacks and data breaches and the risks and costs associated with protecting our systems and maintaining data integrity and security.

Computer system disruption and cyber security threats, including a personal data or security breach, could damage our relationships with our customers, harm our reputation, expose us to litigation and adversely affect our business.

… Despite the security measures we have in place, including those described in Item 1C “Cybersecurity”, the possibility of a successful cyber-attack on any one or all of these systems is a serious threat. The retail industry, in particular, has …

Cybersecurity or information security breaches and other disruptions could compromise our information, result in the unauthorized disclosure of confidential guest, employee, Company, and/or business partner information, damage our reputation, and expose us to liability, which could negatively impact our business.

… Issues that might pose a reputational risk include failure of our cybersecurity measures to protect against cybersecurity incidents; product liability and product recalls; inaccurate claims regarding the sustainability or content/ingredients of the products sold in our stores, including in …

The current cyber threat environment presents increased risk for all companies, including companies in our industry. The cybersecurity risks we face include cyber-attacks involving ransomware and malicious software, advanced persistent threats, social engineering, credential stuffing or distributed denial-of …

Any cybersecurity incident, including the failure to protect the integrity or availability of IT systems or the security of Confidential Information, or the introduction of malware or ransomware, could materially affect our business, financial results and/or our growth prospects and result in substantial costs, litigation, reputational harm and a loss of consumer confidence.

• denial-of-service attacks, security incidents (through cyber-attacks and other malicious actions, including ransomware and social-engineering attacks);

We have been the target of attempted cyber-attacks and other security threats, and we may be subject to breaches of our information technology systems. While we engage in significant cybersecurity and data-protection efforts, criminal activity (such as cyberattacks …

We continue to encounter attempted external attacks in a variety of forms, including ransomware, account takeovers, phishing, disinformation, and denial of service attacks. Additionally, some actors are using AI technology to launch more sophisticated, automated, targeted and coordinated attacks, including phishing and account takeover attacks, that are more

Cybersecurity & IP Vulnerabilities: Increased attack surface and potential leakage of sensitive customer data or proprietary technology during integration or partnership, damaging trust and incurring costs;

… do so as the result of a cyber-attack, misconduct or error by an AutoZoner, job applicant, customer, vendor or third party, system vulnerabilities or compromises, fraud, hacking, phishing attempts, malware, ransomware, other malicious codes or other intentional or unintentional …

critical infrastructure outages, facility damage, physical theft, telecommunications failures, malware, security incidents, malicious cyber-attacks, including the use of malicious codes, worms, phishing, spyware, denial of service attacks and ransomware, natural disasters and catastrophic events, inadequate or ineffective redundancy measures …

… Additionally, if a cybersecurity incident is determined to be material, we are subject to additional reporting requirements. We cannot provide assurances that a cyber incident, including data theft or other significant systems or security failures will not occur in the …

… We use various encryption, tokenization and authentication technologies to mitigate cybersecurity risks and have increased our monitoring capabilities to enhance early detection and rapid response to potential cyber threats. However, because the techniques used to obtain unauthorized access, disable or …

We and our service providers face a variety of cybersecurity threats and risks or inadvertent or intentional data breaches and security events. Cybersecurity threats can take a variety of forms, including malicious software programs, including ransomware, that attack our networks …

• Increasing levels of regulation in the areas of privacy, protection of user data and cybersecurity could harm our business.

… Additionally, cybersecurity threats continue to become more sophisticated, including AI-enabled attacks and deepfake technology. Incidents may include unauthorized access, phishing attacks, account takeovers, denial of service, computer viruses, deepfakes and other malicious uses of artificial intelligence, introduction of malware …

… While we maintain insurance coverage designed to address certain aspects of cybersecurity risks, such insurance coverage may be insufficient to cover all losses or all types of claims that may arise.

Unauthorized access, theft, or destruction of data or any breach, ransomware attack or other incident affecting our systems - whether through external attacks or internal methods - could result in reputational harm, loss of customers, business disruption, regulatory investigations, litigation (including class …

Emerging technologies, including artificial intelligence and machine learning, may not deliver expected efficiencies and could introduce new risks, such as those related to cybersecurity, data privacy, inaccuracies, hallucinations, bias or discrimination and intellectual property infringement, which may become more pronounced as the Company’s reliance on such technologies increases.

The occurrence of cyber incidents, or a deficiency in cybersecurity, could negatively impact our business by causing a disruption to our operations, a compromise or corruption of confidential information, or damage to our employee and business relationships, any of which could subject us to loss and harm our brand.

The primary risks that could directly result from the occurrence of a cyber incident include operational interruption, damage to our relationships with customers, franchisees and employees, private data exposure, including payment card or other financial data, publicity impact and regulatory …

… These attempts include use of malware, ransomware, phishing, vishing, deepfakes, social engineering, denial-of-service attacks, exploitation of system vulnerabilities or misconfigurations, Associate or third-party malfeasance, digital and physical payment card skimmers, account takeovers and other forms of cyber …

We maintain policies, procedures and controls designed to reduce the risks of cybersecurity compromises and IT failures or disruptions, but these controls vary in maturity across the business and may fail to operate as intended or be circumvented by bad …

… The information that we receive and store makes us subject to cybersecurity attacks and cyber incidents, which are occurring more frequently, are constantly evolving in nature, are becoming more sophisticated, and are being made by groups and individuals with a …

Technology, Data Security, Cybersecurity, Business Continuity, and Disaster Recovery Risks

We have experienced targeted and organized malware, phishing, and account takeover attacks, and may in the future experience these and other forms of attack such as ransomware, SQL injection (where a third party attempts to insert malicious input in order …

… Some of these regulations give consumers a private right of action against companies for certain alleged violations of cybersecurity requirements. Non-compliance with these laws could result in damage to our reputation, significant penalties, or other liability. If laws or …

• Operational information systems, security systems, products, and services could be affected by cybersecurity incidents, ransomware attacks, and other disruptions and impact Ford, Ford Credit, their suppliers, and dealers;

Operational information systems, security systems, products, and services could be affected by cybersecurity incidents, ransomware attacks, and other disruptions and impact Ford, Ford Credit, their suppliers, and dealers. We rely on information technology networks and information systems, including in-vehicle …

From time to time we and our third-party service providers experience cyber-attacks, attempted and actual breaches of our or their information technology systems and networks or similar events, which could result in a loss of sensitive business or …

• Failures in, material damage to or interruptions in our information technology systems, software or websites, including as a result of cyber-attacks on our systems or systems operated by third parties that provide operational and technical services to us, costs …

… infrastructure outages; facility damage; physical theft; telecommunications failures; malware; security incidents; cyber-attacks, including the use of malicious codes, worms, phishing, spyware, denial of service attacks, and ransomware; natural disasters and catastrophic events; inadequate or ineffective redundancy measures; and misconduct …

… These systems are subject to failure, damage, or interruption, including power outages, telecommunications failures, computer viruses, cyber-attacks, security breaches, or other catastrophic events. If these systems are damaged or fail to function properly, we may experience loss of critical …

Risks related to our intellectual property, cybersecurity, information technology, and data management practices

… are vulnerable to intrusions, damage, disruptions, or shutdowns caused by attacks by hackers, computer viruses or worms, malware (including “ransomware”), phishing attacks, spyware, denial of service attacks, and/or breaches due to errors, negligence or malfeasance by employees, contractors, vendors …

… Cybersecurity"), our facilities and systems and those of our third-party service providers may be vulnerable to targeted or random attacks that could lead to security breaches, acts of vandalism, phishing attacks, denial-of-service attacks, computer viruses, malware, ransomware …

… These risks include heightened data privacy, cybersecurity, and data protection risks, as the use of AI may involve processing sensitive data and, in some cases, sharing data with third-party providers. Such use may increase the risk of unauthorized access …

… While we maintain information technology measures designed to protect us against intellectual property theft, data breaches, sabotage and other external or internal cyber-attacks or misappropriation, our systems and those of our service providers are potentially vulnerable to malware, ransomware …

Our information technology systems or data, or those of our service providers or customers or users could be subject to cyber-attacks or other security incidents, which could result in data breaches, intellectual property theft, claims, litigation, regulatory investigations, significant liability, reputational damage and other adverse consequences.

We have been and may continue to be impacted by cybersecurity incidents and data privacy breaches, which occur from time to time. These malicious attacks can vary in scope and aim to disrupt or compromise our shoreside and shipboard operations …

e. Cybersecurity incidents and data privacy breaches, as well as disruptions and other damages to our principal and other offices, information technology operations and system networks and failure to keep pace with developments in technology may adversely impact our business operations, the satisfaction of our guests and crew and may lead to fines, penalties and reputational damage.

rules for public companies, requiring the mandatory disclosure of material cybersecurity incidents and the Federal Trade Commission and the New York Department of Financial Services have both also increased incident reporting and expanded cybersecurity program requirements. Any failure or perceived …

… Although we consider cybersecurity protection and system stability to be an important piece of our business, strategy, and management, we have in the past and may in the future experience potentially significant interruptions to our systems. Interruptions in these systems …

We are subject to an evolving cybersecurity, privacy, and AI regulatory environment, and failure to comply with new or existing requirements, including federal cybersecurity incident disclosure obligations, could result in regulatory enforcement and further financial or reputational harm. Emerging laws …

… not limited to those related to safety, employment, discrimination, harassment, whistle-blowing, privacy, corporate citizenship, improper business practices, or cybersecurity. Certain activities on the part of stakeholders, including nongovernmental organizations and governmental institutions, could cause reputational damage, distract senior management …

… Moreover, these IT systems, like those of most companies, are subject to the possibility of computer viruses or other malicious codes, and to security breaches, cyber incidents, ransomware attacks or phishing-attacks. Cyber intrusion efforts are becoming increasingly frequent and …

… A significant theft, loss or fraudulent use of the personally identifiable information we or third parties maintain, or of our data, by cyber-criminals or otherwise could adversely impact our reputation and could result in significant costs, fines and litigation …

In the event of a data security breach of our systems and/or third-party systems or a cybersecurity incident, we may incur costs associated with the following: response, notification, forensics, regulatory investigations, public relations, consultants, credit identity monitoring, credit …

… We experience cybersecurity threats and incidents of varying degrees on our systems and networks and, as a result, unauthorized parties have obtained in the past, and may in the future, obtain access to our computer systems and networks, including cloud …

Cybercriminals (including state-sponsored actors) may attempt to penetrate our information systems, including supply chain and logistics systems, to deprive us from access to necessary business information and to disrupt our operations, as part of so-called “ransomware” extortion activity …

Information or data security breaches, including cyberattacks on our transaction processing and computer information systems (including malware intrusion, data exfiltration, identity theft, and other types of cybersecurity threats), could disrupt our operations, result in theft or unauthorized disclosure of our …

To date, we have not experienced a material breach of cybersecurity; however, our computer systems and the computer systems of our third-party service providers have been, and will likely continue to be, subjected to unauthorized access or phishing attempts, computer viruses, malware, ransomware or other malicious codes.

• disruptions to our global technology infrastructure, including through cyberattacks, ransom attacks or cyber-intrusion;

… The steps we take may not be sufficient to prevent future significant cybersecurity incidents, and as a result, such incidents may occur again. Although we carry cyber insurance that is designed to protect us against certain losses related to cyber …

Additional cybersecurity incidents could have adverse effects on our business. We have enhanced our security measures to safeguard our information systems and data, and we intend to continue implementing additional measures in the future, but, as we have seen in …

… vulnerable to security breaches, acts of vandalism, phishing attacks, computer viruses, worms, ransomware, malicious software programs, misplaced or lost data, programming or human errors and other events. Cyber-attacks are becoming increasingly more difficult to anticipate, prevent and detect due …

… As a result, we face cybersecurity risks including cyber and physical security breaches, system failure, phishing attacks, computer viruses, worms, ransomware, malicious software programs and negligent or intentional misuse by customers, company employees, or employees of our third-party information …

Moreover, as we develop, deploy and integrate AI, including internally developed and third-party AI tools, into our operations, digital platforms and business processes, we may face increased cybersecurity, privacy, data governance, operational and compliance risks, including risks related to …

… The failure of these systems to operate effectively, including due to security breaches, viruses, threat actors, malware, ransomware, denial of service

… In particular, the frequency, severity and novelty of cyber-attacks on companies has increased significantly in recent years, including significant ransomware attacks and foreign attacks on prominent companies and computer software programs, as threat actors become increasingly sophisticated and employ …

While to our knowledge we have not experienced a significant cybersecurity incident that has materially affected our business strategy, results of operations or financial condition in the last three years, and we are frequently working to improve our information technology …

… Cyber-attacks could include the deployment of harmful malware and key loggers, ransomware, a denial-of-service attack, a malicious website, artificial intelligence, the use of social engineering and other means to affect the confidentiality, integrity and availability of our …

… These systems are subject to damage or interruption from power outages, computer and telecommunications failures, computer viruses, malware and other cybersecurity attacks and breaches, catastrophic events such as hurricanes, fires, floods, earthquakes, tornadoes, acts of war or terrorism and usage …

… of our components and finished goods, regulatory and trade restrictions, tariff policy changes and trade disputes, data protection and cybersecurity laws, economic factors, geopolitical events, security issues, or other factors negatively impacting China-based sellers and suppliers could adversely affect …

… For example, in order to meet local ownership, regulatory licensing, and cybersecurity requirements, we provide

… The rapid evolution and increased adoption of artificial intelligence technologies may also heighten our cybersecurity risks by making cyber-attacks more difficult to detect, contain, and mitigate.

Cybersecurity incidents affecting our electronic and other confidential information could expose us to liability and materially adversely affect our financial condition and results of operations.

… accidents, power disruptions, telecommunications failures, acts of terrorism or war, computer viruses, physical or electronic break-ins, and ransomware or other cybersecurity incidents. Failures or disruptions of our internal operations, our systems, the systems of our supply chain partners, or …

… Although we maintain cyber insurance coverage that, subject to policy terms and conditions and significant self-insured retentions, is designed to address certain aspects of cyber risks, such insurance coverage may be insufficient to cover all losses or all types …