Compare peers

While we maintain cybersecurity insurance, our coverage may be insufficient to cover all liabilities resulting from a cybersecurity incident. We cannot be certain that our insurance coverage will be adequate to address the results of regulatory or civil investigations or …

… The increasing sophistication and resources of cyber criminals and other non-state threat actors and increased actions by nation-state actors make it difficult to keep up with new threats and could result in a breach of security.

a security impact (including the deployment of harmful malware, ransomware, denial-of-service attacks, social engineering,

cyber intrusions could also be employed against our various stakeholders or other third parties, including attempts to

… As cyber-attacks or other information or security breaches continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any cybersecurity vulnerabilities or cyber …

… In addition, cybersecurity risks have significantly increased in recent years in part due to the increased sophistication and activities of cyber threat actors, such as organized crime affiliates, terrorist organizations, state-sponsored actors, hostile foreign governments, disgruntled employees or vendors …

… For example, rapid changes in the sophistication and use of certain types of cyber-attacks, such as ransomware and social engineering attacks, as well as other cyber incidents impacting our insureds, have increased the frequency and severity of losses under …

Like other global companies, our computer systems and networks are regularly subject to and will continue to be the target of computer viruses, malware or other malicious codes (including ransomware), unauthorized access, cyber-attacks or other computer-related penetrations. The …

telecommunications failure, computer viruses, ransomware or other cybersecurity incidents, technology failures, software or

attacks to achieve their aims and goals, which may include espionage, information operations, monetary gain, ransomware,

attacks (including digital or telephonic impersonation), computer viruses, ransomware, malware, malicious or destructive code, employee or insider error, malfeasance, social engineering, physical breaches or other actions. It is possible that our preventive, detective, containment or remedial security controls, employee training and other aspects of our cybersecurity safeguards are not effective.

… Despite ongoing efforts to improve our and our vendors’ ability to protect and defend against cyber-attacks, we may not be able to protect all of our data. From time to time, cybersecurity incidents and data breaches of certain systems …

… While to date we have not experienced cyber incidents that are individually, or in the aggregate, material, we and certain of our third-party service providers have experienced cyber attacks of varying degrees in the past.

Our role in the global marketplace places us at greater risk than other public companies for a cyber attack and other cyber-security risks. Our technology, our customers, our people and our third-party service providers are vulnerable to cyber …

… cyber incidents. While we have a third party risk management program, because we do not control our third party service providers or their downstream service providers and our ability to monitor their cybersecurity is limited, we cannot ensure the cybersecurity …

For information on our cybersecurity risk management and governance practices, please see Item 1C. Cybersecurity of this report.

Although we believe that we have appropriate information security procedures and controls designed to prevent or limit the effects of a cybersecurity or other similar incident, our technologies, systems, networks and our customers’ devices may be the target of cybersecurity …

… Additionally, the federal banking regulators, as well as the SEC and related self-regulatory organizations, regularly issue guidance regarding cybersecurity that is intended to enhance cyber risk management among financial institutions.

… including malware and computer virus attacks, ransomware, unauthorized access, business e-mail compromise, misuse, denial-of-service attacks, system failures and other disruptions. We maintain insurance to cover operational risks, such as cyber risk and technology outages, but it may …

… physical or electronic break-ins or unauthorized tampering, as well as cybersecurity threats such as “denial of service” attacks, phishing, automated attacks, and other disruptive attacks, including ransomware. Cyber threats are constantly evolving and the techniques used in these attacks …

In particular, we, like other financial services firms, will continue to face increasing cyber-threats, including computer viruses, malicious code, distributed denial of service attacks, phishing attacks, ransomware, hacker attacks, limited availability of services, unauthorized access, information security breaches or …

… to such cyber-attacks or for our systems to recover in a manner that does not disrupt our ability to provide services to our clients. The failure to maintain an adequate technology infrastructure and applications with effective cybersecurity controls could …

Furthermore, as a global financial services company, Visa is increasingly subject to complex, varied, and rapidly evolving cybersecurity regulations and cyber incident reporting requirements across numerous jurisdictions. For example, governments around the world have recently passed or are considering new …

• inadequate data security, cybersecurity or operational resilience posture of our acquired entities, joint ventures or companies we invest in or partner with, which may lead to increased risk of system failures, service disruptions or cyber incidents or attacks;

… or cause other damage; ransomware; denial of service attacks; data breaches; social engineering attacks; phishing attacks; and other events. There can be no assurance that such unauthorized access, mishandling or misuse of information, or cybersecurity incidents will not occur in …

We continue to make investments with a view toward maintaining and enhancing our cybersecurity, resilience and information security posture, including investments in technology and associated technology risk management activities. The cost of managing cybersecurity and information security risks and attacks, along with complying with new, increasingly expansive and evolving regulatory requirements, could adversely affect our results of operations and business.

… financial services providers, the Company continues to be targeted with evolving and adaptive cyber threats from sophisticated third parties. Although the Company is not aware of any material losses relating to cybersecurity incidents, there can be no assurance that unauthorized …

… be the subject of attempted unauthorized access, denial-of-service attacks, computer viruses, hacking, malware, ransomware, phishing or other forms of social engineering, and cyber attacks designed to obtain confidential information, destroy data, disrupt or degrade service, eliminate access or …

… a significant increase in information security and cybersecurity risk in recent years and will likely continue to be the target of increasingly sophisticated cyberattacks, including computer viruses, malicious or destructive code, ransomware, social engineering attacks (including phishing, impersonation and identity …

For additional information regarding cybersecurity risk management & strategy and cybersecurity governance, including information regarding our technology risk and information security program, see Part I, Item 1C. “Cybersecurity.”

… These threats include cyber-attacks such as computer viruses, denial-of-service attacks, malicious code (including ransomware), social-engineering attacks (including phishing attacks) or information security breaches and could lead to the misappropriation or loss of consumer account and other …

We are subject to increasingly complex, fragmented, overlapping and/or divergent laws and regulations related to privacy and data protection, data use and governance, AI and information security (including with respect to cybersecurity and cyber-risk) in the jurisdictions in …

… increasing number of cybersecurity threats and cyberattacks and, accordingly, the Corporation devotes considerable resources to the establishment and maintenance of processes for assessing, identifying and managing cybersecurity risk through its global workforce and 24/7 cyber operations centers. The Corporation …

… In accordance with the Corporation’s cyber incident response framework, GIS, including its incident response team, tracks, documents, responds to and analyzes cybersecurity threats and cybersecurity incidents, including those experienced by the Corporation’s third-party service providers that may …

… For additional information regarding our cybersecurity and information security risks, see “Item 1A. Risk Factors - Cyberattacks and security vulnerabilities could result in serious harm to our reputation, business, and financial condition” and “Item 1C. Cybersecurity.”

Any cybersecurity incidents, including cyberattacks or data security breaches affecting the IT or infrastructure of our customers, partners, or vendors (including data center and cloud computing providers) or of companies we acquire, could have similar negative effects.

Security incidents and cyber-attacks may originate from a wide variety of sources, and while we have implemented processes, procedures and internal controls designed to mitigate cybersecurity risks and cyber-attacks, these measures do not guarantee that a security incident …

… While we perform risk assessments on our third-party providers, our reliance on them and their potential reliance on other third-party service providers removes certain cybersecurity functions from outside of our immediate control, and cyber-attacks on our third …

A cyber-attack or a failure to implement effective information and cybersecurity policies, procedures and capabilities could disrupt operations and lead to financial losses and reputational harm, which may cause BlackRock’s AUM, revenue and earnings to decline.

… An information security incident or disruption, such as a cyber-attack including social engineering, deepfakes, phishing scams, business email compromise, malware, denial-of-service or ransomware attacks, or failures to control access to sensitive systems, could materially interrupt business operations …

… sensitive information, could be subject to cyber-attacks or other information security incidents, such as, among other things, from physical and electronic break-ins or unauthorized tampering, theft, malware and computer virus attacks, ransomware attacks, social engineering attacks (including phishing …

… Additional information regarding the manner in which cyber risk is managed can be found in Item 1C, “Cybersecurity.”

• The cyber threats we and our third-party service providers (including our vendors, data partners and distribution partners) face are rapidly evolving and are becoming increasingly sophisticated and include denial of service attacks, ransomware, spyware, misinformation, phishing/smishing/vishing attacks, business compromise attacks,

Our size, scale and role in the global markets increases our exposure to cyber attacks and other cyber-security risks. Our information systems and networks and those of our third-party service providers are exposed to risks related to cybersecurity and protection of confidential information, including material non-public information, which could have a material adverse effect on our business, financial condition or results of operations.

… are vulnerable to an increasing threat of continually evolving cybersecurity risks. We regularly experience cyberattacks and are the target of computer viruses, hackers, distributed denial of service attacks, malware infections, ransomware attacks, phishing and spear-phishing campaigns, and other external …

… privacy regulators) of such cybersecurity incidents or attacks. During an incident, we may need to disconnect systems or suspend certain services, and there can be delays before full scope and impact are understood. Our cyber insurance coverage may be unavailable …

… our physical security, cybersecurity, or by employee or third party theft and hold surety bonds as required for compliance with certain of our licenses under applicable state laws. Our ability to maintain crime, specie, and cyber insurance, as well as …

• cybersecurity incidents, employee or service provider misconduct, or other unforeseen activities cause losses to us or our customers, including losses to assets held by us on behalf of our customers;

appropriate. Our cybersecurity leaders hold memberships and/or positions within the Financial Services Information Sharing and Analysis Center, or FS-ISAC, and the cross-sector Analysis and Resiliency Center, or ARC, in the U.S., the Financial Sector Cyber Collaboration Centre, or FSCCC, in the U.K., and similar organizations across the Europe, Middle East and Africa, or EMEA, and Asia-Pacific, or APAC regions.

… For a discussion of our cyber risks, see " - Item 1- "Business - Cybersecurity". Our systems and those of our third-party service providers are vulnerable to cyberattacks, hacking and other cybersecurity risks, which could result in wrongful manipulation, disclosure, destruction, or …

… As Gen AI technologies continue to advance, threat actors will develop increasingly sophisticated methods as well as technology and tools to facilitate the commission of cyber-attacks and develop new cyber-crime business models such as Ransomware-as-a-Service …

… Cyber-attacks targeting Moody’s or Moody’s vendors’ technology and systems, whether from circumvention of security systems, exploitation of security vulnerabilities, denial-of-service attacks, ransomware, malware, hacking, social engineering or "phishing" attacks, deepfake attacks, computer viruses, employee or …

We constantly defend against threats to our data and systems, including malware, ransomware and computer virus attacks, unauthorized access, system failures and disruptions. Events like these may jeopardize the information processed and stored in, and transmitted through, computer systems and …

The failure of cyber or other information security controls, could result in a loss or disclosure of confidential information, damage to our reputation, additional costs and impair our ability to conduct business effectively

Our systems have been, and will likely continue to be, subject to viruses or other malicious code, unauthorized access, cyber-attacks (such as ransomware and denial of service), cyber frauds or other computer related penetrations. The frequency and sophistication of …

Cyber risk exposure exists through stand-alone cyber policies as well as cyber coverage endorsements on some property, general liability, management liability and directors and officers policies. Increasing frequency of cyber attacks and the evolving nature of cyber risk taking …

… Additionally, nation states may deploy threat actors masquerading as potential candidates for hire at target companies to perform corporate espionage or execute internal cyber threat activities. Despite our efforts to comply with applicable cybersecurity requirements and mitigate risks of cybersecurity …

We have experienced data incidents and cybersecurity breaches, such as malware incursions (including computer viruses and ransomware), vulnerabilities in the software on which we rely, users exceeding their data access authorization, employee misconduct and incidents resulting from human error, such …

• Cyber-attacks involving the encryption and/or threat to disclose personal or confidential information (i.e., ransomware) or disruptions of communications (i.e., denial of service) for the purposes of, among other things, extortion or other motives persist and are on the rise.

… Cybersecurity” for additional information about cybersecurity risk management and governance. Risks related to cyber-attack arise in various areas, including:

… other malicious codes, unauthorized access, cyber-attacks, cyber frauds, ransomware or other unauthorized occurrences, on or conducted through our information systems, which jeopardize the confidentiality, integrity or availability of our information or information systems. Cybersecurity threats are rapidly evolving and …

While frequency and severity trends are being managed through long-standing underwriting strategies, the potential catastrophe risk that aggregation of cyber exposures presents to insurers is unique and unprecedented. In contrast with natural catastrophe risks, catastrophic cyber event scenarios are …

Although CNA maintains cybersecurity insurance coverage insuring against costs resulting from cyber attacks, CNA does not expect the amount available under its coverage policy to cover all potential losses from cyber-attacks. In addition, potential disputes with its insurers about …

… whom we and they do business, may increase our and their exposure to risks of cyber attacks and other cyber incidents. As the cybersecurity threat landscape continues to evolve, we and our subsidiaries may be required to expend significant capital …

Other cyber attacks and data security breaches are not focused on gaining access to credit card or user credential information, but instead seek access to a range of other types of confidential information, such as internal emails and other forms …

… As a result, efforts by bad actors to engage in various types of cyber attacks and breaches, including by way of computer viruses, hacking, ransomware and other malware, denial of service attacks, credential staffing, phishing, social engineering, account takeovers, insider …

• Cyber-attacks or other security breaches could have a material adverse effect on our business.

Cyber-attacks or other security breaches could have a material adverse effect on our business.

… our systems or our partners’ systems, or if we, our third-party developers or vendors suffer a cyber-attack, including a ransomware or advanced persistent threat attack, or if any of the foregoing is reported or perceived to have occurred …

… outages, cyber-attacks and security breaches and incidents, human error, earthquakes, hurricanes, floods, pandemics, fires, other natural disasters, power losses, disruptions in telecommunications services, fraud, military or political conflicts, terrorist attacks and other geopolitical unrest, computer viruses, ransomware, and other …

… in some cases have been subject to, damage or interruption from a variety of external threats, including cybersecurity incidents, such as advanced ransomware, credential compromises, vulnerability exploitation including zero-day exploits, distributed denial of service attacks, hardware misconfigurations, phishing and …

Cybersecurity and Privacy Risks - The failure to effectively maintain and modernize our technology systems and infrastructure and integrate those of acquired businesses could adversely affect our business.”

Fifth Third and its service providers are exposed to cybersecurity risks, including risk of cyber-attacks and other information security breaches, which create both operational and reputational risk for the Bank and its customers across all lines of business.

… prevent a cyber-attack, a successful cyber-attack could persist for an extended period before being detected and, following detection, it could take considerable time for Fifth Third to obtain full and reliable information about the cybersecurity incident and the …

… access, or to carry out ransomware or cyber-attacks, as well as human errors and other breaches or incidents affecting our cybersecurity and information security systems. Globally, the frequency, severity and sophistication of cybersecurity incidents have increased, and these trends …

We, our vendors, our reinsurers, and our customers may suffer disasters such as a natural catastrophe, epidemic, pandemic, industrial accident, blackout, telecommunications or other infrastructure failure, computer virus, terrorist attack, ransomware or cyber-attack, or war, and our or their …

the cessation of service by any service provider as a result of systems failures, cybersecurity or data privacy incidents (including, but not limited to, ransomware), capacity constraints, financial difficulties, or for any other reason could disrupt our operations, impact our ability to offer certain products and services, and result in contractual or regulatory penalties, liability claims from clients, or employees, damage to our reputation, and harm to our business.

… All information technology systems are potentially vulnerable to damage or interruption from a variety of sources, including but not limited to cyber-attacks, malicious or destructive code, ransomware, social engineering attacks, generative artificial intelligence and deepfake attacks, denial of service …

… Attacks on our systems could also involve ransomware or other forms of cyber extortion. Cyberattacks and other data security threats could originate from a wide variety of external sources, including cyber criminals, nation state hackers, hacktivists and other outside parties …

… In light of the focus of federal regulators on cybersecurity, SEC enforcement and examination activity has increased in recent years and may increase further. Although we maintain cybersecurity controls designed to prevent cyber incidents from occurring, no security is impenetrable …

• the effect of legislative initiatives or proposals, statutory changes, governmental or applicable regulations and/or changes in industry requirements, including privacy, data protection, cybersecurity, cyber resilience and AI laws and regulations;

Constantly evolving global privacy, data protection, cybersecurity, cyber resilience, and AI laws and regulations require the Company to adopt new business practices, update contractual provisions in existing and new contracts, and constantly update our global Privacy and Data Protection Program and our global Information Security Program, which may require transitional and incremental expenses and may impact our future operating results.

… banking agencies and the SEC have adopted or proposed enhanced cybersecurity risk management rules and/or standards that could apply to us and that address cybersecurity risk governance and management, management of internal and external dependencies, and incident response, cyber …

• The data security, cybersecurity and operational resilience posture of the acquired entities, joint ventures or companies we invest in or partner with, may not be adequate and may be more susceptible to a system failure, service disruption or cybersecurity incident or attack; and

… cyber-attacks and other security incidents, such as phishing scams or other social engineering attacks, deepfake attacks, hacking, tampering, intrusions, viruses, malware (including ransomware) and denial-of-service attacks - all of which could be exacerbated by AI technologies. Cybersecurity risks …

• Our exposure to security incidents including cyber-attacks or failures of our plans, systems, networks or procedures;

… 1C - Cybersecurity” of this Form 10-K, despite our implementation of protective measures and endeavoring to modify them as circumstances warrant, our computer systems, software and networks may be vulnerable to human error, natural disasters, power loss, cyber-attacks and …

… We also face increased cybersecurity risk related to mobile and cloud solutions or related to new and emerging technologies such as AI. We seek to continuously monitor for and nimbly react to any and all such malicious cyber activity, and …

… While we require our critical third-party suppliers to implement and maintain what we believe to be effective cybersecurity and data protection measures, we cannot guarantee that third parties and infrastructure in our supply chain or our partners’ supply chains …

… and international state privacy, cybersecurity and AI laws and regulations; as well as by the Financial Stability Oversight Council and similar non-U.S. regulators; the Federal Reserve; the SEC; FINRA; the CFTC; the NFA; the U.S. Department of …

… Federal Trade Commission (“FTC”) have adopted or proposed enhanced cyber and privacy security standards that apply to us and our financial institution clients and address privacy requirements for processing data of individuals, cyber risk governance and management, management of internal …

Legislative or regulatory initiatives on cybersecurity and data privacy could adversely impact our business and financial results.

… may also increase or intensify potential cybersecurity risks. We are dependent upon our information technology platform, including our processing systems, data and electronic transmissions in our business operations. Security breaches and other cyber threats, including those at third parties that …

Despite these safeguards, a significant cyber incident, including system failure, security breach and disruption by malware or other damage could interrupt or delay our operations and possibly our results. This type of incident may result in a violation of applicable …

• We could be the target of a cyber-attack or experience a cybersecurity incident that impairs internal systems, degrades services we provide to customers, or results in a data compromise, causing reputational or monetary damages as a consequence.

We could be the target of a cyber-attack or experience a cybersecurity incident that impairs internal systems, degrades services we provide to customers, or results in a data compromise, causing reputational or monetary damages as a consequence.

Our size, scale and role in the financial markets increase our exposure to cyber-attacks and other cybersecurity risks. We and the third-party service providers we rely on for certain critical functions are subject to system failures, security breaches …

Unauthorized access to confidential data including client data, other cyber-attacks, and the failure of our cybersecurity systems and procedures

… Cybersecurity breaches, including physical or electronic break-ins, computer viruses, malware, attacks by hackers, ransomware attacks, phishing attacks, supply chain attacks, breaches due to employee error or misconduct and other similar breaches can create system disruptions, shutdowns or unauthorized access …

• claims relating to unanticipated consequences of current or new technologies, including cyber security related risks;

For more information regarding our cybersecurity risk management practices and governance, see Item 1C in this report.

We are subject to a variety of cybersecurity risks that, if realized, could adversely affect how we conduct our business.

As previously disclosed, the Company identified an incident involving unauthorized access to a limited number of its systems in the U.S. on June 12, 2025. The Company promptly initiated its cybersecurity incident response protocols and believes it contained the unauthorized access within hours. The Company's systems were not affected by ransomware, and the Company remained able to serve its policyholders and underwrite policies, review claims, and otherwise service customers as usual.

… The rapid evolution and increased adoption of artificial intelligence technologies may also heighten the Company's cybersecurity risks by making cyber-attacks more difficult to detect, contain, and mitigate.

• Regulations promulgated from time-to-time to mitigate cybersecurity and information, technology and communication (ICT) risks, including regulations that could require asset managers and certain types of investment funds to adopt and implement procedures that are reasonably designed to address …

In recent years, several financial services firms suffered cyber-attacks launched both domestically and from abroad, resulting in the disruption of services to clients, loss or misappropriation of confidential data, litigation and regulatory enforcement actions and reputational harm. Cyber security …

… We are continually subject to attempts by unauthorized parties to access confidential information or to destroy data, often through the introduction of computer viruses, ransomware or malware, and cyber-attacks. The increasing sophistication of frontier artificial intelligence models is reshaping …

… Cybersecurity incidents, which, among other things, may result in unauthorized access to systems, service interruptions, malicious intrusions, exfiltration of data, ransomware, cyber-attacks, or operating failures, have become more sophisticated and more prevalent, have occurred in our systems in the …

… In addition, should we be subject to a cybersecurity event or data breach, or the target of cyber criminals who seek to defraud our clients, our reputation could be harmed and we could suffer financial loss. Any damage to our …

… and cybersecurity policies, procedures and technology-based capabilities we maintain to protect our systems and data. An externally caused data security incident, such as a cyberattack, social engineering attacks (including phishing, impersonation and identity takeover attempts), virus, ransomware attack, denial …

… Cybersecurity breaches of any of the systems we rely on may result from circumvention of security systems, denial-of-service attacks or other cyber-attacks, software bugs, malicious or destructive code, hacking, social engineering attacks (including “phishing” attacks, business email …

… We have from time to time experienced cybersecurity incidents, such as malware infections, phishing campaigns, ransomware and vulnerability exploit attempts, which to date have not had a material impact on our business.

… these areas that we believe will protect us from cybersecurity risks, which may not be effective. While we also maintain cyber liability insurance to mitigate the financial risk around cyber incidents, such insurance may not cover all costs associated with …

• difficulties with technology, data or network security breaches, including cyber attacks;

… coverage for cybersecurity incidents, we can provide no assurance that any of these measures or coverage will prove adequate or effective, or comply with evolving information security standards, particularly given the expanding nature and sophistication of cyber and technology threats …

We may be adversely affected if any of our third-party providers is subject to a successful cyber or security attack.

Our operational systems and networks (as well as those of our franchise advisors and third parties) are subject to evolving cybersecurity or other technological risks, which could result in the disclosure of confidential information, loss of our proprietary information, damage to our reputation, additional costs to us, regulatory penalties and other adverse impacts.

On a corporate basis, various laws and regulations, and in some cases contractual obligations, require us to establish and maintain corporate policies and technical and operational measures designed to protect sensitive client, employee, contractor and vendor information, and to respond to cybersecurity incidents in certain ways and timeframes. We have established policies and implemented

… cyber threats. Our systems and those of third-party vendors may become vulnerable to damage or disruption due to circumstances beyond our or their control, such as from catastrophic events, power anomalies or outages, natural disasters, network failures, viruses, ransomware …

Reinsurance protection for cyber coverage is also through a separate treaty. We offer cyber insurance as an affirmative coverage option on various insurance policies written on a direct basis and subsequently cede all of the related cyber insurance premiums to a reinsurer, therefore transferring substantially all of that risk.

… cyber criminals, and face various cybersecurity risks, resulting in unauthorized access, theft of funds, extortion, disruption or degradation of service or other damage. These attacks may take a variety of forms, including web application attacks, denial of service attacks, ransomware …

Risks relating to computer cyber-terrorism, crisis on a national or global scale, climate change or other catastrophic events

The federal banking regulators, as well as the SEC, CFPB, CFTC, and related self-regulatory organizations, regularly issue guidance on cybersecurity that is intended to enhance cyber risk management among financial institutions and provide timely information to investors. A financial …

… Similarly, the Office of the Superintendent of Financial Institutions in Canada requires Federally Regulated Financial Institutions to report qualifying technology and cybersecurity incidents under the provisions of the August 13, 2021 Technology and Cyber Security Incident Reporting Advisory.

… Cybersecurity for additional information regarding information security risk, including cybersecurity risk management.

Given the high volume of transactions that we process, the large number of clients, counterparties, and third-party service providers with which we do business, including cloud service providers, and the increasing sophistication of cyber attacks, a cyber attack could …

… Like those of many large businesses, certain of our information systems have been subject to cyber threats, including computer viruses, malicious codes, unauthorized access, phishing efforts, denial-of-service attacks and other cyber-attacks. We expect continued exposure to such …

… Political, economic, social or financial market instability or damage to or interference with our operating assets, customers or suppliers from cyber-attacks may result in business interruptions, lost revenues, higher commodity prices, disruption in fuel supplies, lower energy consumption, unstable …

… These systems and networks may be subject to various cybersecurity incidents such as improper or inadvertent access to or disclosure of confidential, commercially sensitive, or personally identifiable information, data theft, corruption or destruction, ransomware, supply chain attack, denial of service …

… Additionally, cyber threats and the techniques used in cyberattacks change, develop and evolve rapidly, including from emerging technologies, such as advanced forms of artificial intelligence (“AI”) and quantum computing. Our hybrid work environment, usage of mobile, AI and cloud-based …

Additionally, the Company is at risk of being unable to meet legal, regulatory, financial or customer obligations if the data, information systems, facilities or networks of a third-party vendor are disrupted, damaged or fail, whether due to physical disruptions, such as fire, natural disaster, pandemic or power outage, or due to cybersecurity incidents, ransomware or other impacts to vendors, including labor strikes, political unrest and terrorist attacks.

… current cyber threats, risk management activities, and discussions of cyber incident investigations that warrant the attention of the Board. The CISO also provides an annual update to the entire Board of Directors on topics such as changes in cybersecurity, top …

… As we do this, we must make judgments about where to invest resources to most effectively protect ourselves from cybersecurity risks. These are inherently challenging judgements, and we can provide no assurance that processes and technological defenses that we implement …

… Although we may review and assess third-party vendor cybersecurity controls, our efforts may not be successful in preventing or mitigating the effects of such events. Third-party risks may include, among other factors, the vendor’s lax security measures …

The information required by this Item is set forth in the “MD&A - Cybersecurity” section in the Annual Report, which is incorporated herein by reference.

• a cybersecurity incident directed at us or a third party could result in the theft, loss, disclosure, use or alteration of information, unauthorized or loss of access to information, or system or network failures. Any such incident could adversely impact our ability to conduct our businesses, damage our reputation and cause losses;

… Part I. Item 1. Business 1 Item 1A. Risk Factors 17 Item 1B. Unresolved Staff Comments 31 Item 1C. Cybersecurity 31 Item 2. Properties 33 Item 3. Legal Proceedings 33 Part II. Item 5. Market for Registrant’s Common Equity …