Compare peers

sophistication and variety of ransomware techniques. Cyber-attacks and incidents also include manufacturing, hardware or

technology systems because of software or hardware malfunctions, computer viruses, cyber-attacks, employee theft or

million, $9 million and $11 million, respectively, of direct expenses related to the cyber incident, mostly consisting

proceeds of $20 million and $40 million, respectively, representing insurance recovery of losses related to the cyber

… code; coordinated attacks by a variety of actors, including, among others, activist entities or state sponsored cyberattacks; emerging cybersecurity risks; cyber risk related to connected devices; misplaced or lost data; programming and/or human errors; or other similar events that …

For additional information about our assessment of our cybersecurity risks, see discussion in Part I Item 1C. "Cybersecurity."

Our third-party business partners are vulnerable to cybersecurity risks, and any cyber incident affecting our third-party business partners could significantly disrupt our operations.

… Despite our comprehensive approach to conducting diligence on the cybersecurity controls of our third-party business partners, we may not be able to prevent a third-party business partner from experiencing a cybersecurity incident and any cyber incident affecting our …

There are numerous and evolving risks to our cybersecurity and privacy from cyber threat actors. These cyber threat actors, whether internal of external to Dexcom, are becoming more frequent, sophisticated and coordinated in their attempts to access data, including, without …

• Cybersecurity risks and cyber incidents could result in the compromise of confidential data or critical data systems and give rise to potential harm to customers, remediation and other expenses, expose us to liability under HIPAA, consumer protection laws, or other common law theories, subject us to litigation and federal and state governmental inquiries, damage our reputation, and otherwise be disruptive to our business and operations.

… made separately by both our internal cybersecurity team and our external digital forensics and incident response supplier that no confidential information had been exfiltrated, and the incidents are now closed. As the cyber-threat landscape evolves, these attacks are growing …

System vulnerabilities and/or cybersecurity breaches experienced by our third-party service providers have constituted a substantial share of the information security risks that have affected us. For example, in the past we have experienced cybersecurity incidents involving third-party service providers, including incidents in which unauthorized third parties accessed or exfiltrated certain information, including non-significant Amgen data and personally identifiable patient information, and we

… to data privacy or security breaches, acts of vandalism or theft, malware, ransomware, social engineering attacks (including phishing attacks), denial-of-service attacks or other forms of cyber-attack, misplaced or lost data including paper or electronic media, programming and …

• A failure in or breach of our operational or security systems, networks or infrastructure, or those of third-party vendors with which we do business, including as a result of cyber-attacks and other data security incidents, could have a material adverse effect on our business;

While we maintain cyber insurance coverage that is intended to address data security risks, such insurance coverage may be insufficient to cover all losses or claims that may arise.

• Information technology system failures, cyberattacks, or deficiencies in our cybersecurity could harm our business, customer relations, financial condition, or results of operations.

The costs to eliminate or address security threats and vulnerabilities before or after a cyber incident could be significant. Our remediation efforts may not be successful and could result in interruptions, delays or cessation of service and loss of customers. As security threats continually evolve, we may be required to devote additional resources to modify or enhance our operational or security systems and networks and our cybersecurity program.

provide employee awareness training around phishing, malware and other cyber risks; however, such measures may not be effective against all types of security incidents.

… Our IT systems have been subject to computer malware, unauthorized access, and other cyber-attacks. There has been an increase in the frequency and sophistication of the cybersecurity threats we and our service providers face, including through the use of …

… If a material cyber incident or other disruption impacting a supplier were to result in its prolonged inability to use, manufacture, and/or ship such components, this could impact our ability to manufacture and/or use our products. In addition …

While we have made, and expect to continue making, significant investments intended to strengthen our cybersecurity posture - including measures designed to protect our products, systems, and data - we cannot guarantee that these efforts will fully prevent, mitigate or remediate cybersecurity …

• IT system disruptions, breaches or breakdowns, including through cyberattacks, ransom attacks or cyber-intrusion, which could impair our ability or that of our customers, suppliers and other business partners to conduct business, result in the loss of our trade secrets or otherwise compromise sensitive information

respect to any particular claim. Refer to Part I, Item 1C “Cybersecurity” of this Form 10-K for additional information about the Company’s risk management and strategy and governance with respect to cybersecurity threats and incidents.

◦ We are increasingly dependent on IT and information systems and our systems and infrastructure face certain risks, including cybersecurity and data leakage risks.

Cybersecurity threats continue to increase in frequency and sophistication; a successful cybersecurity attack could interrupt or disrupt our information technology systems, or those of our third-party service providers, or cause the loss of confidential or protected data which could disrupt our business, force us to incur excessive costs or cause reputational harm.

… There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information. We maintain cyber liability insurance; however, this …

We cannot ensure that we or our third-party service providers will be able to identify, prevent or contain the effects of cyber-attacks or other cybersecurity risks that bypass our or their security measures or disrupt our or their …

… disruptions or cyber events, but there is no guarantee that such efforts will be effective. If those efforts are not effective, the functionality of our information technology systems or those of third parties could be interrupted. Cybersecurity and the continued …

… As a global pharmaceutical company, our systems and assets are the target of frequent cyber-attacks. Such cyber-attacks are of ever-increasing levels of sophistication, including the use of adversarial AI techniques (for example, AI may be used to …

… not be appropriate for the intended use, of poor quality, contain biased information, or that become corrupted during a cyber-attack; and flawed or inappropriate data practices by data scientists, engineers, and end-users could impair results. If the output …

Abbott invests in its information systems and technology and in the protection of its products and data to reduce the risk of a cybersecurity incident or other significant disruption, and monitors its information systems on an ongoing basis for any …

Similar to other large multi-national companies, the size and complexity of the information systems on which Abbott relies for both its infrastructure and products make them susceptible to a cybersecurity incident, breakdown, destruction, loss of data privacy, or other …

… We could also suffer strained relationships with customers, business partners, physicians and other healthcare professionals, increased costs, litigation or other negative consequences as a result of such cyber incidents. The insurance we have procured related to cybersecurity risks may not …

• We may experience breaches and breakdowns affecting our information technology systems or protected information, including from obsolescence, cyber security breaches and data leakage.

… as an increased number of cyber extortion attacks, with higher financial ransom demand amounts and increasing sophistication and variety of ransomware techniques and methodology. Geopolitical instability may increase the risk of cybersecurity threats. Cybersecurity threats or incidents may include deployment …

While we continue to build and improve our systems and infrastructure, including our business continuity plans, there can be no assurance that our efforts will detect and prevent cybersecurity threats or incidents in our systems and any such incidents could …

The Company continues to face cybersecurity threats, including ransomware attempts, data breaches, and phishing and social engineering attempts targeting its systems and its employees, and those of third-party vendors. Increasingly sophisticated methods, including the use of AI by threat …

Cybersecurity incidents and unauthorized access to the Company's or its customers’ data could harm the Company’s reputation and adversely affect its business.

We rely on the proper function, availability, and security of our products and IT systems; a successful cyber-attack or other breach or disruption of our products or these systems could have a material adverse effect on our business and results of operations.

… Further, we expect that the breadth and complexity of our IT systems and infrastructure will increase as we utilize cloud technologies and AI, which present inherent enterprise technology risks, including those related to privacy, data protection, and cybersecurity, that need …

… Despite Solventum’s cybersecurity and business continuity measures (including employee and third-party training, monitoring of networks and systems, patching, maintenance and backup of systems and data), its information technology networks and infrastructure are still potentially susceptible to attack, compromise …

… Use of these technology solutions could result in Solventum’s increased vulnerability to cyber-attack, malicious intrusions, breakdowns, interference or other significant disruptions, exposure to penalties from non-compliance with emerging regulations, and may result in defects in design or …

… errors or other technical malfunctions, hacking attacks, phishing, vishing, deepfakes, and other social engineering attacks, malware, ransomware, employee noncompliance, error or malfeasance, cybersecurity attacks, malicious code, and other breaches of, or incidents impacting, IT systems or similar malicious or otherwise …

Security breaches, data breaches, cybersecurity attacks, or other cybersecurity incidents could materially adversely impact our operations and patient care, and our reputation, business, financial condition and results of operations could be harmed.

… and international privacy and cybersecurity laws and regulations impacting our operations are described in "Item 1. Business" - Other Factors Impacting Our Operations - Data Privacy and Security Laws and Regulations. Any data security breaches, cyber-attacks, malicious intrusions or significant disruptions …

… One of the most prevalent attacks on large organizations has been ransomware, which can have a devastating impact on an organization’s operations. Our ransomware readiness program has required and will continue to require investment and will not guarantee that …

See Item 1C of this 10-K, “Cybersecurity,” for more information on the Company’s cybersecurity risk management and governance.

See Item 1C of this 10-K, “Cybersecurity,” for more information on the Company’s cybersecurity risk management and governance.

… However, as cyber threats continue to evolve, along with their increased volume and sophistication, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any cybersecurity vulnerabilities …

• the confidentiality, maintenance, interoperability, exchange and security of health-related and personal information and medical records, including data breach, ransomware and identity theft issues;

… These attacks may include phishing, state-sponsored cyber attacks, industrial espionage, insider threats, computer denial-of-service attacks, computer viruses, ransomware and other malware, payment fraud or other cyber incidents. Evolving artificial intelligence and machine learning tools continue to improve …

Cyber attacks are becoming more sophisticated, frequent and adaptive, and therefore, despite our efforts, we cannot assure that cybersecurity incidents or data breaches will not occur or that technology or information system issues will not arise in the future. Any …

… by failures during system upgrades or implementations, user error, network or hardware failure, malicious intrusion and ransomware attack. Likewise, data privacy or cybersecurity incidents or breaches by employees or others, including the unauthorized use of AI tools, can result in …

Like many companies, we have experienced and expect to continue to be the target of cybersecurity incidents, including data breaches and temporary service interruptions. When cybersecurity incidents occur, our policy is to respond and address them in accordance with applicable …

We, and some of our third-party vendors, have experienced cybersecurity attacks by threat actors (which may include state-sponsored organizations or nation state actors) and other cybersecurity breaches and incidents in the past, including, among other things, computer viruses and malware, ransomware, denial of service actions, phishing schemes, social engineering, the compromise, misappropriation and/or unauthorized access to (or acquisition or disclosure of) confidential or

… While we maintain a cyber risk insurance policy, it may not cover any or all claims, costs or losses associated with all cybersecurity events. For more information regarding personal data and information privacy and data protection risks, refer to “Our …

… ransomware, cyber-attacks, or other compromises of our systems. Any of these events could result in material financial, operational, legal, business, or reputational harm to our business. For a discussion of our management of cybersecurity risks, see Item 1C, "Cybersecurity …

To date, system inadequacies, inadequate controls or procedures, operating failures, unauthorized access, service interruptions or failures, security breaches, malicious intrusions, theft, exfiltration, ransomware, cyber-attacks, and the compromise, disruption, degradation, manipulation, loss, theft, exfiltration, destruction, or unauthorized disclosure or use …

… In addition, we collaborate with government agencies regarding potential cybersecurity threats and have worked with firms that have cyber security expertise to evaluate our systems and the attacks we experience and strengthen our systems. There can be no assurances that …

service, generate insights from lab and other data and stimulate innovation to improve operational efficiency, including the expanded use of AI, may further expose our IT systems to the risk of cyberattacks and may create the need for rapid modifications to our cybersecurity program. Also, an increasing risk of civil unrest, political tensions, wars or other military conflicts may also impact the cybersecurity threat risk landscape.

In addition, our information technology infrastructure and products are vulnerable to cybersecurity attacks. Cybersecurity attacks can include, but are not limited to, computer viruses, denial-of-service attacks, phishing attacks, ransomware attacks, and other introduction of malware to computers and …

Our inability to protect our intellectual property or failure to maintain the confidentiality and integrity of data or other sensitive company information, by cyber-attack or other event, could have a material adverse effect on our business.

… Cybersecurity incidents include unauthorized occurrences on or conducted through our or our third parties’ information systems, such as tampering, malware insertion, ransomware attacks, or other system integrity events. The risk and efficacy of cyberattacks increases from time to time due …

Privacy, cybersecurity, data protection, and AI laws and guidance increase our compliance burden and expose us to risks.

… Further, although we maintain cyber liability insurance, this insurance may not provide adequate coverage against potential liabilities related to any experienced cybersecurity incident or breach.

… We have experienced, and may experience additional, cyber-attacks on our information technology systems and infrastructure by threat actors of all types (including nation states, criminal enterprises, individual actors or advanced persistent threat groups). Bad actors around the world use …

Our business and results of operations could be adversely affected if we experience a material cyber-attack or other systems breach.

MSO businesses are subject to cybersecurity risks that are, while similar in many respects, incremental to the cybersecurity risks experienced by our legacy businesses. If we are not able to adapt our systems and processes to mitigate these risks, we could

For information regarding our processes and practices related to information and cybersecurity, please see Section 1C of this report, “Cybersecurity”.

Additionally, the rapid ongoing evolution and increased adoption of emerging technologies such as artificial intelligence and machine learning may make it more difficult to anticipate and implement protective measures to recognize, detect, and prevent the occurrence of any of the cyber events described above.

We and our third-party providers experience cyber-attacks and other attempts to gain unauthorized access to our products, services, and systems and data on a regular basis, and we anticipate continuing to be subject to such attempts as cyber-attacks

… macroeconomic trends, sanctions and trade restrictions, natural disasters, pandemic health issues, geopolitical developments, war, terrorist actions, cybersecurity incidents including but not limited to ransomware attacks, misuse of AI and machine learning technologies, governmental actions and legislative or regulatory changes. Any …

… The costs imposed on us because of a cyberattack, ransomware attacks, phishing attempts, social engineering schemes, and other technology enabled threats or network disruption could be significant. Among others, such costs could include increased expenditures on cybersecurity measures, insurance premiums …

Our reputation as a global leader in animal health and our reliance on complex information systems and digital solutions make us inherently vulnerable to malicious cyber intrusion and attack, which have evolved in frequency and sophistication. In addition, we have …

… A cybersecurity incident would harm our reputation and financial condition and cause us to incur legal liability and increased costs to respond to such events. Our cyber liability insurance may not be sufficient to compensate us for losses that may …

… Our internally developed system and processes, as well as those provided by third-party vendors, may be susceptible to damage or interruption from cybersecurity incidents, such as terrorist or hacker attacks, the introduction of malicious computer viruses, ransomware, falsification of …

… In the past, our Customers and resellers of our products have experienced cybersecurity attacks and incidents that have impacted their ability to do business, process payments and sell products, and there can be no assurance that future cybersecurity attacks and …

… We maintain cyber liability insurance with terms, conditions, and limits believed to be adequate. However, cybersecurity-related liability or other claims may exceed insurance coverage limits, fines, penalties and regulatory sanctions may not be covered by insurance, or insurance may …

… The healthcare and biopharmaceutical industries remain targets of cybersecurity threats due to the value and sensitivity of the data they hold. Cybersecurity attacks and incidents are increasing in their frequency, sophistication and intensity and, due to the nature of some …

… These technologies may present opportunities for AbbVie's business but may also entail risks, including that AI-generated analyses utilized by AbbVie could be deficient or exacerbate regulatory, cybersecurity or other significant risks. Further, our failure to effectively implement these …

… We have faced, and will continue to face, risks of incidents, whether through cyber attacks or cyber intrusions through the Cloud, the Internet, phishing attempts, ransomware and other forms of malware, computer viruses, email attachments, extortion, exfiltration and other scams …

We are dependent on information technology systems, including artificial intelligence programs, and face risk of cybersecurity incidents that could disrupt our business and result in theft of proprietary, confidential and personal information.

… This includes emerging technologies which increase our threat landscape, such as generative AI and quantum computing, which are evolving rapidly in their practicality and use for cyber-attacks including through enhanced social engineering, and for cyber-attacks on industry standard …

We rely on the proper function, availability and security of information technology systems to operate our business and a cyber-attack or other breach of these systems could have a material adverse effect on our business, financial condition or results of operations.

… Cyberattacks could include the deployment of harmful malware, ransomware, denial-of-service attacks, social engineering and other means to affect service reliability and threaten the confidentiality, integrity and availability of information. Such cyberattacks increasingly exploit AI and machine-learning techniques …

… training, there can be no assurance that our efforts will prevent significant breakdowns, breaches in our systems or other cyber incidents that could have a material adverse effect upon the reputation, business, operations or financial condition of the company. In …

• there is a heightened risk of future cybersecurity threats, including ransomware attacks targeting healthcare providers. If successful, future cyberattacks could have a material adverse effect on our business. Any costs that we incur as a result of a data security …

… breaches, vandalism, theft, natural disasters, catastrophic events, human error and potential cyber threats, including malicious codes, worms, phishing attacks, denial of service attacks, ransomware and other sophisticated cyber-attacks, and our disaster recovery planning cannot account for all eventualities. Our …

… Our systems, products and services (including those we acquire through business acquisitions) are susceptible to being damaged, disrupted or shut down due to attacks by computer hackers, computer viruses, ransomware, human error or malfeasance (including by employees), power outages, hardware …

… Problems can arise during manufacturing for a variety of reasons, including equipment malfunction, contamination, failure to follow specific protocols and procedures, problems with raw materials or components, cyber-attacks, natural disasters and environmental factors, and if not discovered before the …

… A cybersecurity attack may penetrate our layered security controls and lead to the misappropriation of or compromise of protected personal information or proprietary or confidential information, create system disruptions, cause shutdowns, or deploy viruses, ransomware, and other malicious software programs …

If we, and the third-party service providers on whom we rely, are unable to defend our information technology systems against cybersecurity attacks, contain such attacks when they occur, or prevent other privacy or data security incidents that result in …

Increasingly complex regulations relating to privacy, data protection, and cybersecurity are burdensome, may reduce demand for our solutions, and non-compliance may impose significant liabilities.

Unauthorized access or other security breaches or incidents, as a result of third-party action (e.g., cyberattacks, or the introduction into our networks or systems of ransomware or other malware), employee or contractor error or malfeasance, product defect, or …

While we have programs in place to detect, contain and respond to data security incidents and provide employees with awareness training regarding phishing, malware and other cyber threats as a protection against cybersecurity risks and incidents, we expect that we …

The costs to eliminate or address these threats and vulnerabilities before or after a cybersecurity incident could be material. We have business continuity and resiliency plans which we maintain, update and test regularly in an effort to contain and remediate …

… The risk of damage or interruption to technology infrastructure as a result of cyber-attacks has generally increased as the number, intensity and sophistication of attempted attacks from around the world have increased, including through state-sponsored actors and/or …

Disruption, cyber-attack or unforeseen problems with the security, maintenance or upgrade of the Company’s information and web-based systems could have an adverse effect on the Company’s business strategy, results of operations and financial condition.

We and users of our products may face, and in the past have faced, cyber-attacks, including from nation state actors or advanced persistent threats who attempt to penetrate our or our customers’ network security, including our data centers; sabotage …

Despite using commercially reasonable measures to secure our systems, networks, and products, security breaches, including with respect to cybersecurity, and other disruptions could compromise our information, products, and services, disrupt our or our customers’ operations, and expose us to liability, which could cause our business and reputation to suffer.

An information security incident, including a cybersecurity breach, could have a negative impact on the Company’s business or reputation.

… The Company maintains cybersecurity insurance in the event of an information security or cyber incident; however, the coverage may not be sufficient to cover all financial, legal, business or reputational losses.

• Cyber-attacks on the Company’s or third-party providers’ IT systems, which could disrupt the Company’s operations.

• The Company is increasingly dependent on sophisticated software applications and computing infrastructure, including the use of cloud-based applications and environments. The Company continues to be a target of cyber-attacks that could lead to a disruption of its worldwide operations, including manufacturing, research and sales operations.

… These systems, products and services (including those we acquire through business acquisitions) can be damaged, disrupted or shut down due to attacks by computer hackers, computer viruses, ransomware, human error or malfeasance, power outages, hardware failures, telecommunication or utility failures …

… Also, as part of our cybersecurity risk management program we maintain cyber insurance, with coverage amounts and terms that are typical and appropriate for a company of our size and type. This insurance may not be sufficient to cover us …

… As cyber threats evolve and become more difficult to detect and successfully defend against, one or more cyber threats might defeat the measures that we or our vendors take to anticipate, detect, avoid or mitigate such threats. Certain techniques used …

… These third parties face risks relating to cyber security similar to ours, which could disrupt their businesses and therefore materially impact ours. Accordingly, we are subject to any flaw in or breaches to their computer and communications systems or those …

… The size and complexity of our IT systems make our IT systems and data vulnerable to risks and damages from a variety of sources, including malicious human acts, breaches of security, cyber-attacks, catastrophe or natural disaster, telecommunications or network …

• the risk that acquired businesses may have differing or inadequate cybersecurity and data protection controls; and

… For example, in the past we have experienced, and may experience in the future, various types of cybersecurity incidents, including unauthorized access to our IT systems, data security breaches, malware incursions, denial-of-service attacks, phishing campaigns, and other similar …

We collaborate with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes. These include cybersecurity assessors, consultants, and other external cybersecurity experts to assist in the identification, verification, and validation of cybersecurity risks, as …

… The risk of a security breach or disruption through cyber-attacks has generally increased as the number, intensity and sophistication of attempted attacks from around the world have increased. For example, many companies have experienced an increase in phishing and …

… There is uncertainty related to the legal and regulatory landscape surrounding rapidly evolving AI technologies, particularly in the areas of cybersecurity, intellectual property, and privacy and data protection. Failure to comply or appropriately respond to this developing landscape may result …

… Securities and Exchange Commission Final Rule on Cybersecurity Risk Management, Strategy, Governance and Incident Disclosure which requires enhanced disclosure requirements for cybersecurity, with similar applicable requirements under the EU’s NIS2 Directive and China’s Data Security Law.

Key Elements of Our Cybersecurity Program. We maintain cybersecurity policies that articulate Agilent's expectations and requirements regarding technology use, data privacy, risk management, and incident management. Regular exercises and assessments against recognized cybersecurity frameworks are conducted to improve the …

… This plan covers various cyber incidents like ransomware attacks, cyber-intrusions, data loss, denial of service, insider threats, malware attacks, and others. In a material cybersecurity incident, our D&T team, inclusive of our Chief Digital Officer and our VP …

The Company also educates and shares best practices globally with its employees to raise awareness of cybersecurity threats. As part of our onboarding process, we train all new employees on cybersecurity and conduct an annual retraining of all employees on …

PART I Item 1. Business 1 Item 1A. Risk Factors 5 Item 1B. Unresolved Staff Comments 12 Item 1C. Cybersecurity 12 Item 2. Properties 12 Item 3. Legal Proceedings 12 Item 4. Mine Safety Disclosures 12 PART II Item 5 …