Compare peers

Advancements in artificial intelligence and large language models may increase cybersecurity threats and operational risks. Threat actors may use artificial intelligence to enhance their attacks, increasing the frequency, sophistication and potential impact of cyber incidents affecting our IT and OT environment.

While the Company maintains insurance relating to cybersecurity events, such insurance is subject to a number of exclusions and may be insufficient to offset any losses, costs or damages experienced. Also, the market for cybersecurity insurance is relatively new and coverage available for cybersecurity events is evolving as the industry matures.

… Cyber attacks may include hacking, viruses, malware, denial of service attacks, ransomware, exploited vulnerabilities or other security incidents, including loss of data and communications and business disruption. Cyber threats in general, and in particular, to critical infrastructure, are increasing in …

The Companies have experienced cybersecurity incidents and attacks in the past and expect to experience them in the future. The Companies have not experienced any cybersecurity incidents in the last three years that have materially affected the business strategy, results …

… Technological complexities combined with advanced cyber-attack or security breach techniques, lack of cybersecurity hygiene and human error can result in a cybersecurity incident, such as a ransomware attack. Supplier non-compliance with cybersecurity controls can also result in a …

The legal and regulatory environment surrounding cybersecurity and privacy is increasingly demanding. As cyber-attacks or security breaches are becoming more sophisticated, critical infrastructure assets, including pipelines and electric infrastructure, may be specifically targeted. In November 2024, the TSA issued …

The sophistication of cybersecurity threats, including those leveraging AI, continues to increase, and the controls and preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems, including the regular testing of our cybersecurity incident response …

… The risk of a disruption or breach of our operational technology systems, or the compromise of the data processed in connection with our operations, through a cybersecurity breach or ransomware attack, has increased as attempted attacks have advanced in sophistication …

… Increasingly sophisticated cyber-attacks, ransomware, and other security breaches - whether targeting us or third parties with whom we do business - could disrupt operations, compromise confidential information, and result in significant financial, legal, and reputational harm. Cybersecurity threats, including those that …

• The risks associated with physical attacks, such as acts of war, terrorism, sabotage or other acts of violence, and cyber-attacks and other disruptions to our, or our vendors’, information technology system, which may compromise our operations, and data security breaches of sensitive data, intellectual property and proprietary or personally identifiable information;

… These attacks and disruptions, both physical and cyber, are becoming increasingly sophisticated and dynamic. Security incidents such as ransomware attacks are becoming increasingly prevalent and severe, as well as increasingly difficult to detect. In addition, geopolitical issues, to include conflicts …

Our acquisition of Calpine in January 2026 introduces expanded cybersecurity and physical security risks. As part of the integration, we have and expect to continue to evolve our systems, processes, and technical controls in connection with Calpine's information technology and operational technology. Our acquisition of Calpine and the visibility of the transaction will likely increase attention from potential cyber threat actors, potential insider threats, and opportunistic adversaries.

… that such attacks and disruptions, both physical and cyber, are highly sophisticated and dynamic. Several U.S. Government agencies have highlighted the increasing risks related to physical and cybersecurity attacks, including ransomware attacks, related to the electric sector, including its …

… SCE's current security controls and defenses may also not protect against insider threats, including deliberate and unintentional actions (e.g., human error) and other emerging cybersecurity risks created by artificial intelligence, quantum computing, cyber skills shortages, and regulatory constraints.

… Coverage for cybersecurity events continues to evolve as the industry matures. In the future, adequate insurance may not be available at rates that we believe are reasonable, and the costs of responding to and recovering from a cyber incident may …

We develop and maintain systems and processes aimed at detecting and preventing information and cybersecurity incidents which require significant investment, maintenance, and ongoing monitoring and updating as technologies and regulatory requirements change. These systems and processes may be insufficient to mitigate the possibility of cybersecurity incidents, malicious social engineering, fraudulent or other malicious activities, and human error or malfeasance in the safeguarding of our data.

Our operations are subject to acts of sabotage, terrorism, cyber attacks, and other disruptive acts.

• potential adverse effects of a natural disaster, acts of sabotage or terrorism, including a cyber attack, or any accident leading to a radiological release.

… government agencies have warned that the energy sector and its supply chains are subject to increasing risks of physical attacks, ransomware attacks and cybersecurity threats, and that the risks may escalate during periods of heightened geopolitical tensions. In addition, the …

• Catastrophic events such as extreme weather, fires, earthquakes, explosions, hurricanes, tornadoes, winter storms, terrorism (including cyber-terrorism), floods or other similar occurrences.

… the technological and financial aspects of decommissioning nuclear plants at the end of their licensed lives; and the threat of a terrorist attack or cyber incident and other potential liabilities arising out of the ownership or operation of nuclear facilities.

The Duke Energy Registrants are subject to standards enacted by the North American Electric Reliability Corporation and enforced by FERC regarding protection of the physical and cybersecurity of critical infrastructure assets required for operating North America's bulk electric system …

• Cyber terrorism and cybersecurity risks, data breaches or the occurrence of a catastrophic loss and the possibility that NRG may not have sufficient insurance to cover losses resulting from such hazards or the inability of NRG's insurers to provide coverage;

… International conflict increases the risk of state-sponsored or ideologically motivated cyber threats and escalated use of cybercriminal and cyber-espionage activities. In particular, the current geopolitical climate has further escalated cybersecurity risk, with various government agencies, including the U …

We take precautions to protect our infrastructure, but we have been, and will likely continue to be, subject to attempts at phishing and other cybersecurity intrusions. International conflict increases the risk of state-sponsored cyber threats and escalated use of …

• The operation of our businesses is subject to information security and operational technology risks, including cybersecurity breaches and failure of critical information and operations technology systems. Attacks on our infrastructure that breach cyber/data security measures could expose us to significant liabilities, reputational damage, regulatory action, and disrupt business operations, which could have a material adverse effect on us.

We have been subject to attempted cyber attacks from time to time, and will likely continue to be subject to such attempted attacks; however, these prior attacks have not had a material impact on our system or business operations. All …

… A successful physical or cybersecurity intrusion may occur despite our security measures or those we require of our vendors, including compliance with reliability and critical infrastructure protection standards. Successful cybersecurity intrusions, including those targeting the electronic control systems used at …

Threats of cyber incidents, physical security, and terrorism could affect the Registrants' business. Issues may threaten the Registrants such as cyber incidents, physical security, or terrorism that may disrupt the Registrants' operations, and could harm the Registrants' operating results.

… All of the Registrants' technology systems are vulnerable to disability or failures due to cyber incidents, physical security threats, acts of war or terrorism, and other causes, as well as loss of operational control of the Registrants' electric generation and …

• attacks by third parties, including cyber-attacks, acts of terrorism, vandalism, or war. For more information, see “The Utility’s operational networks and information technology systems could be impacted by a cyber incident, cybersecurity breach, physical attack, or technology failure” below.

The Utility’s operational networks and information technology systems could be impacted by a cyber incident, cybersecurity breach, physical attack, or technology failure.

• a deterioration in our ability to ensure business continuity, including increased cybersecurity attacks related to a work-from-home environment;

… To date, cyber breaches have not had a material impact on our operations or financial results. We continue to assess potential threats and vulnerabilities and make investments to address them, including global monitoring of networks and systems, identifying and implementing …

… with mandatory reporting measures, designate a cybersecurity coordinator, provide vulnerability assessments, and ensure compliance with certain cybersecurity requirements. Such directives or other requirements may require expenditure of significant additional resources to respond to cyber-attacks, to continue to modify or …

Cyber-attacks or acts of cyber-terrorism could disrupt our business operations and information technology systems or result in the loss or exposure of confidential or sensitive customer, employee or Company information.

A successful cyber attack through third-party or insider action on the systems that control the Companies’ electric generation, electric transmission, electric distribution or gas distribution assets could severely disrupt business operations, preventing the Companies from serving customers or collecting …

Hostile cyber intrusions could severely impair the Companies’ operations, lead to the disclosure of confidential information, damage the reputation of the Companies and otherwise have an adverse effect on the Companies’ business. The Companies own assets deemed as critical infrastructure …

… cybersecurity situational awareness. The FERC, through the North American Electric Reliability Corporation (NERC), requires certain safeguards to be implemented to deter cyberattacks. These safeguards may not always be effective due to the evolving nature of cyberattacks. We maintain cyber insurance …

… cybersecurity events, such as software defects, misconfigurations, system integration failures and problematic third-party software or firmware updates that can cause widespread outages or disruptions even in the absence of a deliberate attack. A successful cyberattack or other significant cyber …

… government agencies have warned that the energy sector and its supply chains are subject to increasing risks of physical attacks, ransomware attacks and cybersecurity threats, and that the risks may escalate during periods of heightened geopolitical tensions. In addition, the …

The Registrants are subject to physical security and cybersecurity risks (All Registrants).

… Due to the evolving nature of cyber attacks and cybersecurity, our current safeguards to protect our operating systems and information technology assets may not always be effective. We rely on third parties for software to protect against cyber attacks and …

… In some cases, we outsource administration of certain functions to vendors that have been or could be targets of cyber attacks. Any theft, loss and/or fraudulent use of customer, shareowner, employee or proprietary data as a result of a …

… Cyber attacks, which include the use of malware, ransomware, computer viruses, and other means for disruption or unauthorized access against companies, including CMS Energy and Consumers, are increasing in frequency, scope, and potential impact. While CMS Energy and Consumers have …

CMS Energy and Consumers are subject to risks that are beyond their control, including but not limited to natural disasters, civil unrest, terrorist attacks and related acts of war, cyber incidents, vandalism, and other catastrophic events.

… The electric utility industry, both within the United States and internationally, has experienced physical and cybersecurity attacks on energy infrastructure such as power plants, substations and related assets in the past, and there will likely be more attacks in the …

Physical and cybersecurity breaches, criminal activity, terrorist attacks, acts of war and other disruptions to facilities or technology infrastructure could interfere with operations, expose the Evergy Companies or their customers or employees to a risk of loss, expose the Evergy Companies to legal or regulatory liability and cause reputational and other harm.

… Occurrences affecting these operations that may or may not be beyond the control of subsidiaries of NEE, including FPL, (such as geopolitical factors, cyber incidents, physical attacks, severe weather or a generation or transmission asset outage, pipeline rupture, or sudden …

… The use of and reliance on AI may present certain risks such as, but not limited to, AI tools may malfunction, produce inaccurate or biased outputs, or behave unpredictably, and introduce NEE and FPL to additional cybersecurity threats and data …