Read in the 10-K filed Feb 25, 2025The Company has previously experienced and expects to continue to experience attempts by unauthorized parties to compromise the Company’s cybersecurity controls, like the 2018 ransomware attack. The Company has also experienced and expects to continue to experience similar attempts by threat actors to penetrate the systems of third-party suppliers and vendors to whom the Company has provided data, like the 2019 AMCA data breach. These attempts, if successful, could result in the misappropriation or compromise of personal information or proprietary or confidential information stored within the Company's systems or within the systems of third parties, create system disruptions or cause shutdowns. Threat actors have a variety of attack methods, including without limitation, by developing and deploying viruses, worms, and other malicious software programs that attack the Company’s systems, the systems of third-parties, or otherwise exploit any security vulnerabilities. In addition, the increased use of AI by threat actors is enhancing the scale sophistication and effectiveness of their cyberattacks. Outside parties may also attempt to fraudulently induce employees to take actions, including the release of confidential or sensitive information or to make fraudulent payments through illegal electronic spamming, phishing, spear phishing, and other tactics.
Read in the 10-K filed Feb 25, 2025protect against these evolving threats. In addition, as cyber threats continue to evolve including the use of AI by threat actors to compromise systems, the Company may be required to expend additional resources to continue to enhance the Company’s cybersecurity measures or to investigate and remediate any cybersecurity vulnerabilities. The Company’s remediation efforts may not be sufficient and could result in interruptions, delays, cessation of service, loss of data integrity, loss of confidentiality, and/or loss of data. This could also impact the cost and availability of cyber insurance to the Company. Cybersecurity incidents affecting the Company’s or third parties' security measures and the unauthorized dissemination of personal, proprietary or confidential information about the Company or its customers or other third parties could expose customers’ private information. Such incidents could expose customers to the risk of financial or medical identity theft or expose the Company or other third parties to a risk of loss or misuse of this information, result in litigation and potential liability for the Company, damage the Company’s brand and reputation, or otherwise harm the Company’s business. Any of these incidents could have a material adverse effect on the Company’s business, regulatory compliance, financial condition, reputation, and/or results of operations.
Read in the 10-K filed Feb 25, 2025The Company and its third parties leverage AI and machine learning tools to increase productivity and innovation. The Company also faces potential risks from the use of AI and machine learning tools. The Company, or its customers' sensitive, proprietary, or confidential information could be leaked, disclosed, or revealed as a result of or in connection with employees' or vendors' use of generative AI technologies. In addition, the Company may use AI outputs to inform certain decisions, and AI models may create incomplete, inaccurate, or otherwise flawed outputs, some of which may appear correct. Due to the potential flaws in the use of AI, the Company could make incorrect decisions, including decisions that could bias certain individuals or classes of individuals and adversely impact their rights. The rapid development of AI tools could render obsolete certain technologies or tools we currently use, or otherwise provide competitors with a technological edge. New or evolving legislation or regulations might impose restrictions on how AI and machine learning tools can be used, requiring the Company to adapt its tools or face various penalties for non-compliance, including potential disgorgement of data and associated capabilities. As a result, the Company could face adverse consequences, including exposure to reputational and competitive harm, customer loss, and legal liabilities. The AI tools may also be subject to additional, and as yet unidentified, security threats.