Cybersecurity and data breaches

In addition, cybersecurity is a priority for regulators in the U.S. and around the world. The SEC has adopted cybersecurity disclosure rules for public companies and has adopted amendments to Regulation S-P that require, among other things, written incident response programs, customer notification in certain circumstances and enhanced oversight of service providers. In June 2025, the SEC formally withdrew certain pending proposed rules relating to cybersecurity risk management for investment advisers and certain funds; however, regulators continue to focus on cybersecurity through examinations,

Read in the 10-K filed Feb 25, 2026 ↗

We use and plan to expand our use of artificial intelligence tools and technologies in the operation of our business. These uses come with potential risks, including, but not limited to, generation of inaccurate results, misuse or disclosures of confidential information, infringement of third-party intellectual property rights, potential cybersecurity vulnerabilities, reputational risk and regulatory burdens. In addition, artificial intelligence models may create outputs that are flawed, inaccurate, biased, or that infringe or misappropriate intellectual property of third parties. The models may also be subject to new or different modes of cyber attacks, including prompt injection attacks, and such attacks may be able to circumvent cybersecurity tools and processes that we or the providers of such tools have in place. To the extent we rely on such technologies, these risks could negatively impact our business. There is also a risk that artificial intelligence tools or applications may be misused by our employees and/or third parties engaged by us. For example, an employee may input confidential information, including material non-public information, trade secrets, or personal information, into artificial intelligence technologies in a manner that results in such information becoming part of a dataset that is accessible by third-party artificial intelligence applications and users, including our competitors. Further, we may not be able to control how any third-party artificial intelligence technologies that we use are developed or maintained, or how data we input is used or disclosed, even where we have contractual protections with respect to these matters. The misuse or misappropriation of our data could have an adverse impact on our reputation and could subject us to legal and regulatory investigations and/or actions.

Read in the 10-K filed Feb 25, 2026 ↗

Finally, governments and regulators in the U.S. and abroad have proposed, adopted or are considering laws, regulations and guidance governing the development, deployment and use of artificial intelligence systems, including requirements relating to transparency, accountability, data governance, risk management, human oversight, cybersecurity, intellectual property and recordkeeping. For example, the European Union has adopted the EU Artificial Intelligence Act, which applies on a phased basis that began in 2025 and a numbers of U.S. states have enacted general artificial intelligence laws. These and other developments could increase our compliance costs, restrict our use of artificial intelligence in our business and investment processes, require changes to our policies, procedures, controls and vendor arrangements, and expose us to investigations, enforcement actions, litigation, fines, penalties or reputational harm.

Read in the 10-K filed Feb 25, 2026 ↗

If we or our third-party service providers experience a security breach or cyberattack and unauthorized parties obtain access to our bitcoin holdings, or if our private keys are lost or destroyed, or other similar circumstances or events occur, we may lose some or all of our bitcoin and our financial condition and results of operations could be materially adversely affected.

Read in the 10-K filed Mar 19, 2026 ↗

We expect that substantially all of the bitcoin we will acquire will be held in custody accounts at U.S.-based institutional-grade digital asset custodians. Our custodial services contracts are not expected to restrict our ability to reallocate our bitcoin among our custodians, and our bitcoin holdings may be concentrated with a single custodian from time to time. Security breaches and cyberattacks are of particular concern with respect to bitcoin. Bitcoin and other blockchain-based cryptocurrencies and the entities that provide services to participants in the bitcoin ecosystem have been, and may in the future be, subject to security breaches, cyberattacks, or other malicious activities. For example, in October 2021 it was reported that hackers exploited a flaw in the account recovery process and stole from the accounts of at least 6,000 customers of the Coinbase exchange, although the flaw was subsequently fixed and Coinbase reimbursed affected customers. Similarly, in November 2022, hackers exploited weaknesses in the security architecture of the FTX Trading digital asset exchange and reportedly stole over $400 million in digital assets from customers.

Read in the 10-K filed Mar 19, 2026 ↗

Further, any actual or perceived data security breach or cybersecurity attack directed at other companies with digital assets or companies that operate digital asset networks, regardless of whether we are directly impacted, could lead to a

Read in the 10-K filed Mar 19, 2026 ↗

In addition, bitcoin is controllable only by the possessor of both the unique public key and private key(s) relating to the local or online digital wallet in which the bitcoin is held. While the Bitcoin blockchain ledger requires a public key relating to a digital wallet to be published when used in a transaction, private keys must be safeguarded and kept private in order to prevent a third party from accessing the bitcoin held in such wallet. To the extent the private key(s) for a digital wallet are lost, destroyed, or otherwise compromised and no backup of the private key(s) is accessible, neither we nor our custodians will be able to access the bitcoin held in the related digital wallet. Furthermore, Strive cannot provide assurance that its digital wallets, nor the digital wallets of our custodians held on our behalf, will not be compromised as a result of a cyberattack. The bitcoin and blockchain ledger, as well as other digital assets and blockchain technologies, have been, and may in the future be, subject to security breaches, cyberattacks, or other malicious activities.

Read in the 10-K filed Mar 19, 2026 ↗

Attacks upon systems across a variety of industries, including industries related to bitcoin and financial services, are increasing in frequency, persistence, and sophistication, and, in many cases, are being conducted by sophisticated, well-funded and organized groups and individuals, including state actors. The techniques used to obtain unauthorized, improper or illegal access to systems and information (including personal data and digital assets), disable or degrade services, or sabotage systems are constantly evolving, may be difficult to detect quickly, and often are not recognized or detected until after they have been launched against a target. These attacks may occur on our systems or those of our third-party service providers or partners. In 2025, we have not identified any cybersecurity threats or incidents, including those resulting from any previous cybersecurity incidents, that have materially affected, or, to our knowledge, are reasonably likely to materially affect, us or our business strategy, results of operations or financial condition. However, we may, in the future, experience breaches of our security measures due to human error, malfeasance, insider threats, system errors or vulnerabilities or other irregularities. In particular, we expect that unauthorized parties will attempt to gain access to our systems and facilities, as well as those of our partners and third-party service providers, through various means, such as hacking, social engineering, phishing and fraud. Threats can come from a variety of sources, including criminal hackers, hacktivists, state-sponsored intrusions, industrial espionage, and insiders. In addition, certain types of attacks could harm us even if our systems are left undisturbed. For example, certain threats are designed to remain dormant or undetectable, sometimes for extended periods of time, until launched against a target and we may not be able to implement adequate preventative measures. Further, there has been an increase in such activities due to the increase in work-from-home arrangements. The risk of cyberattacks could also be increased by cyberwarfare in connection with the ongoing Russia-Ukraine and Israel-Hamas conflicts, or other future conflicts, including potential proliferation of malware into systems unrelated to such conflicts. Any future breach of our operations or those of others in the bitcoin or financial services industries, including third-party services on which we rely, could materially and adversely affect our financial condition and results of operations.

Read in the 10-K filed Mar 19, 2026 ↗

•We face technology, cybersecurity and data privacy risks, including failures, cyber attacks, unauthorized access and evolving privacy requirements, any of which may result in operational disruption, regulatory actions or reputational harm.

Read in the 10-K filed Feb 18, 2026 ↗

We face risks from fraudulent activity associated with Card Members, merchants and others, including through bad actors obtaining access to our customer accounts and information and frauds committed by our customers against us. Large financial services firms such as American Express and our customers are regularly targeted by a range of fraudulent activity, including fraud on our card and banking products, false disputes, account takeovers, identity theft and electronic-transaction related crimes, with sophisticated perpetrators increasingly utilizing a range of advanced techniques and multiple parties acting in concert. New or emerging technologies, such as generative AI capabilities, have increased these fraud risks. For example, we have seen our customers targeted by elaborate and voluminous social engineering attacks, which may utilize advanced methods of deception, such as synthetic voice and conversation generation. Information and cybersecurity breaches and other operational incidents that we or third parties experience also increase our fraud risk. Additionally, our introduction of new products and services, expansion into new jurisdictions or usage of new partners or vendors may create new fraud risks or heighten existing risks. While we have policies and procedures designed to address fraud risks, such as customer authentication controls and fraud detection systems, they may be insufficient to accurately predict, prevent or detect fraud.

Read in the 10-K filed Feb 6, 2026 ↗

The rapid evolution and increased adoption of AI, including generative and agentic AI, may create new or heightened risks for our business. If we are unsuccessful in developing, deploying, or governing these technologies, or if competitors adopt them more effectively, our competitive position, customer experience, operations, reputation, financial condition, or results of operations could be adversely affected. AI use may also increase cybersecurity risks by enabling more sophisticated, automated, or difficult-to-detect threats, and evolving laws and regulations related to AI, privacy, consumer protection, and data use may increase compliance obligations and potential exposure.

Read in the 10-K filed Oct 26, 2026 ↗

The Corporation and third parties with whom we interact and/or on whom we rely, are subject to cybersecurity incidents,

Read in the 10-K filed Feb 25, 2026 ↗

Our IT systems and Technology are vulnerable to breakdown, interruption, cyber and other security attacks, system malfunction, unauthorized access, inadvertent exposure or disclosure of information, theft, and other events and, at times, requires the manual application of security upgrades or patches on each machine or device that utilizes the Technology. Third-party systems and solutions that we rely on are also vulnerable to the same risks and may contain defects in design or manufacture or other problems that could result in system disruption or compromise the information security of our own systems, products, and services. Security threats, including cyber and other attacks, have become very sophisticated, frequent, and adaptive. The adversarial use of AI also poses unique challenges and may impact real-time detection capabilities and containment efforts. In addition, we are at risk of our third-party service providers sustaining such attacks, which may impact our products, services, and operations. Further, we expect that the breadth and complexity of our information and technology systems and infrastructure will increase as we work to expand our product offerings to utilize and generate data analytics and potentially AI (which create emerging enterprise risks, including cybersecurity, monitoring, and oversight). See “Risks Relating to Our Operations – We are exposed to risks associated with incorporating AI, machine learning and other emerging technologies into our products, services and operations”. The continuing evolution of technology we use, including cloud-based computing, open-source software, data hosting, AI, and reliance on third parties and Software as a Service (Saas) solutions, whom may also use open-source software, cloud-based computing, data hosting, or AI tools, create additional opportunities for the unintentional, intentional, unauthorized or unlawful disclosure, exposure, dissemination, loss, alteration, access or destruction of Protected Information stored or processed in our devices, systems, servers, infrastructure, and products (collectively, Technology), and those of our Saas providers and third party service providers. Additionally, certain of our products and systems collect Protected Information regarding customers, partners, patients and their therapies, and are internet enabled and connect to our systems, hospital networks, electronic medical record systems, or electronic health record systems, and are subject to the same risks, and could impact patient safety and lead to field actions or product recalls.

Read in the 10-K filed Feb 12, 2026 ↗

Catastrophic events, including those driven or intensified by climate change, pose a growing risk to our operating results and financial performance. The frequency and severity of natural disasters or extreme weather events (such as storms, blizzards, extreme temperatures, earthquakes, hurricanes, floods, fires and droughts) are increasing in many of our key markets, particularly in our three largest states by total sales (California, Texas and Florida). We may experience other catastrophic events beyond natural disasters, including pandemics, civil unrest, power loss, telecommunications failures, software and hardware malfunctions, terrorism (including related cyber threats) and other acts of violence. Additionally, the locations where we do business could continue to be the subject of unrest and national attention, which impacts our ability to operate. The adverse effects of these events may be amplified should multiple events occur simultaneously, such as a natural disaster during a pandemic.

Read in the 10-K filed Mar 18, 2026 ↗

•denial-of-service attacks, security incidents (through cyber-attacks and other malicious actions, including ransomware and social-engineering attacks);

Read in the 10-K filed Mar 18, 2026 ↗

Additionally, newly applicable and potential new or significantly revised state, provincial and federal laws and regulations in the jurisdictions in which we do business are expanding (and may further expand) our obligations to protect and honor the privacy and security of personal information, imposing new restrictions on the collection, use, sharing and retention of data and requiring additional implementation resources, all of which create incremental risk arising from a potential breach or compliance failure. The proliferation of new and updated privacy laws and regulations, including the rise of extreme data minimization legislation, has the potential to limit our ability to collect, use or share personal information and thus hinder our strategic and marketing efforts (e.g., Best Buy Ads and Best Buy’s own efforts to communicate with consumers). We could be subject to heightened regulatory investigations, penalties and fines if a cybersecurity event or privacy violation is related to data or sensitive personal information that is regulated by laws such as, for example, the Health Insurance Portability and Accountability Act (HIPAA), the Personal Information Protection and Electronic Documents Act (PIPEDA), or the California Consumer Privacy Act (CCPA).

Read in the 10-K filed Mar 18, 2026 ↗

While we have made, and expect to continue making, significant investments intended to strengthen our cybersecurity posture—including measures designed to protect our products, systems, and data—we cannot guarantee that these efforts will fully prevent, mitigate or remediate cybersecurity incidents or breaches. We maintain processes designed to monitor, detect and respond to threats and collaborate with government authorities and third-party partners in an effort to reduce risk. However, given the evolving nature, sophistication, scale and frequency of cybersecurity incidents and breaches, no system can be entirely secure. A successful cybersecurity incident or breach could materially adversely affect our business, financial condition, results of operations or cash flows.

Read in the 10-K filed Nov 25, 2025 ↗

risks, including from confidentiality, privacy, data protection, cybersecurity and compliance perspectives, and raises intellectual property issues and legal, regulatory, reputational ethical, operational, technological and other concerns (see, “Our operations are dependent in part on patents and other intellectual property assets” and “Cybersecurity incidents and breaches or breakdowns of our information and technology systems or infrastructure could have a material adverse effect on our operations” elsewhere in this Item 1A, Risk Factors). Additionally, if we do not effectively adopt and integrate AI into innovative, market-differentiated products in a timely manner, our competitive position could be adversely affected.

Read in the 10-K filed Nov 25, 2025 ↗

Furthermore, privacy and data protection risks extend beyond our direct operations. Non-compliance by third-party vendors, manufacturers, or service providers (especially those involved in data processing) can expose us to liability indirectly. Cybersecurity incidents, system failures, or breaches involving our own infrastructure or that of our partners may trigger regulatory scrutiny, financial penalties, business interruption, reputational harm, loss of competitive advantage and customer trust, as well as privacy litigation and civil lawsuits with damages.

Read in the 10-K filed Nov 25, 2025 ↗

• Our internal computer systems, and those of our third-party providers, may fail or suffer from events beyond our control, including from cybersecurity events, which could reduce revenue and earnings, increase expenses and expose us to legal and regulatory claims.

Read in the 10-K filed Feb 9, 2026 ↗

technology service providers to adequately safeguard their systems and prevent cyber-attacks could disrupt our operations and result in misappropriation, corruption or loss of confidential or propriety information.

Read in the 10-K filed Feb 6, 2026 ↗

To the extent we pursue our Investment Policy, we expect that our Bitcoin and digital assets may be held by a third-party custodian, and the safety of those assets is dependent on the custodian's security practices and operational integrity, which may lead to the loss of our digital assets as a result of the insolvency of the custodian, theft by employees or insiders of the custodian or if the custodian's security measures are compromised, including as a result of cyberattacks. A successful security breach or cyberattack could result in a partial or total loss of our Bitcoin in a manner that may not be covered by insurance or indemnity provisions of the custody agreement with a custodian who holds our Bitcoin. Such a loss could have a material adverse effect on our financial condition and results of operations.

Read in the 10-K filed Mar 19, 2026 ↗

Digital asset trading venues are relatively new and, in many cases, unregulated. Furthermore, there are many digital asset trading venues which do not provide the public with significant information regarding their ownership structure, management teams, corporate practices and regulatory compliance. As a result, the marketplace may lose confidence in digital asset trading venues, including prominent exchanges that handle a significant volume of Bitcoin trading and/or are subject to regulatory oversight, in the event one or more digital asset trading venues cease or pause for a prolonged period the trading of any digital assets, or experience fraud, significant volumes of withdrawal, security failures or operational problems. Negative perception, a lack of stability in the broader digital asset markets and the closure, temporary shutdown or operational disruption of digital asset trading venues due to fraud, business failure, cybersecurity events, government-mandated regulation, bankruptcy, or for any other reason, may result in a decline in confidence in Bitcoin and the broader digital asset ecosystem and greater volatility in the price of Bitcoin and other digital assets.

Read in the 10-K filed Mar 19, 2026 ↗

•Digital Omnibus: In November 2025, the EC proposed a Digital Omnibus package intended to take a holistic view across digital legislation at the EU level, including the EU AI Act, GDPR, Data Act, ePrivacy Directive and cybersecurity laws to reduce complexity and duplication. The package proposes a delay to the introduction of rules relating to high-risk AI uses pending development of compliance guidance, targeted changes to data protection rules under GDPR to facilitate data use in the development and operation of AI models and systems, and streamlining of incident reporting obligations.

Read in the 10-K filed Feb 25, 2026 ↗

Cybersecurity, data privacy and intellectual property risks: Cybersecurity incidents may compromise systems; intellectual property disputes or alleged infringements could disrupt our business; accounting for digital assets and fair value measurements; potential impairment charges; auditor transitions; internal control considerations.

Read in the 10-K filed Nov 21, 2025 ↗

security issues, bugs, and software errors have been identified with many digital assets and their underlying blockchain networks, some of which have been exploited by malicious actors. There are also inherent security weaknesses in some digital assets, such as when creators of certain blockchain networks use procedures that could allow hackers to counterfeit tokens. Any weaknesses identified with a digital asset could adversely affect its price, security, liquidity, and adoption rate. If one or more malicious actors obtain a majority of the compute or staking power on a digital asset network, as has happened in the past, it may be able to engage in illicit activity, which could cause financial losses to holders, damage the network’s reputation and security, and adversely affect its value;

Read in the 10-K filed Nov 21, 2025 ↗

Our rewards are typically earned via pooled mining. We rely on pool operators to honestly and accurately account for our pro rata share of rewards, maintain operational security, and remit proceeds. Pools may lack insurance for theft or loss, and rewards may be held for varying durations. Any failure, insolvency, cyber event, mispricing, or suspension by a pool operator could delay or reduce our receipts or result in losses. A change in pool fee structures or terms could adversely affect yields.

Read in the 10-K filed Nov 21, 2025 ↗

Cybersecurity incidents, including data breaches and ransomware, may compromise systems, disrupt operations, and cause financial loss.

Read in the 10-K filed Nov 21, 2025 ↗

The enhancement and development of technology systems may enhance cybersecurity risks and operational and technological risks, as any latency, disruption or failure in such technological tools could result in errors in analyses and compromise the integrity, security or privacy of generated content. Additionally, the process of integrating technology systems of businesses we acquire is complex and exposes us to additional risk. We may not adequately identify weaknesses in the information systems or information handling, privacy and security policies and protocols of targets, which could expose us to unexpected liabilities or make our own systems and data more vulnerable to cybersecurity incidents. For further discussion of risks relating to these technology systems, please see “A cybersecurity attack, or any other interruption in information technology and/or data security that may impact our operations or the operations of third parties that support us, could adversely affect our business, financial condition and reputation” above.

Read in the 10-K filed Feb 12, 2026 ↗

security issues, bugs, and software errors have been identified with many digital assets and their underlying blockchain networks, some of which have been exploited by malicious actors. There are also inherent security weaknesses in some digital assets, such as when creators of certain blockchain networks use procedures that could allow hackers to counterfeit tokens. Any weaknesses identified with a digital asset could adversely affect its price, security, liquidity, and adoption rate. If one or more malicious actors obtain a majority of the compute or staking power on a digital asset network, as has happened in the past, it may be able to engage in illicit activity, which could cause financial losses to holders, damage the network’s reputation and security, and adversely affect its value;

Read in the 10-K filed Mar 27, 2026 ↗

Our rewards are typically earned via pooled mining. We rely on pool operators to honestly and accurately account for our pro rata share of rewards, maintain operational security, and remit proceeds. Pools may lack insurance for theft or loss, and rewards may be held for varying durations. Any failure, insolvency, cyber event, mispricing, or suspension by a pool operator could delay or reduce our receipts or result in losses. A change in pool fee structures or terms could adversely affect yields.

Read in the 10-K filed Mar 27, 2026 ↗

WhiteFiber believes that the successful use of its platform requires a high level of support and engagement for many of its customers. In order to deliver appropriate customer support and engagement, WhiteFiber must successfully assist its customers in deploying and continuing to use its platform, resolve performance issues, address interoperability challenges with the customers’ existing IT infrastructure, and respond to security threats and cyber-attacks and performance and reliability problems that may arise from time to time. Increased demand for customer support and cloud operations services, without corresponding increases in revenue, could increase its costs and adversely affect its business, operating results, financial condition, and future prospects.

Read in the 10-K filed Mar 27, 2026 ↗

result in exposure to claims for damages and other remedies by WhiteFiber’s customers and individuals whose personal data is the subject to a cybersecurity incident;

Read in the 10-K filed Mar 27, 2026 ↗

For example, California has enacted the California Consumer Privacy Act (“CCPA”) and the California Privacy Rights Act (“CPRA”), which, among other things, allows California consumers to request that certain companies disclose the types of personal information collected by such companies, to correct that information, to delete that information and to opt-out the sale or sharing of personal information for cross-context behavioral advertising. The California Privacy Protection Agency (“CPPA”) has proposed new regulations to require companies to conduct risk assessments, annual cybersecurity audits and set up notice and opt-out and access procedures for the use of automated decision-making technology. These proposed new requirements could increase our costs of compliance and impact our operations and the products and services we offer.

Read in the 10-K filed Mar 27, 2026 ↗

We conduct periodic cybersecurity risk assessments to identify reasonably foreseeable internal and external cybersecurity threats, including assessments conducted in connection with material changes to our business operations, systems, or third-party relationships. These risk assessments evaluate, among other things, the potential likelihood and magnitude of harm from such risks, including potential impacts on our operations, financial condition, reputation, digital assets, and business strategy, as well as the effectiveness of existing controls and safeguards.

Read in the 10-K filed Mar 26, 2026 ↗

Risk assessments consider information from internal stakeholders, known security vulnerabilities, threat intelligence, reported incidents affecting other companies in our industry, and information obtained from third parties and external advisors, as appropriate. The results of these assessments are used to inform enhancements to our cybersecurity controls, operational processes, and broader Company-wide risk management activities, which are periodically reported to management and the Audit Committee.

Read in the 10-K filed Mar 26, 2026 ↗

We maintain a cybersecurity incident response and recovery plan designed to guide our response to cybersecurity incidents. The plan provides a structured framework for incident identification, containment, investigation, remediation, and recovery, and includes defined escalation and communication protocols. In the event of a cybersecurity incident, management evaluates the incident to determine its severity and potential impact, including whether the incident is reasonably likely to be material, based on both quantitative and qualitative factors.

Read in the 10-K filed Mar 26, 2026 ↗

We maintain a vendor risk management program designed to identify and mitigate cybersecurity risks associated with third-party service providers. Third-party providers are subject to cybersecurity risk assessments during onboarding, contract renewal, and upon the identification of elevated risk. These assessments may include questionnaires, management discussions, third-party intelligence, and review of available SOC reports or similar assurances. Cybersecurity incidents affecting third-party providers are evaluated for potential impact to the Company, as appropriate.

Read in the 10-K filed Mar 26, 2026 ↗

Our policies require employees and relevant third-party contractors to contribute to our cybersecurity efforts. We provide periodic cybersecurity and data protection awareness training and require the prompt reporting of suspicious activity or potential cybersecurity incidents to management.

Read in the 10-K filed Mar 26, 2026 ↗

Our Board retains ultimate oversight responsibility for cybersecurity risk. The Board has delegated primary oversight of cybersecurity and information technology risks to the Audit Committee as part of its risk oversight function.

Read in the 10-K filed Mar 26, 2026 ↗

In the event of a cybersecurity incident, management evaluates the incident and, as appropriate, escalates matters to the Audit Committee and the Board. The Audit Committee receives periodic updates regarding cybersecurity risks, program effectiveness, and any material cybersecurity incidents. The Audit Committee also meets regularly with the Company’s independent registered public accounting firm and discusses cybersecurity risks relevant to financial reporting and internal controls, as appropriate.

Read in the 10-K filed Mar 26, 2026 ↗

Cybersecurity, privacy and data protection have become top priorities for regulators in the United States and around the world. Many jurisdictions in which we operate have laws and regulations relating to privacy, data protection and cybersecurity, including the Gramm-Leach-Bliley Act (“GLBA”) (including recent amendments to Regulation S-P),

Read in the 10-K filed Feb 27, 2026 ↗

Citi may also rely on AI models developed by third parties and be exposed to risks arising from their development and training methods, including potential inclusion of unauthorized material in the training data or limitations in their risk mitigation strategies, over which Citi may have limited visibility or control (see also the operational processes and systems risk factor below). While Citi may provide restrictions on use of certain data in third-party AI applications or models, a third party could breach those terms, which could expose Citi to legal and reputations risks. Citi is also exposed to risks related to the use of AI technologies by counterparties, clients and vendors, where interconnected AI systems could amplify failures and threats of cyber infiltration, as well as cause widespread disruptions.

Read in the 10-K filed Feb 20, 2026 ↗

Moreover, the use of increasingly sophisticated AI technologies by malicious actors and others has increased the risk of fraud, including identity theft and bypassing of verification controls, and exposure to cyberattacks (see the cybersecurity risk factor below), as well as disinformation and market manipulation campaigns, and failure to effectively manage such risks could result in misappropriation of funds, unauthorized transactions, exposure of sensitive client or Company information, reputational harm and increased litigation and regulatory risk.

Read in the 10-K filed Feb 20, 2026 ↗

The application and interpretation of such requirements are constantly evolving and are subject to change, creating a complex compliance environment. In some cases, these requirements may be either unclear in their interpretation and application, or they may have inconsistent or conflicting requirements with each other. Further, there has been a substantial increase in legislative activity and regulatory focus on data privacy and security in the United States and elsewhere, including in relation to cybersecurity incidents. In addition, some such requirements place restrictions on our ability to process Personal Information across our business or across country borders.

Read in the 10-K filed Feb 19, 2026 ↗

Our acquisition of Calpine in January 2026 introduces expanded cybersecurity and physical security risks. As part of the integration, we have and expect to continue to evolve our systems, processes, and technical controls in connection with Calpine's information technology and operational technology. Our acquisition of Calpine and the visibility of the transaction will likely increase attention from potential cyber threat actors, potential insider threats, and opportunistic adversaries.

Read in the 10-K filed Feb 24, 2026 ↗

The use of AI technologies in our operations presents risks that could adversely affect our business, financial condition, results of operations and reputation. AI systems, whether developed internally or used by our vendors, service providers or business partners, may produce inaccurate, biased or misleading outputs or experience errors, security vulnerabilities or other failures, which could result in operational disruptions, flawed decision‑making, data loss, cybersecurity incidents or reputational harm. The use of AI may also increase the risk of inadvertent disclosure or misuse of proprietary, confidential or personal information. In addition, the legal and regulatory landscape governing AI technologies is rapidly evolving and uncertain, and compliance with new or changing requirements may impose significant costs or limit our ability to develop, deploy or use AI. If we fail to keep pace with the rapid evolution of AI technologies in our industry and the segments we serve, our competitive position and business results could be negatively impacted.

Read in the 10-K filed Feb 24, 2026 ↗

In addition to state-specific data breach notification laws (which exist in all US states and territories), evolving federal cybersecurity laws may require us to provide notifications about cybersecurity incidents in limited timeframes and before investigations are complete. Our businesses’ failure to comply with these laws and regulations could expose us to breach of contract claims, substantial fines, penalties and other liabilities and expenses, costs for remediation and harm to our reputation.

Read in the 10-K filed Feb 12, 2026 ↗

It is also important to note that many countries are following the EU in producing a broad omnibus law in relation to privacy protection and enhanced cybersecurity requirements. In Asia, privacy and cybersecurity requirements are becoming more prescriptive and may include localization, mandatory breach notification obligations, security baseline requirements and cross-border transfer constraints. As a result of the various privacy, cybersecurity, and data protection regimes that apply to our operations globally, we may need to adapt our technologies or practices, incur material compliance and operational costs, restrict certain features or data uses in some jurisdictions, implement region-specific solutions, renegotiate vendor and customer terms, and/or change our business operations.

Read in the 10-K filed Feb 12, 2026 ↗

provide employee awareness training around phishing, malware and other cyber risks; however, such measures may not be effective against all types of security incidents.

Read in the 10-K filed Feb 26, 2026 ↗

Cyber-attacks could compromise our technology and information, damaging our business and reputation and disrupting our operations.

Read in the 10-K filed Dec 12, 2025 ↗

Our network environment and assets, and those of our third-party business partners, maintain information that is confidential, regulated, proprietary or sensitive to our business. The frequency and sophistication of cybersecurity events globally continues to increase, including through the use of AI, with companies in our industry particularly targeted given the nature of the products that we sell. Companies in the technology, communications and networking industries have been subjected to data security incidents, including cyber-attacks, attacks against products, and other attempts to gain unauthorized access to network assets, infrastructure or sensitive information.

Read in the 10-K filed Dec 12, 2025 ↗

We and our business partners have been, and may be in the future, subjected to cybersecurity incidents including ransomware attacks, exploitation, intrusion, disruption and other attempts to gain unauthorized access. These incidents could cause us to incur significant costs, risk to our technology, disruption of our operations, harm to customers and stakeholders, and reputational damage. We may also be subject to increased regulatory scrutiny, governmental investigations or enforcement actions, and regulatory fines. Additionally, a data security incident may result in significant remediation expenses and increased cybersecurity protection and insurance costs.

Read in the 10-K filed Dec 12, 2025 ↗

We operate in a regulatory environment that is rapidly evolving with respect to product security, cybersecurity, and the collection, use, and retention of data. Governments around the world continue to adopt new, and expand existing, laws and regulations imposing heightened requirements on companies related to these topics. Further expansion of product security, cybersecurity, or data protection regulations, whether through new legislation, more stringent industry standards, or increased enforcement activity, could require us to modify our products, enhance our security controls, or change our data practices, potentially resulting in increased costs. Failure to comply with applicable laws and regulations, or perceived shortcomings in our security or data practices, could subject us to governmental investigations, regulatory penalties, litigation, or reputational harm which could materially and adversely affect our business, financial condition, and results of operations.

Read in the 10-K filed Dec 12, 2025 ↗

Our business depends on providing tenants with highly reliable services, including with respect to physical security, cybersecurity, and maintenance of environmental conditions. We may fail to provide such services because our operations are vulnerable to, among other things, mechanical or telecommunications failure, power outage, human error, physical or electronic security breaches, cyberattacks, war, terrorism, fire, earthquake, pandemics, hurricane, flood and other natural disasters, sabotage and vandalism.

Read in the 10-K filed Feb 24, 2026 ↗

We and our third-party service providers face numerous and evolving cybersecurity risks and regularly identify, defend against and recover from a variety of cyber-attacks, including phishing and other efforts to gain unauthorized access to systems. These risks may increase as we grow, as our operations become more complex and as threat actors become more sophisticated, including through the use of artificial intelligence and other advanced techniques designed to circumvent security controls, evade detection or remain dormant for extended periods. Remote and hybrid working arrangements at our company and at many of our third-party providers may further increase cybersecurity risks due to challenges associated with managing distributed computing assets and non-corporate networks. In addition, any integration of artificial intelligence in our or our service providers’ or partners’ operations, products or services may pose new or unknown cybersecurity risks.

Read in the 10-K filed Feb 24, 2026 ↗

Despite our efforts to maintain and enhance cybersecurity controls and incident response and disaster recovery preparedness, including employee training, monitoring and preventative measures, we may be unable to detect, prevent, investigate, remediate or adequately recover from all cybersecurity incidents or IT Systems failures in a timely manner or at all. Security breaches or other cybersecurity incidents may arise from a variety of sources, including state-sponsored actors, opportunistic hackers, hacktivists, insiders, human or technological error, malware (including ransomware), social engineering or vulnerabilities in our or third-party systems. Certain attacks could harm us even if our systems are not directly compromised, including through disruptions at or vulnerabilities within third-party service providers on which we rely. We also may not be able to ensure the adequacy of the security measures implemented by our third-party service providers, custodians or counterparties, many of which store or process our sensitive data and digital assets.

Read in the 10-K filed Feb 24, 2026 ↗

A successful cybersecurity incident or IT Systems failure could result in, among other things, (i) interruptions to our operations or services; (ii) loss of control or impaired operation of our equipment; (iii) misappropriation or loss of personal data, Confidential Information or other critical data; and (iv) loss, theft or irretrievable loss of bitcoin or other digital assets. Such incidents could materially harm our business and reputation, require significant incident response, remediation or system restoration efforts and expenses, and expose us to governmental or regulatory investigations,

Read in the 10-K filed Feb 24, 2026 ↗

enforcement actions, litigation (including class actions), fines, penalties or other liabilities. In addition, a data breach or cybersecurity incident may trigger mandatory notification obligations under applicable privacy and data protection laws, which could result in negative publicity and a loss of confidence in our security measures.

Read in the 10-K filed Feb 24, 2026 ↗

Mitigating cybersecurity risks and responding to incidents has resulted, and may in the future result, in increased operating and capital costs for systems, technology, personnel, monitoring and compliance. Insurance coverage for cybersecurity incidents involving digital or cryptocurrency assets is limited, and we do not currently maintain cybersecurity insurance for such assets. As a result, losses, costs or damages arising from cybersecurity incidents or IT Systems failures may not be fully recoverable, if at all.

Read in the 10-K filed Feb 24, 2026 ↗

For example, the European Union (“EU”) Artificial Intelligence Act (“EU AI Act”), which entered into force on August 1, 2024 and will become enforceable in a gradual manner between 2025 and 2027, establishes, among other things, a risk-based governance framework for regulating AI systems operating in the EU. There is a risk that the EU AI Act could have a negative impact on our current or future use of AI. For example, the EU AI Act prohibits certain uses of AI systems and places numerous obligations on providers and developers of permitted AI systems, with heightened requirements based on AI systems that are considered high risk. This regulatory framework is expected to have a material impact on the way AI is regulated in the EU and beyond. Similarly, other jurisdictions, such as Canada with its Artificial Intelligence and Data Act and several U.S. states have also implemented or are considering similar regulatory frameworks or laws governing the development and deployment of AI generally or in specific contexts, as well as critical infrastructure cybersecurity legislation or regulations relating to data flows. Specific to AI law, in April 2023, the U.S. Federal Trade Commission, Department of Justice, Consumer Financial Protection Bureau and Equal Employment Opportunity Commission issued a joint statement on AI enforcement, demonstrating their interest in monitoring the development and use of automated systems and enforcement of their respective laws and regulations. The Federal Trade Commission and certain state Attorneys General have pursued enforcement actions against companies offering AI products and services under consumer protection laws. Such regulatory frameworks, as well as developing or potentially conflicting regulatory guidance and judicial decisions in this area, as well as conflict between potentially competing legal regimes (including with respect to state laws that may conflict with federal AI policy), may introduce uncertainty, affect our use of AI and our ability to provide and to improve our products and solutions, require additional compliance measures and changes to our operations and processes, result in increased compliance costs and potential increases in civil claims against us and could have a material adverse effect on our business, financial condition and results of operations.

Read in the 10-K filed Feb 24, 2026 ↗

Our financial performance depends, in part, on our ability to develop and market new and innovative services that differentiate our products or provide cost efficiencies, while avoiding increased related expenses. As artificial intelligence is a new and evolving technology in the early stages of commercial use, there are significant risks involved in the development and deployment of artificial intelligence. Moreover, there can be no assurance that our use of artificial intelligence in our business processes, system development, operations, or as part of our product and service offerings will enhance our products or services or augment our business or operating results. Market acceptance of artificial intelligence technologies is uncertain, and we may be unsuccessful in our product development efforts. Our artificial intelligence-related product initiatives and offerings, or use in our internal business operations, may give rise to risks related to accuracy, bias, discrimination, intellectual property infringement, misappropriation or leakage of intellectual property, defamation, data privacy and cybersecurity, among others. We are also exposed to risks related to the use of artificial intelligence technologies by third-party service providers, clients and other financial intermediaries. Risks related to our development and use of artificial intelligence include the possibility of new or enhanced laws or regulations or novel enforcement of existing laws related to artificial intelligence, compliance with which may be costly and burdensome or involve changes to our business practices or products, litigation or other legal liability, or additional oversight, audits or enforcement under existing laws or regulations. Our use of artificial intelligence may also give rise to ethical concerns or negative public perceptions, which may cause brand or reputational harm. Additionally, our existing competitors or new entrants may be developing their own artificial intelligence products and technologies, which may be superior in features or functionality, or cost, to our offerings. Any of these factors could adversely affect our business, reputation or operating results.

Read in the 10-K filed Feb 26, 2026 ↗

We continue to invest in and utilize emerging technologies that have potential to make business tasks easier, more efficient and less labor intensive, including artificial intelligence and machine learning. These new technologies may not deliver the expected efficiencies and could expose us to new risks, including risks related to cybersecurity, data privacy, inaccuracies, hallucinations, bias or discrimination and claims of intellectual property infringement.

Read in the 10-K filed Feb 4, 2026 ↗

We are incorporating AI solutions into our business, products, services and features, and we are leveraging AI, including generative AI, machine learning and similar tools and technologies, in our product development, operations and software programming. There is inherent risk and uncertainty involved in using AI. The use of AI in the development of our products and services could cause loss or theft of intellectual property, as well as subject us to risks related to intellectual property infringement or misappropriation, data privacy and cybersecurity. The use of AI by us, our vendors or our suppliers can lead to unintended consequences, including

Read in the 10-K filed Feb 10, 2026 ↗

Technologies, systems, networks and other devices of Capital One, as well as those of our employees, service providers, insiders, customers, partners, network participants, including merchants, and other third parties with whom we interact, have been and may continue to be the subject of cyber-attacks and other security incidents, including computer viruses, hacking,

Read in the 10-K filed Feb 19, 2026 ↗

Furthermore, the Transaction exposes us to additional cybersecurity risks, which we expect to continue until the integration of Discover is completed. These risks include the possibility of previously undetected cybersecurity threats in Discover's operations, systems and networks, as well as risks related to the cybersecurity posture of Discover and its third-party service providers. The materialization of such risks could lead to the degradation or disruption of our operations and services; unauthorized access; breach of confidentiality; and misuse or modification of systems, networks and data. Additionally, in connection with the integration of Discover, failures or difficulties in retaining new personnel, including those with access to our confidential or sensitive information (including personal information), and other difficulties in the organizational,

Read in the 10-K filed Feb 19, 2026 ↗

technological and cultural integration process may heighten the risk of cyber-attacks and other security incidents, including as a result of human error, fraud or malice on the part of current or former employees.

Read in the 10-K filed Feb 19, 2026 ↗

restructurings, consolidations, operational outages, cybersecurity incidents and other similar events that may occur in any industry. For example, we are contingently liable for certain disputed credit card sales transactions that arise between customers and merchants. If a dispute is resolved in the customer’s favor, we will cause a credit or refund of the amount to be issued to the customer and charge back the transaction to the merchant or merchant acquirer. If we are unable to collect this amount from the merchant or merchant acquirer, we will bear the loss for the amount credited or refunded to the customer. Where the purchased product or service is not provided until some later date following the purchase, such as an airline ticket, the likelihood of potential liability increases.

Read in the 10-K filed Feb 19, 2026 ↗

We provide components to contract manufacturers to produce finished or intermediary goods, and for some products a particular internal or external manufacturing site may be the sole qualified source. Our reliance on contract manufacturers exposes us to risks including reduced control over delivery schedules and planning, limited visibility into or availability of manufacturing capability and capacity, reliance on third-party quality assurance procedures, cybersecurity incidents or data security breaches affecting contract manufacturers, and the risk that disruptions at those manufacturers could require us to identify and qualify alternatives, which may be expensive and time-consuming and could result in supply interruptions and harm to customer relationships.

Read in the 10-K filed Aug 14, 2026 ↗

increasingly difficult to detect, and come from a variety of sources, including traditional computer “hackers,” threat actors,

Read in the 10-K filed Mar 2, 2026 ↗

attacks, credential stuffing attacks, credential harvesting, physical or electronic break-ins, employee misconduct or error , ransomware

Read in the 10-K filed Mar 2, 2026 ↗

technology assets, adware, attacks enhanced or facilitated by AI, and other similar disruptions. In particular, severe ransomware

Read in the 10-K filed Mar 2, 2026 ↗

reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of ransomware attack, but we may be

Read in the 10-K filed Mar 2, 2026 ↗

cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated

Read in the 10-K filed Mar 2, 2026 ↗

consumer protection rules, anti-money laundering and sanctions requirements, and data and cybersecurity laws. U.S. federal regulators

Read in the 10-K filed Mar 2, 2026 ↗

additional stability, larger exchanges may be more likely to be appealing targets for hackers and “malware” (i.e., software used or

Read in the 10-K filed Mar 2, 2026 ↗

the digital asset exchange market and the closure or temporary shutdown of digital asset exchanges due to business failure, hackers or

Read in the 10-K filed Mar 2, 2026 ↗

relating to hackers and technological attack. Nevertheless, the security procedures cannot guarantee the prevention of any loss due to a

Read in the 10-K filed Mar 2, 2026 ↗

cybersecurity incidents could disrupt our services and extend recovery times beyond our control. Our business involves

Read in the 10-K filed Feb 27, 2026 ↗

telecommunications failure, computer viruses, ransomware or other cybersecurity incidents, technology failures, software or

Read in the 10-K filed Feb 27, 2026 ↗

We also operate in an evolving regulatory environment for cybersecurity and data privacy. New or expanded disclosure or

Read in the 10-K filed Feb 27, 2026 ↗

In the United States, California has enacted the California Consumer Privacy Act, as amended (“CCPA”) and numerous similar recently enacted laws create new data privacy rights for individuals. Other evolving legislation relating to privacy and cybersecurity at the federal, state, and local levels also may, or may be argued to, apply to us. Additionally, certain of our commercial partners, including payment card companies, have imposed data security standards or other obligations relating to privacy, data protection, or data security upon us, and others may do so in the future. We also may be, or may be argued to be, subject to industry standards or other actual or asserted obligations relating to privacy, data protection, and cybersecurity. We strive to comply with applicable laws, regulations, policies, and contractual and other legal obligations relating to privacy, data protection, and cybersecurity. These legal, contractual, and other actual and asserted obligations are, however, evolving rapidly, may be interpreted and applied in new ways and/or in manners that are inconsistent, and may conflict with other obligations or our practices.

Read in the 10-K filed Sep 29, 2026 ↗

Information security risks have escalated as a result of these emerging technologies and the heightened sophistication and activity levels of cyber-attack perpetrators. Cyber-attacks can include third parties gaining unauthorized access to our data, including sensitive information about our residents, as well as our vendors' data or information technology systems. These attacks may occur through stolen credentials, computer malware, phishing attacks, ransomware, and other deliberate attempts to compromise information security.

Read in the 10-K filed Feb 12, 2026 ↗

We leverage software and hardware solutions from technology and services providers, including software-as-a-service and public cloud infrastructure, who have been subject to cybersecurity incidents in the past and may have incidents or breaches in the future. As of the date of this filing, to our knowledge, no prior cybersecurity incident or breach at a third party has had a material impact on our business. However, future incidents or breaches could cause us to suffer significant harm.

Read in the 10-K filed Feb 18, 2026 ↗

We, along with many businesses in the biopharmaceutical industry, are adopting and exploring the use of artificial intelligence (AI) in our business, and as an emerging and rapidly evolving technology, our use of AI introduces potential opportunities but also presents risks that could adversely affect our operations, information security and reputation. For example, algorithms may be flawed; data sets may be insufficient, of poor quality, or contain biased information; and inappropriate or controversial data practices by data scientists, engineers, and end-users could impair results. If the analyses that artificial intelligence-based applications assist in producing are deficient or inaccurate, we could be subjected to competitive harm, potential legal liability and brand or reputational harm. Use of AI-based software may also lead to cybersecurity risks or the release of confidential proprietary information, including personal data, which may impact our ability to realize the benefit of our intellectual property or violate our internal policies, data protection laws or contractual requirements. The use of AI-based software may also result in unauthorized access of personal data or the intellectual property of third parties. The legal and regulatory landscape regarding the use of AI is rapidly evolving, including in the areas of intellectual property, cybersecurity, and privacy and data protection. Compliance may impose operational costs and limit our ability to use AI-based software, and failure to comply may result in potential government actions, litigation, fines, penalties or adverse publicity.

Read in the 10-K filed Feb 18, 2026 ↗

•in the case of foreign acquisitions, challenges with integrating operations across different cultures and languages and addressing the particular economic, currency, political, cybersecurity, regulatory and market risks associated with certain countries;

Read in the 10-K filed Mar 2, 2026 ↗

For additional information and a further discussion of impacts and risks related to cybersecurity matters, see the risk factors under the “Item 1A. Risk Factors— Risk Related to Cybersecurity, Privacy, and Regulatory Requirements” heading.

Read in the 10-K filed Sep 2, 2026 ↗

The regulatory environment governing AI is rapidly evolving in the U.S. and internationally. Existing and new laws, regulations, industry standards and governmental guidance relating to AI, data privacy, cybersecurity, intellectual property, transparency, consumer protection, employment practices and automated decision-making may increase our compliance costs, restrict our ability to develop and deploy AI solutions, require changes to our business practices or expose us to regulatory investigations, enforcement actions, penalties or litigation.

Read in the 10-K filed Jul 29, 2026 ↗

Our use of AI technologies also may increase cybersecurity, privacy and data protection risks. AI systems may process large volumes of proprietary, personal, customer, supplier and employee-partner information, and failures in the design, implementation or oversight of such systems could result in the unauthorized disclosure, misuse, loss or corruption of data. Additionally, threat actors may utilize AI to develop increasingly sophisticated cyberattacks, phishing campaigns, malware, fraud schemes, social engineering techniques and other malicious activities targeting the Company, our customers, suppliers and employee-partners.

Read in the 10-K filed Jul 29, 2026 ↗

If we are unable to effectively manage the risks associated with AI and other emerging technologies, including risks relating to data protection, cybersecurity, intellectual property, regulatory compliance, operational effectiveness, ethical use and reputational considerations, our business, financial condition, results of operations and reputation could be materially adversely affected.

Read in the 10-K filed Jul 29, 2026 ↗

We increasingly develop and deploy AI technology through third party generative AI platforms and internal software, in connection with our proprietary systems and customer experiences, including automated, self-service workflows, AI-enabled customer support tools, internal work efficiencies, and enhancement of our recruiting and hiring processes. These initiatives are complex, rapidly evolving, and inherently uncertain. There is no assurance that our AI capabilities will function as intended, deliver anticipated benefits, or scale cost-effectively. The performance, quality, and impact of AI models depend on numerous factors, including the availability and integrity of training data, model design, computational resources, integration with our operations and technology stack, and ongoing monitoring and governance. If our AI systems or those third party platforms we utilize underperform, produce inaccurate, incomplete, or biased outputs, hallucinate or fail under edge cases, degrade customer experiences, inadvertently disclose or misuse intellectual property, or otherwise fail to meet expectations, we could experience decreased conversion, operational disruptions, increased costs, reduced margins, customer dissatisfaction, negative publicity, or harm to our brand and competitive position. Increased use of AI may additionally result in cybersecurity, data privacy, and labor and employment risks.

Read in the 10-K filed Feb 18, 2026 ↗

The use of AI and related technology may also increase exposure to reputational, cybersecurity, data privacy, legal, regulatory and operational risks as AI technology rapidly evolves along with public opinion concerning the use of AI and the associated legal and regulatory framework. These risks include, but are not limited to, heightened exposure to cybersecurity incidents or the misuse of data during the integration of AI models and large data sets; increased potential liability and costs associated with complying with rapidly emerging regulatory frameworks; costs and competitive disadvantages associated with the failure to properly integrate AI into existing operations; and reputational harm caused by actual or perceived failures in the performance of AI or AI-related technology.

Read in the 10-K filed Feb 10, 2026 ↗

Chevron is incorporating artificial intelligence technologies into its processes and these technologies may present business, compliance, and reputational risks The company is increasingly utilizing artificial intelligence (“AI”) technologies in certain of its processes, information systems and various operations, and expects that AI will assume a more critical role in its operations over time. The use of AI technologies introduces certain risks to the company, including potential dependency on biased or incorrect AI outputs, new or enhanced regulatory requirements, litigation, privacy risks, cybersecurity risks, reputational harm, liability or other adverse consequences, any of which could adversely affect its business, financial condition and results of operations. Additionally, other unforeseen risks stemming from either the company’s or third-party service providers’ use and development of AI tools and technologies, or the company’s inability to adopt such technologies at the same pace as its competitors, may arise in the future that could adversely affect its business and results of operations.

Read in the 10-K filed Feb 24, 2026 ↗

Our reliance on third-party vendors, contractors, and SaaS providers creates additional cybersecurity risks. Many of our critical business operations depend on external providers for hosting, cloud services, data analytics, customer support, and other key functions. If these third parties experience a cybersecurity incident, fail to implement adequate security measures, misconfigure their systems, or otherwise do not comply with our security, privacy, or contractual requirements, our systems and data could be exposed to unauthorized access, loss, or misuse, resulting in significant operational disruption, regulatory scrutiny, financial losses, or reputational harm.

Read in the 10-K filed Feb 18, 2026 ↗

Certain jurisdictions impose regulatory obligations focused on cybersecurity resilience, system availability, and incident response. For example, in the European Union, the Network and Information Security Directive (EU) 2022/2555 (“NIS2”), and in the United Kingdom, the Network and Information Systems Regulations 2018, establish requirements related to risk management, security incident reporting, and business continuity for certain entities. Failure to comply with these frameworks may result in significant administrative fines, enforcement actions, and operational restrictions.

Read in the 10-K filed Feb 18, 2026 ↗

or equipment, cyber-security incidents, power outages or similar problems. Any significant disruption to our

Read in the 10-K filed May 22, 2026 ↗

Cybersecurity threats continue to evolve in frequency and sophistication, and our reliance on interconnected

Read in the 10-K filed May 22, 2026 ↗

A cyber-attack, data security incident, or system disruption could materially and adversely affect our business if:

Read in the 10-K filed May 22, 2026 ↗

If we or our service providers experience a security breach or cyberattack and unauthorized parties obtain access to our digital assets, or if our private keys are lost or destroyed, or other similar circumstances or events occur, we may lose some or all of our digital assets and our financial condition and results of operations could be materially adversely affected.

Read in the 10-K filed Mar 30, 2026 ↗

Substantially all of the digital assets we own are held in custody accounts at U.S. institutional digital asset custodians. Security breaches and cyberattacks are of particular concern with respect to our digital assets. Solana and other blockchain cryptocurrencies and the entities that provide services to participants in the Solana ecosystem have been, and may in the future be, subject to security breaches, cyberattacks, or other malicious activities. For example, in October 2021 it was reported that hackers exploited a flaw in the account recovery process and stole from the accounts of at least 6,000 customers of the Coinbase exchange, although the flaw was subsequently fixed and Coinbase reimbursed affected customers. Similarly, in November 2022, hackers exploited weaknesses in the security architecture of the FTX Trading digital asset exchange and reportedly stole over $400 million in digital assets from customers. A successful security breach or cyberattack could result in:

Read in the 10-K filed Mar 30, 2026 ↗

Further, any actual or perceived data security breach or cybersecurity attack directed at other companies with digital assets or companies that operate digital asset networks, regardless of whether we are directly impacted, could lead to a general loss of confidence in the broader Solana ecosystem or in the use of the Solana Network to conduct financial transactions, which could negatively impact us.

Read in the 10-K filed Mar 30, 2026 ↗

Attacks upon systems across a variety of industries, including industries related to Solana, are increasing in frequency, persistence, and sophistication, and, in many cases, are being conducted by sophisticated, well organized groups and individuals, including state actors. The techniques used to obtain unauthorized, improper or illegal access to systems and information (including personal data and digital assets), disable or degrade services, or sabotage systems are constantly evolving, may be difficult to detect quickly, and often are not recognized or detected until after they have been launched against a target. These attacks may occur on our systems or those of our third-party service providers or partners. We may experience breaches of our security measures due to human error, malfeasance, insider threats, system errors or vulnerabilities or other irregularities. In particular, we expect that unauthorized parties will attempt to gain access to our systems and facilities, as well as those of our partners and third-party service providers, through various means, such as hacking, social engineering, phishing and fraud. Threats can come from a variety of sources, including criminal hackers, hacktivists, state intrusions, industrial espionage, and insiders. In addition, certain types of attacks could harm us even if our systems are left undisturbed. For example, certain threats are designed to remain dormant or undetectable, sometimes for extended periods of time, or until launched against a target and we may not be able to implement adequate preventative measures. Further, there has been an increase in such activities due to the increase in remote work arrangements. The risk of cyberattacks could also be increased by

Read in the 10-K filed Mar 30, 2026 ↗

The Company may also be susceptible to cybersecurity threats through its third-party service providers. For example, our independent public accounting firm was subject to a data breach and, while there is no determination of the effect on the Company of the breach, the Company continues to evaluate such effects.

Read in the 10-K filed Feb 27, 2026 ↗

Cronos’ value and trading liquidity are closely associated with the reputation of and interest in the Cronos blockchain ecosystem and its sponsors and service providers, such as Crypto.com. Adverse developments involving those parties—including business setbacks, policy changes, cybersecurity incidents, or regulator actions related to the Cronos network—could reduce demand for Cronos, restricting trading venues, or negatively affecting perceptions of the token and the Cronos network.

Read in the 10-K filed Feb 27, 2026 ↗

Negative perception, a lack of stability in the broader bitcoin markets and the closure, temporary shutdown or operational disruption of bitcoin trading venues, lending institutions, institutional investors, institutional miners, custodians, or other major participants in the bitcoin ecosystem, due to fraud, business failure, cybersecurity events, government-mandated regulation, bankruptcy, or for any other reason, may result in a decline in confidence in bitcoin and the broader bitcoin ecosystem and greater volatility in the price of bitcoin. For example, in 2022, each of Celsius Network, Voyager Digital, Three Arrows Capital, FTX, and BlockFi filed for bankruptcy, following which the market prices of bitcoin and other digital assets significantly declined. In addition, in June 2023, the SEC announced enforcement actions against Coinbase, Inc., and Binance Holdings Ltd., two providers of large trading venues for digital assets, which similarly was followed by a decrease in the market price of bitcoin and other digital assets. These were followed in November 2023, by an SEC enforcement action against Payward Inc. and Payward Ventures Inc., together known as Kraken, another large trading venue for digital assets. Although these complaints were ultimately dismissed, the SEC or other regulatory agencies may initiate similar actions in the future. As the price of our listed securities is affected by the value of our bitcoin holdings, the failure of a major participant in the bitcoin ecosystem could have a material adverse effect on the market price of our listed securities.

Read in the 10-K filed Feb 27, 2026 ↗

If we or our third-party service providers experience a security breach or cyberattack and unauthorized parties obtain access to our bitcoin or Cronos, or if our private keys are lost or destroyed, or other similar circumstances or events occur, we may lose some or all of our digital assets and our financial condition and results of operations could be materially adversely affected.

Read in the 10-K filed Feb 27, 2026 ↗

Substantially all of the bitcoin and Cronos we own will be held in custody accounts at institutional-grade digital asset custodians. Security breaches and cyberattacks are of particular concern with respect to our digital assets. Digital assets such as bitcoin and Cronos, and the entities that provide services to participants in the broader blockchain ecosystem have been, and may in the future be, subject to security breaches, cyberattacks, or other malicious activities. For example, in October 2021 it was reported that hackers exploited a flaw in the account recovery process and stole from the accounts of at least 6,000 customers of the Coinbase exchange, although the flaw was subsequently fixed and Coinbase reimbursed affected customers. Similarly, in November 2022, hackers exploited weaknesses in the security architecture of the FTX Trading digital asset exchange and reportedly stole over $400 million in digital assets from customers. In 2025, Coinbase reported that criminals bribed certain of its non-U.S. employees to steal customer data to use in social engineering attacks. A successful security breach or cyberattack could result in:

Read in the 10-K filed Feb 27, 2026 ↗

Further, any actual or perceived data security breach or cybersecurity attack directed at other companies with digital assets or companies that operate digital asset networks, regardless of whether we are directly impacted, could lead to a general loss of confidence in the broader digital asset blockchain ecosystem, including bitcoin and Cronos networks to conduct financial transactions, which could negatively impact us.

Read in the 10-K filed Feb 27, 2026 ↗

Attacks upon systems across a variety of industries, including industries related to digital assets, are increasing in frequency, persistence, and sophistication, and, in many cases, are being conducted by sophisticated, well-funded and organized groups and individuals, including state actors. Emerging risks, such as AI-driven cyberattacks and the potential for quantum computing, could introduce new vulnerabilities in our systems, potentially rendering traditional cryptographic techniques less effective and exposing us to more sophisticated forms of cyberattacks. The techniques used to obtain unauthorized, improper or illegal access to systems and information (including personal data and digital assets), disable or degrade services, or sabotage systems are constantly evolving, may be difficult to detect quickly, and often are not recognized or detected until after they have been launched against a target. Novel methods, such as those utilizing AI or quantum computing, may be even more difficult to detect and defend against. These attacks may occur on our systems or those of our third-party service providers or partners. We may experience breaches of our security measures due to human error, malfeasance, insider threats, system errors or vulnerabilities or other irregularities. In particular, unauthorized parties have attempted, and we expect that they will continue to attempt, to gain access to our systems and facilities, as well as those of our partners and third-party service providers, through various means, such as hacking, social engineering, phishing and fraud. Threats can come from a variety of sources, including criminal hackers, hacktivists, state-sponsored intrusions, industrial espionage, and insiders. In addition, certain types of attacks could harm us even if our systems are left undisturbed. For example, certain threats are designed to remain dormant or undetectable, sometimes for extended periods of time, or until launched against a target and we may not be able to implement adequate preventative measures. Further, there has been an increase in such activities due to the increase in work-from-home arrangements since the onset of the COVID-19 pandemic. The risk of cyberattacks could also be increased by cyberwarfare in connection with geopolitical conflicts, such as the ongoing Russia-Ukraine conflict, including potential proliferation of malware into systems unrelated to such conflicts. As of the date of this Annual Report, neither we nor any of our service providers has experienced a security breach or cyberattack that has materially impacted our digital asset holdings, financial condition or operating results; however, any future breach of our operations or those of our service providers or others in the digital asset industry could materially and adversely affect our business.

Read in the 10-K filed Feb 27, 2026 ↗

Bitcoin and Cronos are controllable only by the possessor of both the unique public key and private key(s) relating to the local or online digital wallet in which the digital assets are held. While the blockchain ledger relevant to such assets requires a public key relating to a digital wallet to be published when used in a transaction, private keys must be safeguarded and kept private in order to prevent a third party from accessing the digital assets held in such wallet. To the extent the private key(s) for a digital wallet are lost, destroyed, or otherwise compromised and no backup of the private key(s) is accessible, neither we nor our custodians will be able to access the digital assets held in the related digital wallet. Furthermore, we cannot provide assurance that our digital wallets, nor the digital wallets of our custodians held on our behalf, will not be compromised as a result of a cyberattack. The bitcoin and blockchain ledger, as well as other digital assets and blockchain technologies, have been, and may in the future be, subject to security breaches, cyberattacks, or other malicious activities.

Read in the 10-K filed Feb 27, 2026 ↗

For additional discussion of the company’s cybersecurity posture, including risk management and governance, please see “Item 1C. Cybersecurity.”

Read in the 10-K filed Mar 16, 2026 ↗

Our business depends significantly on effective information systems. Our information systems require an ongoing commitment of significant resources to maintain, upgrade and enhance existing systems and develop or contract for new systems in order to keep pace with an evolving cyber threat landscape in information processing technology, emerging cybersecurity risks and threats, evolving industry, legal and regulatory standards and requirements, new models of care, and other changes in our business, among other things. For example, in the clinical environment, any failure of our clinical systems or the systems of our third-party service providers could adversely impact the clinical care provided to patients, and any failure to accurately capture relevant claims data or any data integrity issues in our clinical systems with respect information reported

Read in the 10-K filed Feb 11, 2026 ↗

Moreover, we are subject to various operational, compliance, and reputational risks associated with our adoption and utilization of AI technologies, including inaccurate or unpredictable outputs, such as errors or hallucinations, that may impair decision‑making, disrupt operations, or expose sensitive information. Integrating AI into our systems may also expand our cybersecurity attack surface, increasing exposure to data breaches, loss of intellectual property, or inadvertent disclosure of confidential data. Although we have taken steps intended to mitigate risks related to our use of AI, there can be no assurance that our use of AI will yield the anticipated benefits or that we will be able to effectively mitigate the associated risks. Externally, the rapid adoption of AI by competitors and malicious actors heightens risks as threat actors leverage AI to execute more sophisticated cyberattacks and social‑engineering campaigns, while competitor use of AI may accelerate innovation cycles and intensify competitive pressures. Any of these events could have a material adverse effect on our business, financial condition and results of operations.

Read in the 10-K filed Feb 12, 2026 ↗

FERC, North American Electric Reliability Corporation, TSA, Cybersecurity and Infrastructure Security Agency, NYSPSC, and United States Coast Guard on a regular basis, with at least one regulatory agency conducting an audit periodically.

Read in the 10-K filed Feb 19, 2026 ↗

We are exposed to unpredictable catastrophic events, including, but not limited to, weather-related and other natural catastrophes, as well as acts of terrorism, wars, pandemics, political instability and significant cyber or operational incidents.

Read in the 10-K filed Feb 26, 2026 ↗

For additional information on our strategy and processes for assessing, identifying, and managing the risks posed by cybersecurity threats, and the management and oversight of such efforts, refer to Part I, Item 1C. Cybersecurity.

Read in the 10-K filed Feb 26, 2026 ↗

Furthermore, we use artificial intelligence technologies in our business and there are significant information technology risks involved in maintaining and deploying these technologies. There can be no assurance that our investments in such technologies will always enhance our services or be beneficial to our business, including our efficiency or profitability. In particular, if the models underlying our artificial intelligence technologies are: incorrectly designed or implemented; trained or reliant on incomplete, inadequate, inaccurate, biased or otherwise poor quality data; used without sufficient oversight, governance or in violation of our internal guidelines, policies and procedures; and/or adversely impacted by unforeseen defects, technical challenges, cybersecurity threats, data privacy concerns, or material performance issues, the performance of our services and business, as well as our reputation, could suffer or we could incur liability resulting from the violation of laws or contracts to which we are a party or civil claims.

Read in the 10-K filed Feb 20, 2026 ↗

Recent technological advances in artificial intelligence (AI) and machine-learning technology have presented opportunities for us to drive internal efficiencies in our business operations, but they also pose risks to us. If we fail to keep pace with rapidly evolving technological developments in AI, our competitive position and business results may suffer, particularly if our competitors more effectively use AI to drive their business efficiencies or create new or enhanced products or services that we are unable to compete against on cost, quality or other attributes. However, the introduction of AI technologies, particularly generative AI, into internal processes and/or new and existing offerings may result in new or expanded risks and liabilities, including due to enhanced governmental or regulatory scrutiny, litigation, compliance issues, ethical concerns, confidentiality or security risks, as well as other factors that could adversely affect our business, reputation, and financial results. Furthermore, any confidential information that is disclosed to a third-party generative AI platform could be leaked or disclosed to others, which could result in loss or theft of intellectual property, as well as subject us to risks related to intellectual property infringement or misappropriation, data privacy and cybersecurity. Moreover, the use of AI may give rise to risks related to harmful content, accuracy, and bias, which could expose us to risks related to inaccuracies or errors in the output of such technologies. The rapidly evolving legal and regulatory environment relating to AI, in the United States and globally, could also impact Eaton’s implementation of AI technology, and increase compliance costs and the risk of non-compliance.

Read in the 10-K filed Feb 26, 2026 ↗

We use AI and other emerging technologies in various facets of our operations and our business. The legal and regulatory landscape surrounding AI technologies is rapidly evolving and uncertain. The rapid advancement of these technologies entails risks, including potential deficiencies in AI-generated information and increased regulatory, cybersecurity, privacy, intellectual property and data-related risks. Another risk may arise if we are unable to timely utilize AI for technological innovation and business operation efficiency in a manner that is faster and more effective than our competitors. In addition, compliance with new or changing laws, regulations or industry standards relating to AI may impose significant costs on us and limit our ability to effectively develop, deploy or use AI technologies. Furthermore, if we are unable to effectively manage the use of AI technologies by our employees and service providers, our confidential information, intellectual property and reputation could be put at risk. Failure to appropriately respond to this evolving landscape may result in reputational, competitive and business harm as well as litigation and regulatory action and fines, penalties and expenses related thereto.

Read in the 10-K filed Feb 25, 2026 ↗

or delays in our cloud or internal infrastructure or third-party services and cybersecurity incidents such as attacks on our

Read in the 10-K filed Mar 11, 2026 ↗

cybersecurity threats which may include attacks from malicious third parties, viruses, ransomware and other malicious

Read in the 10-K filed Mar 11, 2026 ↗

The cybersecurity threat landscape is rapidly evolving and has become increasingly sophisticated, and we may not be

Read in the 10-K filed Mar 11, 2026 ↗

successful in preventing or mitigating cybersecurity threats that could have a material adverse effect on us despite our

Read in the 10-K filed Mar 11, 2026 ↗

delay in or failure to detect a cybersecurity incident, or the full extent of an incident, could exacerbate its effects. We may

Read in the 10-K filed Mar 11, 2026 ↗

digital assets held at these platforms makes them appealing targets for hackers and a number of digital asset trading

Read in the 10-K filed Mar 11, 2026 ↗

do not provide the public with significant information regarding their management team, corporate practices, cybersecurity,

Read in the 10-K filed Mar 11, 2026 ↗

cybersecurity and data privacy. We could also inherit unforeseen liabilities, credit or compliance issues, or adverse

Read in the 10-K filed Mar 11, 2026 ↗

or anyone’s control. If Everstake or smart contracts fail to operate as expected, suffer cybersecurity attacks, experience

Read in the 10-K filed Mar 11, 2026 ↗

issues, cybersecurity incidents, disruptions, interruptions, and other misconduct of which we are not aware. Should any of

Read in the 10-K filed Mar 11, 2026 ↗

Cybersecurity & IP Vulnerabilities: Increased attack surface and potential leakage of sensitive customer data or proprietary technology during integration or partnership, damaging trust and incurring costs;

Read in the 10-K filed Feb 13, 2026 ↗

Uncertainty around the safety and security of new and emerging AI applications may require additional investment in the development of proprietary datasets, machine learning models and systems to test for security, accuracy, bias and other variables, which are often complex, may be costly and could impact our operating results. Cybersecurity threat actors may also utilize AI tools to automate and enhance cybersecurity attacks against us and could lead to data breaches, loss of confidential or sensitive information, and financial or reputational harm.

Read in the 10-K filed Feb 20, 2026 ↗

•Failure to comply with cybersecurity and data privacy laws and regulations could have a material effect on our reputation, results of operations or financial loss.

Read in the 10-K filed Feb 25, 2026 ↗

Additionally, the development, deployment and use of artificial intelligence (“AI”) and machine learning in our operations and those of our service providers and partners could introduce new risks, including increased exposure to cybersecurity threats and social engineering, inadvertent disclosure or misuse of confidential, proprietary or personal information, errors, bias or other unexpected outcomes in AI outputs used for operational decision‑making, and evolving and potentially divergent regulatory requirements that may restrict certain uses of AI or increase compliance costs. AI adoption may require significant investment, specialized talent and access to high‑quality data, and our competitors may adopt AI more effectively than we do. Failures or limitations in AI tools, misuse by employees or third parties, or disruptions or breaches involving AI‑enabled systems could adversely affect our business, reputation, financial condition and results of operations.

Read in the 10-K filed Feb 25, 2026 ↗

Failure to comply with cybersecurity and data privacy laws and regulations could have a material adverse effect on our reputation, results of operations or financial condition.

Read in the 10-K filed Feb 25, 2026 ↗

Cyber-attacks continue to evolve in sophistication, frequency and volume, including as threat actors exploit generative and agentic AI to discover and exploit vulnerabilities at unprecedented speed and scale, and may be difficult to detect for long periods of time. Our protective measures, and those of the third parties to which we are connected, may not be effective, and a failure by our clients or third-party providers to notify us of an incident in a timely manner could delay our response and increase the resulting harm. As a result, we may not be able to anticipate, prevent or detect all attacks, and we are exposed to heightened risks of cyber-attacks or other security incidents. In addition, future advances in computing, including quantum computing, could weaken or render obsolete the encryption and other security measures on which we and our third parties rely, including through the potential future decryption of data captured today.

Read in the 10-K filed Oct 20, 2026 ↗

Although we do not believe the cyber incidents and other systems disruptions that we and our third-party service providers have experienced to date have had a material effect on our business, there is no guarantee that a future cybersecurity threat or incident will be detected and remediated to not materially and adversely affect our business strategy, reputation, results of operations, or financial condition. While we believe we devote significant resources to network security, disaster recovery, employee training and other measures to secure our information technology systems and prevent unauthorized access to or loss of data, there are no guarantees that they will be adequate to safeguard against all cyber incidents, systems disruptions, system compromises or misuses of data.

Read in the 10-K filed Jul 20, 2026 ↗

We are increasingly utilizing AI within our operations. The development and deployment of AI technologies involve significant risks and uncertainties, and our ability to successfully implement and use AI technologies depends on a variety of factors, including the reliability, accuracy, security, and effectiveness of the technologies; the availability of qualified personnel and technical infrastructure; the performance of third-party vendors and service providers; evolving regulatory requirements and industry standards; and customer and market acceptance. AI technologies are rapidly evolving and may produce inaccurate, flawed, or unintended outputs or outcomes. Our use of AI may also increase risks related to cybersecurity, data privacy, intellectual property, confidentiality, regulatory compliance, and reputational harm. In addition, evolving laws, regulations, and governmental guidance relating to AI may require us to incur additional compliance costs, change our business practices, or limit our ability to develop or use AI technologies. Our competitors may also adopt AI technologies more quickly or more effectively than we do. Further, our investments in AI technologies may not improve our services, operations, efficiency, or profitability to the extent anticipated and may divert resources from other strategic initiatives. Any failure to successfully develop, implement, manage, or use AI technologies in a timely, compliant, and responsible manner could adversely affect our business, reputation, results of operations, or financial condition.

Read in the 10-K filed Jul 20, 2026 ↗

•The Cyber Incident has had and may continue to have an adverse effect on our business, reputation, customer, employee and partner relations, results of operations, financial condition and cash flows;

Read in the 10-K filed Nov 25, 2025 ↗

The Cyber Incident has had and may continue to have an adverse effect on our business, reputation, customer, employee and partner relations, results of operations, financial condition and cash flows

Read in the 10-K filed Nov 25, 2025 ↗

The Cyber Incident may harm our reputation, our customers, employee and partner relations and our operations and business. Customers may in the future defer purchasing or choose to cancel or not renew their agreements or subscriptions with us.

Read in the 10-K filed Nov 25, 2025 ↗

We may expend significant costs and expenses related to the Cyber Incident including in connection with our investigations, and to address the damage to our reputation, customer, employee and partner relations. If we are unable to maintain the trust of our current and prospective customers and partners, or our personnel continue to have to devote significant time to the Cyber Incident, our business, market share, results of operations and financial condition could be negatively affected.

Read in the 10-K filed Nov 25, 2025 ↗

As a result of the Cyber Incident and market forces beyond our control, the cost of our insurance may increase substantially, and we may not be able to obtain additional or comparable insurance coverage on commercially reasonable terms. In addition, governmental authorities investigating the Cyber Incident may seek to impose undertakings, injunctive relief, consent decrees, or other civil or criminal penalties, which could, among other things, materially increase our software development and related expenses or otherwise require us to alter how we operate our business. Further, any legislative or regulatory changes adopted in reaction to the Cyber Incident could require us to make modifications to the operation of our business that could have an adverse effect or increase or accelerate our compliance costs.

Read in the 10-K filed Nov 25, 2025 ↗

We have not seen any evidence of modification to our software supply chain, including our source code and our build release pipelines. We have confirmed that the threat actor exfiltrated files from our BIG-IP product development environment and engineering knowledge management platform. The discovery of new or different information regarding the Cyber Incident, including with respect to its scope and impact on our systems, products or customers, could increase our costs and liabilities related to the Cyber Incident and result in further damage to our business, reputation, intellectual property, results of operations and financial condition. The Cyber Incident also may embolden other threat actors to further target our systems, which could result in additional harm to our business. We cannot ensure that our steps to secure our systems, our product development environments and protect the security and integrity of the products that we deliver will be successful to protect against threat actors or cyberattacks or perceived by existing and prospective customers as sufficient to address the harm caused by the Cyber Incident.

Read in the 10-K filed Nov 25, 2025 ↗

•Laws and regulations that apply to technology services and cloud-hosted services, and related digital and cyber resiliency, operational continuity, and data processing requirements, including contract termination rights (e.g., the EU Digital Operational Resilience Act, the EU Cyber Resilience Act, and the EU Data Act);

Read in the 10-K filed Nov 6, 2026 ↗

BRICS countries are working to reduce their reliance on the U.S. dollar and Western financial infrastructure due to sanctions, wars, and tariffs. BRICS is an international organization currently comprised of 11 countries, including Brazil, Russia, India, China, South Africa, Saudi Arabia, Egypt, United Arab Emirates, Ethiopia, Indonesia, and Iran. Intelligence sources, along with peer assessments and other observers, suggest that cyber actors from some of the BRICS countries may conduct attacks on payment infrastructure, including third-party fintech services, to undermine trust in the Western financial infrastructure.

Read in the 10-K filed Feb 24, 2026 ↗

affects one segment of the financial services industry could also impact Fifth Third. The prospect that AI may be used to conduct attacks may make them more difficult to detect. Additionally, the growing sophistication of AI increases the risk of cyber-attacks.

Read in the 10-K filed Feb 24, 2026 ↗

For more detail on Fifth Third’s cybersecurity governance structure and practices, see Item 1C of this Annual Report.

Read in the 10-K filed Feb 24, 2026 ↗

We face numerous and evolving cybersecurity risks that threaten the confidentiality, integrity and availability of our IT Systems and Confidential Information, including from diverse threat actors, such as state-sponsored organizations, opportunistic hackers and hacktivists, as well as through diverse attack vectors, such as social engineering/phishing, malware (including ransomware), malfeasance by insiders, human or technological error (including the misuse of artificial intelligence tools by our employees), and as a result of malicious code embedded in open-source software, or misconfigurations, bugs or other vulnerabilities in commercial software that is integrated into our (or our suppliers’ or service providers’) IT Systems, products or services. Because we make extensive use of third-party suppliers and service providers, such as cloud services that support our internal and customer-facing operations, successful cyberattacks that disrupt or result in unauthorized access to third party IT Systems can materially impact our operations and financial results. Remote and hybrid working arrangements at the Company (and at many third-party providers) also increase cybersecurity risks due to the challenges associated with managing remote computing assets and security vulnerabilities that are present in many non-corporate and home networks. Additionally, any integration of artificial intelligence in our or any service providers’ operations, products or services is expected to pose new or unknown cybersecurity risks and challenges. Any circumvention or failure of our cybersecurity defenses or measures could compromise the confidentiality, integrity, and availability of our customers’ own IT Systems and/or Confidential Information as well.

Read in the 10-K filed Feb 19, 2026 ↗

•A breach of our IT or physical security systems, or a cybersecurity incident affecting our operations, products, or third parties upon which we rely, could materially disrupt our business, damage our reputation, and expose us to significant costs and liability.

Read in the 10-K filed May 20, 2026 ↗

•Failure to comply with data privacy and cybersecurity laws and regulations could expose us to government enforcement, significant penalties, civil litigation, and reputational harm.

Read in the 10-K filed May 20, 2026 ↗

A breach of our IT or physical security systems, or a cybersecurity incident affecting our operations, products, or third parties upon which we rely, could materially disrupt our business, damage our reputation, and expose us to significant costs and liability.

Read in the 10-K filed May 20, 2026 ↗

We are incorporating AI solutions into aspects of our business, including our manufacturing operations, design and engineering services, and internal processes, and we also rely on AI tools used by our employees, vendors, or other third parties. AI technologies are complex and rapidly evolving, and our business may be adversely affected if we are unable to successfully integrate AI into our operations, products, and services in a timely and cost-effective manner. AI is subject to increasing regulatory, legal, and ethical scrutiny, and its use may give rise to risks related to accuracy, bias, intellectual property infringement or misappropriation, data privacy, cybersecurity, and compliance with evolving laws and regulations.

Read in the 10-K filed May 20, 2026 ↗

Failure to comply with data privacy and cybersecurity laws and regulations could expose us to government enforcement, significant penalties, civil litigation, and reputational harm.

Read in the 10-K filed May 20, 2026 ↗

Any actual or perceived failure to comply with applicable data privacy or cybersecurity laws, related contractual obligations, or other data protection standards, whether by us, a third-party service provider, or another party, could result in government inquiries, regulatory investigations, significant fines and penalties, orders to cease or modify our data practices, damages for contract breach, and civil litigation, as well as harm to our reputation and market position. We may also be required to invest significant additional resources to comply with evolving cybersecurity and AI-related regulations and to modify and enhance our information systems and controls. Our liability insurance may not be sufficient in type or amount to cover us against all claims related to privacy violations or regulatory non-compliance.

Read in the 10-K filed May 20, 2026 ↗

Cloud services, content delivery and other networks, information systems and other technologies that we or our vendors or other partners use, including AI-enabled technologies and technology systems used in connection with the production and distribution of our content (the “Systems”), are critical to our business activities, and shutdowns or disruptions of, and cybersecurity attacks on, the Systems pose increasing risks. Disruptions to the Systems, such as computer hacking and phishing, theft, computer viruses, ransomware, worms or other destructive software, process breakdowns, denial of service attacks or other malicious activities, as well as power outages, natural or other disasters (including extreme weather), human error, terrorist and/or

Read in the 10-K filed Aug 6, 2026 ↗

In addition to the GDPR, the EU has also enacted legislation that would regulate non-personal data and establish new cybersecurity standards, and other countries, including the U.K., may similarly do so in the future. In particular, the EU Data Act went into effect in 2024 and imposes certain data and cloud service interoperability and switching obligations to enable users to switch between cloud service providers (as well as certain requirements concerning cross-border international transfers of non-personal data outside the EEA). Additionally, the EU’s Network and Information Security Directive II, adopted in 2023, regulates resilience and incident response capabilities of entities operating in a number of sectors, including the digital infrastructure sector and provides for EU member states to have issued implementing legislation by October 2024. Further, DORA became effective in January 2025 and imposes certain requirements on entities in the financial sector and their third-party cloud service providers related to managing and mitigating information and communication technology risk. If we are unable to transfer data, including personal data, between and among countries and regions in which we operate, or are otherwise required to modify our practices, including our data privacy and security controls and procedures, it could affect the manner in which we provide our services, the geographical location or segregation of our relevant systems and operations, and could adversely affect our financial results.

Read in the 10-K filed Feb 25, 2026 ↗

Our shift towards a SOL treasury-focused strategy, including staking, liquid staking, and other decentralized finance activities, exposes us to significant operational risks. To participate in Solana’s Proof-of-Stake consensus mechanism, we must either operate or delegate to validator nodes, and such validator nodes must keep software updated, maintain validator uptime and employ secure key management. In addition, the Solana ecosystem rapidly evolves, with frequent upgrades and protocol changes that may require significant adjustments to our operational setup if we are operating a validator node. The upgrades and protocol changes may require that we incur unanticipated costs and could cause temporary service disruptions to the Solana network. We may also need to employ third-party service providers in our operations, which may introduce risks outside of our control, including significant cybersecurity risks. Any of these operational risks could materially and adversely affect our ability to execute our SOL treasury strategy and may prevent us from realizing positive returns and could severely hurt our financial condition.

Read in the 10-K filed Dec 11, 2025 ↗

Negative perception, a lack of stability in the broader digital asset markets and the closure, temporary shutdown or operational disruption of digital asset trading venues, lending institutions, institutional investors, institutional miners, custodians, or other major participants in the digital asset ecosystem, due to fraud, business failure, cybersecurity events, government-mandated regulation, bankruptcy, or for any other reason, may result in a decline in confidence in digital assets and the broader digital asset ecosystem and greater volatility in the price of digital assets. The price of our listed securities may be affected by the value of our future digital asset holdings, and the failure of a major participant in the ecosystem could have a material adverse effect on the market price of our listed securities.

Read in the 10-K filed Dec 11, 2025 ↗

Digital asset lending arrangements may expose us to risks of borrower default, operational failures and cybersecurity threats.

Read in the 10-K filed Dec 11, 2025 ↗

Additionally, digital asset lending platforms are vulnerable to operational and cybersecurity risks. Technical failures, software bugs or system outages could disrupt lending activities, delay transactions or result in inaccurate record-keeping. Cybersecurity threats, including hacking, phishing and other malicious attacks, pose further risks, potentially leading to the loss, theft or misappropriation of our loaned SOL. A successful cyberattack or security breach could materially and adversely impact our financial position, reputation and ability to conduct future lending activities.

Read in the 10-K filed Dec 11, 2025 ↗

Decentralized finance arrangements may expose us to risks of smart contract risk, operational failures and cybersecurity threats.

Read in the 10-K filed Dec 11, 2025 ↗

The Company will face risks relating to the custody of its digital assets. If we or our third-party service providers experience a security breach or cyberattack and unauthorized parties obtain access to our private keys, or if our private keys are lost or destroyed, or other similar circumstances or events occur, we may lose some or all of our digital assets and our financial condition and results of operations could be materially adversely affected.

Read in the 10-K filed Dec 11, 2025 ↗

A cyberattack or other malicious attack on the Solana blockchain could have a material impact on the value of SOL held by the Company.

Read in the 10-K filed Dec 11, 2025 ↗

Solana and other digital assets and the entities that provide services to participants in blockchain ecosystems have been, and may in the future be, subject to security breaches, cyberattacks, or other malicious activities. For example, in October 2021 it was reported that hackers exploited a flaw in the account recovery process and stole from the accounts of at least 6,000 customers of the Coinbase exchange, although the flaw was subsequently fixed and Coinbase reimbursed affected customers. Similarly, in November 2022, hackers exploited weaknesses in the security architecture of the FTX Trading digital asset exchange and reportedly stole over $400 million in digital assets from customers. A successful security breach or cyberattack could result in:

Read in the 10-K filed Dec 11, 2025 ↗

Further, any actual or perceived data security breach or cybersecurity attack directed at other companies with digital assets or companies that operate digital asset networks, regardless of whether we are directly impacted, could lead to a general loss of confidence in the broader Solana ecosystem or in the use of the Solana network to conduct financial transactions, which could negatively impact us.

Read in the 10-K filed Dec 11, 2025 ↗

Attacks upon systems across a variety of industries, including industries related to Solana, are increasing in frequency, persistence, and sophistication, and, in many cases, are being conducted by sophisticated, well-organized groups and individuals, including state actors. The techniques used to obtain unauthorized, improper or illegal access to systems and information (including personal data and digital assets), disable or degrade services, or sabotage systems are constantly evolving, may be difficult to detect quickly, and often are not recognized or detected until after they have been launched against a target. These attacks may occur on our systems or those of our third-party service providers or partners. We may experience breaches of our security measures due to human error, malfeasance, insider threats, system errors or vulnerabilities or other irregularities. In particular, we expect that unauthorized parties will attempt to gain access to our systems and facilities, as well as those of our partners and third-party service providers, through various means, such as hacking, social engineering, phishing and fraud. Threats can come from a variety of sources, including criminal hackers, hacktivists, state intrusions, industrial espionage, and insiders. In addition, certain types of attacks could harm us even if our systems are left undisturbed. For example, certain threats are designed to remain dormant or undetectable, sometimes for extended periods of time, or until launched against a target and we may not be able to implement adequate preventative measures. The risk of cyberattacks could also be increased by cyberwarfare in connection with the ongoing Russia and Israel conflicts, or other future conflicts, including potential proliferation of malware into systems unrelated to such conflicts. Any future breach of our operations or those of others in the Solana industry, including third-party services on which we rely, could materially and adversely affect our financial condition and results of operations.

Read in the 10-K filed Dec 11, 2025 ↗

The continued adoption of new technologies across our business and by our customers and suppliers, including emerging technologies, system migrations and network transitions, also increases our exposure to cybersecurity threats. Any vulnerability or compromise in our or a third-party product (for example, open-source software) exposes our systems, networks, software or connected products to malicious actors that seek to misuse our products, steal intellectual property, misappropriate sensitive, confidential or personal data, or

Read in the 10-K filed Jan 29, 2026 ↗

•We manufacture and sell products that rely upon software and computer systems to operate properly and process and store confidential information. Our business could be adversely affected by increased cybersecurity requirements, vulnerabilities, threats, and more sophisticated and targeted cybercrimes, and our inability to obtain, maintain, protect, or effectively enforce our IP rights.

Read in the 10-K filed Feb 4, 2026 ↗

Our cyber safety and financial wellness businesses compete with a broad range of companies, including established security software vendors, operating system and platform providers, companies who specialize in a niche segment of the cyber safety market and which are expanding their portfolios into competing cyber safety products, traditional banks and credit unions, licensed and non-bank digital financial service providers, specialty finance companies, digital wealth management and brokerage platforms, embedded finance providers, financial marketplaces, and other technology companies. Many of these competitors have longer operating histories, greater brand recognition, larger customer bases, and significantly greater financial, technical, and marketing resources than we do. They may be able to offer more competitive pricing or terms, bundle products more effectively, introduce new, enhanced, broader or more specialized offerings more quickly (including for free), or respond more rapidly to technological and consumer trends. We expect our competition to continue to increase, as there are generally no substantial barriers to entry into the markets we serve.

Read in the 10-K filed May 21, 2026 ↗

Issues in the development and deployment of AI, including generative AI and emerging AI-enabled cyber threats, could expose us to regulatory, privacy, IP, cybersecurity, operational and reputational risks.

Read in the 10-K filed May 21, 2026 ↗

spikes, cyber-related attacks, or decreased availability of materials and commodities arising from war or other hostilities, natural disasters,

Read in the 10-K filed Jan 29, 2026 ↗

privacy, data protection and cybersecurity laws. Further, we expect increasingly stringent environmental and safety standards across

Read in the 10-K filed Jan 29, 2026 ↗

contractors, we must design and maintain compensation programs, employment policies, cybersecurity and other intellectual property

Read in the 10-K filed Jan 29, 2026 ↗

Risks Related to Technology, Cybersecurity, Data Privacy & Intellectual Property

Read in the 10-K filed Jan 29, 2026 ↗

Global cybersecurity threats, including malware and ransomware, human or technology errors, and attacks by state, state-affiliated actors

Read in the 10-K filed Jan 29, 2026 ↗

cybersecurity practices. Growing interconnectedness and shared liability within our ecosystem heighten our exposure to cybersecurity

Read in the 10-K filed Jan 29, 2026 ↗

risks. We also outsource certain cybersecurity functions, use managed service providers, and collaborate with GE during the transition

Read in the 10-K filed Jan 29, 2026 ↗

period that follows our Spin-Off; these arrangements increase risk due to interconnectivity and potential impacts from a cybersecurity

Read in the 10-K filed Jan 29, 2026 ↗

We rely on third-party hardware, software, and other components. A supplier’s cyber incident could interrupt component availability and our

Read in the 10-K filed Jan 29, 2026 ↗

Internationally, many jurisdictions maintain unique privacy and cybersecurity frameworks. Violations can lead to substantial fines, regulatory

Read in the 10-K filed Jan 29, 2026 ↗

manufacturing or distribution capabilities due to weather, climate change, natural disaster, fire, terrorism, cyber-attack, pandemics,

Read in the 10-K filed Jul 1, 2026 ↗

telecommunications failures, security breaches, computer viruses, hackers, employee error or malfeasance, and other causes. Increased

Read in the 10-K filed Jul 1, 2026 ↗

cyber-security threats pose a potential risk to the security and viability of our information technology systems, as well as the

Read in the 10-K filed Jul 1, 2026 ↗

We utilize multiple integrated software and hardware operating systems across our operations, including in our hospitals. Although we continually monitor these systems and strive to design our policies, programs and processes to preserve or manage these systems, such processes may not be effective and are subject to weaknesses and failures, including human error, data limitations, process delays, system outages, cybersecurity incidents or failed controls. Failure to effectively preserve or manage data accurately, timely and completely may adversely affect its quality and reliability and impair our ability to manage business needs, the provision of care, strategic decision-making and operations. We employ change management methodologies to plan, test and execute system upgrades and improvements. However, we cannot guarantee that our systems will operate as designed or that the implementation of new systems or upgrades will not be subject to excessive costs or disruptions to our operations or business.

Read in the 10-K filed Feb 10, 2026 ↗

Emerging cybersecurity regulations (including the EU Cyber Resilience Act) increasingly mandate rigorous cybersecurity standards for our products and services. These mandates may increase our operational costs by requiring additional investment in secure product development, vulnerability management, and product lifecycle management. Adapting our diverse portfolio to meet these requirements may require costly product redesigns, delay market entry for new solutions, or necessitate strategic retirement of legacy offerings. Failure to meet these standards could result in significant financial penalties, restricted market access, and reputational harm that could adversely affect our competitive position and financial results.

Read in the 10-K filed Feb 17, 2026 ↗

Possessing client assets and sensitive personal information exposes us to cybersecurity threats and data privacy obligations. A breach of our systems or those of our vendors could result in unauthorized access to confidential information, potentially triggering legal liabilities, regulatory investigations, remediation costs, and reputational harm. Continued investment in information security infrastructure and incident response protocols is necessary to mitigate this risk.

Read in the 10-K filed Feb 18, 2026 ↗

In the ordinary course of business, we store sensitive data, including intellectual property, personal data, our proprietary business information and that of our employees, contractors, customers, vendors, partners, suppliers, and other third parties with whom we do business. In addition, we store sensitive data through cloud-based services that may be hosted by third parties and in data center infrastructure maintained by third parties. We have been, and expect to be, subject to cyberattacks and other attempted intrusions into our networks and systems by a wide range of actors, including, but not limited to, nation state actors, criminal enterprises, terrorist organizations, and other organizations or individuals, as well as errors, wrongful conduct or malfeasance by employees and third-party service providers, (collectively, “malicious parties”) who have at times been able to circumvent or bypass our cyber security measures. Geopolitical tensions or conflicts may also heighten the risk of such cyberattacks or exacerbate system vulnerabilities, considering our continued hybrid work environment and our globally dispersed operations, employees, contractors, suppliers, developers, partners, and other third parties.

Read in the 10-K filed Dec 18, 2025 ↗

Additional impacts from cybersecurity incidents have included and could include reimbursement of remediation costs to our customers, suppliers, or distributors; lost revenue resulting from the unauthorized use of proprietary information or the failure to retain or attract business partners following an incident; increased insurance premiums; and damage to our competitiveness, reputation, stock price, and long-term shareholder value. To the extent we carry insurance coverage for such possibilities, we cannot be certain that any such coverage will be adequate or otherwise protect us with respect to claims, expenses, fines, penalties, business loss, data loss, litigation, regulatory actions, or other impacts arising from security breaches or incidents, or that such coverage will continue to be available on acceptable terms or at all.

Read in the 10-K filed Dec 18, 2025 ↗

The cybersecurity threat landscape is rapidly evolving and becoming increasingly sophisticated, and there can be no assurance that our controls and procedures will be sufficient to address future threats or remediate future incidents. Further, there has been an increase in the frequency and sophistication of attacks, and we expect these activities to continue to increase, including malicious actors potentially leveraging AI to develop malicious code or sophisticated phishing attempts. It is possible that such incidents may embolden other malicious actors to perpetrate future attacks that may result in material misappropriation, system disruptions or shutdowns, malicious alteration, or destruction of our confidential or personal information or that of third parties. Additionally, the proliferation of generative AI models within the internal systems, processes, and tools of HPE, our suppliers, our customers, or other third parties with whom we do business may create new attack methods for threat actors. The emergence of deepfakes and advanced social engineering tactics presents new challenges in preventing deception and unauthorized access, underscoring the importance of advanced verification and detection mechanisms. Zero-day vulnerabilities may include newly discovered security flaws in software that are exploited before patches are released, requiring proactive monitoring and immediate remediation efforts. Quantum computing may in the future present a risk to our business by potentially breaking traditional cryptographic methods on which we rely, thereby necessitating the shift to quantum-resistant encryption techniques.

Read in the 10-K filed Dec 18, 2025 ↗

Malicious parties may also be able to otherwise develop and deploy viruses, worms, ransomware, and other malicious software programs that attack our products or otherwise exploit any security vulnerabilities of our products, including within our cloud-based environments and offerings, such that we may be unable to anticipate such malicious parties’ techniques, implement adequate preventative measures, or remediate any intrusion on a timely or effective basis even if our security measures are appropriate, reasonable, and comply with applicable legal requirements. Advanced persistent threats can include

Read in the 10-K filed Dec 18, 2025 ↗

Our suppliers, vendors, partners, and other third parties with whom we do business also face similar cybersecurity threats, risks, and concerns as those set forth above, which introduces vulnerabilities to our business and operations, including our manufacturing supply chain. Although HPE requires strict cybersecurity and data controls through its contractual agreements with third parties, if these third parties do not have adequate safeguards or their safeguards fail, it may result in breaches of their systems, networks, or applications, potentially leading to breaches of our networks and systems or unauthorized access to or disclosure of our and/or our customers' confidential data, thereby compromising us and our customers. While HPE relies on independent audit reports, in addition to our own security assessments and diligence of third parties with whom we do business as part of our third-party risk management practices, these efforts may not detect or identify all cybersecurity risks or vulnerabilities.

Read in the 10-K filed Dec 18, 2025 ↗

Additionally, some of our business processes depend upon the IT systems and processes of third parties, and the interfaces between those and our IT systems, as well as hosted SaaS applications from third parties. For example, we receive a broad range of information technology services, such as applications, including support, development and maintenance; infrastructure management and support, including for server storage and network devices; and end user support. Some of these services are provided to us through cloud providers, third party providers, and off-site facilities that may be vulnerable to damage or interruption, including performance problems from earthquakes, hurricanes, floods, fires, power loss, telecommunications failures, equipment failures, adverse events caused by operator error, cybersecurity attacks, pandemics, and similar events. In addition, because we lease certain off-site data center facilities, we cannot be assured that we will be able to

Read in the 10-K filed Dec 18, 2025 ↗

The Company may be adversely impacted if the Company is affected by cybersecurity attacks or other security breaches. IT systems are an important part of the Company’s business operations. The Company also increasingly relies upon third-party service providers for a variety of business functions, including cloud-based services. The Company has programs in place to prevent, detect, contain, and respond to cyber incidents. However, the Company may be unable to anticipate security incidents, detect attacks, or implement adequate preventive measures as cyber threats continue to evolve and cyberattacks have become more sophisticated and frequent, including through the use of enhanced technologies and capabilities (such as artificial intelligence) by threat actors with a wide range of expertise and motives. For example, threat actors have increasingly targeted organizations in the U.S. and internationally with sophisticated ransomware attacks, which the Company may be unable to anticipate, detect, or contain. In addition, hardware or software that the Company develops or obtains from third parties may contain defects that could compromise the Company's IT systems. Unauthorized parties may also attempt to gain access to the Company's IT systems or facilities, or those of third parties with whom the Company does business, through fraud, deception, social engineering, or other bad acts. Errors or malicious actions by the Company's team members or contractors and other vulnerabilities or irregularities could also negate the Company's security measures or those of third parties with whom the Company does business and result in a compromise or breach of the Company's or their IT systems. The utilization of hybrid and remote work by the Company's team members, suppliers, and other third parties has amplified the Company's already extensive reliance on IT systems and unimpeded internet access. Furthermore, the training the Company conducts as part of information security and cybersecurity efforts may not be effective in preventing or limiting successful attacks.

Read in the 10-K filed Dec 5, 2025 ↗

parties with whom it does business have experienced information security, cybersecurity, and data privacy incidents. None of these incidents have had a material impact on the Company's business strategy, results of operations, or financial condition. If the Company or third parties with whom the Company does business experience additional significant information security, cybersecurity, or data privacy incidents or fail to detect and appropriately respond to significant incidents, the Company's business operations could be severely disrupted and it could be exposed to costly government enforcement actions and private litigation. In addition, the Company's customers and consumers could delay, reduce, or cease purchases of the Company's products. Any of these outcomes could adversely affect the Company's reputation, results of operations, and financial condition.

Read in the 10-K filed Dec 5, 2025 ↗

There have been, and may continue to be, changes in the legal or regulatory environment (including as a result of executive orders) affecting many areas related to the Company's business, including raw material costs and availability, energy costs and availability, workforce availability, transport costs and capacity, information security, cybersecurity, and data privacy, supply chain requirements, food safety, environmental, social, and governance matters, and climate and emissions disclosure. The ultimate impact of any changes in the legal or regulatory environment (including as a result of executive orders) is not possible to predict and could negatively affect the Company's results of operations and financial condition, including by increasing its expenses,

Read in the 10-K filed Dec 5, 2025 ↗

Digital asset lending arrangements may expose us to risks of borrower default, operational failures and cybersecurity threats.

Read in the 10-K filed Mar 31, 2026 ↗

Additionally, digital asset lending platforms are vulnerable to operational and cybersecurity risks. Technical failures, software bugs or system outages could disrupt lending activities, delay transactions or result in inaccurate record-keeping. Cybersecurity threats, including hacking, phishing and other malicious attacks, pose further risks, potentially leading to the loss, theft or misappropriation of our loaned digital asset. A successful cyberattack or security breach could materially and adversely impact our financial position, reputation and ability to conduct future lending activities.

Read in the 10-K filed Mar 31, 2026 ↗

Decentralized finance arrangements and smart contract-based protocols expose us to risks of asset loss, operational failure, and cybersecurity vulnerabilities.

Read in the 10-K filed Mar 31, 2026 ↗

The SEC has also brought recent actions against individuals and digital asset market participants alleging that such persons artificially increased trading volumes in certain digital assets through wash trades, or repeated buying and selling of the same assets in fictitious transactions to manipulate their underlying trading price. Such reports and allegations may indicate that the Solana market is significantly smaller than expected and that the United States makes up a significantly larger percentage of the Solana market than is commonly understood. Any actual or perceived wash trading in the Solana market, and any other fraudulent or manipulative acts and practices, could adversely affect the value of our Solana. Negative perception, a lack of stability in the broader Solana markets and the closure, temporary shutdown or operational disruption of Solana trading venues, lending institutions, institutional investors, institutional miners, custodians, or other major participants in the Solana ecosystem, due to fraud, business failure, cybersecurity events, government-mandated regulation, bankruptcy, or for any other reason, may result in a decline in confidence in Solana and the broader Solana ecosystem and greater volatility in the price of Solana. As the price of our listed securities is affected by the value of our Solana holdings, the failure of a major participant in the Solana ecosystem could have a material adverse effect on the market price of our listed securities.

Read in the 10-K filed Mar 31, 2026 ↗

Solana tokens are controllable only by the possessor of both the unique public key and private key(s) relating to the local or online digital wallet in which the Solana is held. While the Solana blockchain ledger requires a public key relating to a digital wallet to be published when used in a transaction, private keys must be safeguarded and kept private in order to prevent a third party from accessing the Solana held in such wallet. To the extent the private key(s) for a digital wallet are lost, destroyed, accessed by an unauthorized party, or otherwise compromised and no backup of the private key(s) is accessible, neither we nor our custodians will be able to access the Solana held in the related digital wallet. Furthermore, we cannot provide assurance that our digital wallets, nor the digital wallets of our custodians held on our behalf, will not be compromised as a result of a cyberattack. The Solana and blockchain ledger, as well as other digital assets and

Read in the 10-K filed Mar 31, 2026 ↗

blockchain technologies, have been, and may in the future be, subject to security breaches, cyberattacks, or other malicious activities. For more information on cybersecurity threats, please see the risk factor titled, “If we or the third parties with whom we work experience a security breach, cyber incident, or vulnerability impacting our systems or our data, or if unauthorized parties obtain access to our Solana, or if our private keys are lost or destroyed, or other similar circumstances or events occur, we may lose some or all of our Solana and our financial condition and results of operations could be materially adversely affected.”

Read in the 10-K filed Mar 31, 2026 ↗

If we or the third parties with whom we work experience a security breach, cyber incident, or vulnerability impacting our systems or our data, or if unauthorized parties obtain access to our Solana, or if our private keys are lost or destroyed, or other similar circumstances or events occur, we may lose some or all of our Solana and our financial condition and results of operations could be materially adversely affected.

Read in the 10-K filed Mar 31, 2026 ↗

trade secrets and our Solana (collectively, sensitive information). Cyber-attacks, malicious internet-based activity, online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of our sensitive information and information technology systems, and those of the third parties with whom we work. Such threats are prevalent and continue to rise, are increasingly difficult to detect, and come from a variety of sources, including traditional computer “hackers,” threat actors, “hacktivists,” organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors. Some actors now engage and are expected to continue to engage in cyber-attacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we, the third parties with whom we work, and our customers may be vulnerable to a heightened risk of these attacks, including retaliatory cyber-attacks, that could materially disrupt our business.

Read in the 10-K filed Mar 31, 2026 ↗

We and the third parties with whom we work are subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks, credential stuffing attacks, credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, telecommunications failures, earthquakes, fires, floods, attacks enhanced or facilitated by AI, and other similar threats. In particular, severe ransomware attacks are becoming increasingly prevalent — particularly for companies like ours that are engaged in critical infrastructure or manufacturing — and can lead to significant interruptions in our operations, ability to provide our products or services, loss of sensitive data and income, reputational harm, and diversion of and theft of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Remote work has increased risks to our information technology systems and data, as our employees utilize network connections, computers and devices outside our premises or network, including working at home, while in transit and in public locations.

Read in the 10-K filed Mar 31, 2026 ↗

investigation costs, regulatory penalties and fines, and legal proceedings. Our insurance coverage may not be adequate to cover all the costs related to such cybersecurity incidents.

Read in the 10-K filed Mar 31, 2026 ↗

Security breaches and cyberattacks are of particular concern with respect to our Solana. Solana and other blockchain-based cryptocurrencies and the entities that provide services to participants in the Solana ecosystem have been, and may in the future be, subject to security breaches, cyberattacks, or other malicious activities. For example, in October 2021 it was reported that hackers exploited a flaw in the account recovery process and stole from the accounts of at least 6,000 customers of the Coinbase exchange, although the flaw was subsequently fixed and Coinbase reimbursed affected customers. Similarly, in November 2022, hackers exploited weaknesses in the security architecture of the FTX Trading digital asset exchange and reportedly stole over $400 million in digital assets from customers. A successful security breach or cyberattack could result in:

Read in the 10-K filed Mar 31, 2026 ↗

Further, any actual or perceived data security breach or cybersecurity attack directed at other companies with digital assets or companies that operate digital asset networks, regardless of whether we are directly impacted, could lead to a general loss of confidence in the broader Solana ecosystem or in the use of the Solana network to conduct financial transactions, which could negatively impact the market price of Solana and in turn negatively impact our financial condition and results of operations and the market price of our common stock.

Read in the 10-K filed Mar 31, 2026 ↗

Tokenized HSDT would also be subject to the broader risks associated with digital assets, including cybersecurity, technological failures, and operational risks, which could affect our reputation, financial condition, and operating results. As of March 30, 2026, the Company has not issued Tokenized HSDT.

Read in the 10-K filed Mar 31, 2026 ↗

In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act) and other similar laws (e.g., wiretapping laws). For example, the federal Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), as amended by the Health Information Technology for Economic and Clinical Health Act (“HITECH”), and their respective implementing regulations, imposes requirements relating to the privacy, security and transmission of individually identifiable health information. Among other things, HITECH, through its implementing regulations, makes certain of HIPAA’s privacy and security standards directly applicable to business associates, defined as a person or organization, other than a member of a covered entity’s workforce, that creates, receives, maintains or transmits protected health information for or on behalf of a covered entity for a function or activity regulated by HIPAA as well as their covered subcontractors.

Read in the 10-K filed Mar 31, 2026 ↗

incur, and may in the future incur substantial costs as we update our cybersecurity defense systems

Read in the 10-K filed Feb 24, 2026 ↗

A cyberattack that bypasses or compromises our, or our vendors’, IS cybersecurity and/or general

Read in the 10-K filed Feb 24, 2026 ↗

be perceived as a more vulnerable target of the cyber hackers as a result of the October

Read in the 10-K filed Feb 24, 2026 ↗

In addition, Hubbell is increasingly evaluating, developing, or utilizing artificial intelligence (“AI”), including machine learning, automation, and data‑driven analytics technologies, whether internally, embedded in third‑party software products, or integrated into customer‑facing solutions. The use of AI technologies introduces additional risks related to system reliability, data integrity, transparency, governance, and security. AI‑enabled systems may also increase the Company’s exposure to cybersecurity, data privacy, and intellectual property risks.

Read in the 10-K filed Feb 12, 2026 ↗

physical and cybersecurity breaches, including security breaches of infrastructure;

Read in the 10-K filed Feb 25, 2026 ↗

Recent developments in the cyber threat landscape include use of AI and machine learning, as well as an increased number of cyber extortion and ransomware attacks, with the potential for higher ransom demand amounts and increasing sophistication, using a variety of ransomware techniques and methodology. Further, any adoption of AI by us or by third parties may pose new security challenges. A party who is able to compromise the security measures on our networks or the security of our infrastructure could misappropriate the proprietary or sensitive information of us, our customers, or our employees, or cause interruptions or malfunctions in our operations or our customers’ operations.

Read in the 10-K filed Feb 25, 2026 ↗

In addition to Bitcoin, we have acquired 100 million World Liberty Financial, Inc. tokens (the “WLFI Tokens”), which are subject to many of the same risks applicable to Bitcoin and other digital assets, including price volatility, limited liquidity, regulatory uncertainty, technological risks, cybersecurity risks, and changes in market sentiment. Unlike Bitcoin, our WLFI Tokens are subject to an indefinite lock-up, with a minimum of twelve months from the purchase date, and may not be freely transferable. The WLFI Tokens are also subject to the governance procedures of the World Liberty Financial, Inc. protocol, which may be amended or administered in the discretion of World Liberty Financial, Inc. or its affiliates. As a result, we may have limited ability to influence decisions affecting the WLFI Tokens or its underlying protocol, and the value, utility, or transferability of the WLFI Tokens could be adversely affected by governance actions or other decisions beyond our control.

Read in the 10-K filed Feb 25, 2026 ↗

impact our business. Unauthorized use or misuse of AI by the Company's employees, vendors or others may result in the disclosure of confidential Company or customer data, reputational harm, privacy law violations, cybersecurity risks, and legal liability. Additionally, while the use of AI can be beneficial to the Company, AI algorithms are currently known to sometimes produce unexpected results or behave in unpredictable ways that can generate, among other things, irrelevant, nonsensical, inaccurate, harmful, discriminatory or infringing results, which could harm the Company’s business, reputation, or result in legal or regulatory actions.

Read in the 10-K filed Feb 12, 2026 ↗

In addition to the Proposed CAM Acquisition, Howmet may continue to pursue other acquisitions and take other strategic actions to grow or streamline its portfolio. There can be no assurance that we will be able to execute upon any such acquisitions or strategic actions, or that any anticipated benefits of such acquisitions or actions will be realized. Acquisitions, including the planned Proposed CAM Acquisition, present significant operational challenges and risks, including the effective integration of the business into the Company, which may be more difficult, time consuming or more costly than expected and may divert management attention from the Company’s existing business. Acquisitions, including the Proposed CAM Acquisition, may increase operating costs, expose the Company to potential unforeseen issues and legal liabilities, including the assumption of liabilities (including unforeseen liabilities) of acquired companies or businesses, increase cybersecurity issues or vulnerabilities or result in customer loss and business disruption (including, without limitation, difficulties in retaining or maintaining relationships with employees, customers or suppliers). Any of the foregoing may adversely affect Howmet’s business, financial condition, or results of operations.

Read in the 10-K filed Feb 12, 2026 ↗

The price of HYPE has exhibited sudden and significant fluctuations due to shifts in market sentiment, speculative trading, macroeconomic trends, technology-related disruptions and regulatory announcements. Because digital asset trading markets are relatively new, largely unregulated and, at times, subject to limited liquidity, HYPE has experienced and may continue to experience larger or more frequent price swings than traditional asset classes. A rapid decrease in the price of HYPE - whether the result of negative perception, a lack of stability on the digital asset trading platforms on which HYPE trades, market manipulation of cryptocurrency trading platforms by customers, a cyber-security incident, regulatory action or other factors-could materially reduce the value of any HYPE we hold, force us to recognize impairment charges, and depress the market price of our securities.

Read in the 10-K filed Mar 30, 2026 ↗

HYPE is controllable only by the possessor of both the unique public key and private key(s) relating to the local or online digital wallet in which the HYPE is held. While the Layer 1 blockchain ledger requires a public key relating to a digital wallet to be published when used in a transaction, private keys must be safeguarded and kept private in order to prevent a third party from accessing the HYPE held in such wallet. To the extent the private key(s) for a digital wallet are lost, destroyed, or otherwise compromised and no backup of the private key(s) is accessible, neither we nor our custody infrastructure providers will be able to access the HYPE held in the related digital wallet. Furthermore, we cannot provide assurance that our digital wallets, nor the digital wallets of our custody infrastructure providers, will not be compromised as a result of a cyberattack. The HYPE and blockchain ledger, as well as other digital assets and blockchain technologies, have been, and may in the future be, subject to security breaches, cyberattacks or other malicious activities.

Read in the 10-K filed Mar 30, 2026 ↗

Negative perception, a lack of stability in the broader digital currency markets and the closure, temporary shutdown or operational disruption of HYPE trading venues, lending institutions, institutional investors, institutional miners, custodians, or other major participants in the HYPE ecosystem, due to fraud, business failure, cybersecurity events, government-mandated regulation, bankruptcy or any other reason, may result in a decline in confidence in HYPE and the broader digital currency ecosystem and greater volatility in the price of HYPE. For example, in 2022, each of Celsius Network, Voyager Digital, Three Arrows Capital, FTX and BlockFi filed for bankruptcy, following which digital assets significantly declined. In addition, in June 2023, the SEC announced enforcement actions against Coinbase and Binance, two providers of large trading venues for digital assets, which similarly was followed by a decrease in the market price of digital assets. These were followed in November 2023 by an SEC enforcement action against Payward Inc. and Payward Ventures Inc., together known as Kraken, another large trading venue for digital assets. While the complaint against Coinbase was dismissed in February 2025, the complaint against Payward Inc. and Payward Ventures Inc. was dismissed with prejudice in March 2025, and the complaint against Binance was dismissed in May 2025, the SEC or other regulatory agencies may initiate similar actions in the future. As the price of our listed securities may be affected by the value of our HYPE holdings, the failure of a major participant in the digital currency ecosystem could have a material adverse effect on the market price of our listed securities.

Read in the 10-K filed Mar 30, 2026 ↗

The secure processing, storage, maintenance and transmission of this critical information is vital to our operations and business strategy, and we devote significant resources to protecting such information. Although we take measures to protect sensitive information from unauthorized access or disclosure, our information technology and infrastructure may be vulnerable to attacks by hackers or viruses, breaches, interruptions due to employee error, malfeasance, faulty password management, lapses in compliance with privacy and

Read in the 10-K filed Mar 30, 2026 ↗

Additionally, custodial platforms are prime targets for hackers. A breach of our custody systems could lead to the theft of customer assets and unauthorized transfers, for which the company might be held liable, and traditional insurance may not adequately cover losses related to digital assets. Further, our ownership of a digital asset custody business may also involve dependencies on decentralized or other third party blockchain services and the protocols, which we do not control and in turn may expose us to new and evolving technological risks.

Read in the 10-K filed Feb 5, 2026 ↗

We, and some of our third-party vendors, have experienced cybersecurity attacks by threat actors (which may include state-sponsored organizations or nation state actors) and other cybersecurity breaches and incidents in the past, including, among other things, computer viruses and malware, ransomware, denial of service actions, phishing schemes, social engineering, the compromise, misappropriation and/or unauthorized access to (or acquisition or disclosure of) confidential or

Read in the 10-K filed Feb 20, 2026 ↗

A significant IT disruption or breach of our systems or those of our third party providers could result in loss of confidential data, operational downtime, litigation, regulatory penalties, damages, reputational harm, and substantial remediation costs. Increased reliance on cloud computing, AI, and hybrid work arrangements adds complexity and risk, including through unauthorized access or disclosure of personal and proprietary information. Integration of acquired systems and divestitures also create transitional vulnerabilities. Privacy laws such as GDPR and CCPA that allow private actions increase our litigation exposure related to potential cyber incidents.

Read in the 10-K filed Feb 27, 2026 ↗

We regularly face attempts by malicious attackers to, among other things: gain unauthorized access to our network or data centers or those of our suppliers, customers and partners; steal proprietary, personal or confidential information; sabotage or corrupt our systems or processes to design and manufacture hardware and associated software and services; interrupt operations; or demand ransom. Threats include malicious hackers, state-sponsored organizations, insider threats, including employees and third-party service providers and unauthorized physical facility access. In addition, service providers we use can experience breaches of their systems and products, or provide inadequate updates or support, which can impact the security of our systems and our proprietary or confidential information.

Read in the 10-K filed Jan 23, 2026 ↗

Our dependence on this platform also exposes us to operational and reputational risks arising from service disruptions, system outages, cybersecurity incidents, data integrity issues, or reputational harm suffered by the platform itself. Any interruption in the platform’s operations or loss of consumer trust could materially reduce leasing activity for our homes.

Read in the 10-K filed Feb 19, 2026 ↗

well as private rights of action for data breaches that may increase data breach litigation. We use internal and

Read in the 10-K filed Feb 27, 2026 ↗

create an increased risk of cybersecurity incidents. Following our regional integration, efforts may not produce the

Read in the 10-K filed Feb 27, 2026 ↗

manipulate data or disrupt operations. In this regard, we have experienced cyber threats and events from time to

Read in the 10-K filed Feb 27, 2026 ↗

current cyber threat environment, the volume and intensity of cybersecurity attacks and attempted intrusions are

Read in the 10-K filed Feb 27, 2026 ↗

platforms, software, applications, and technologies, each of which may be subject to a cybersecurity incident or

Read in the 10-K filed Feb 27, 2026 ↗

resources to verify the implementation of cybersecurity controls by our vendors and suppliers. In addition, despite

Read in the 10-K filed Feb 27, 2026 ↗

been and could again be compromised or disrupted due to factors such as employee error or malfeasance, cyber-

Read in the 10-K filed Feb 27, 2026 ↗

attacks, including ransomware, malware, phishing attacks, advanced persistent threats, social engineering,

Read in the 10-K filed Feb 27, 2026 ↗

common hackers, criminal groups or nation-state organizations or social activist (“hacktivist”) organizations,

Read in the 10-K filed Feb 27, 2026 ↗

increased adoption of AI technologies may intensify cybersecurity risks by making cyber-attacks more difficult to

Read in the 10-K filed Feb 27, 2026 ↗

detect, contain, and mitigate. Furthermore, remote working and personal device use increases the risks of cyber

Read in the 10-K filed Feb 27, 2026 ↗

addition, cybersecurity-related threats may remain undetected for an extended period of time.

Read in the 10-K filed Feb 27, 2026 ↗

Any cybersecurity attack, data or security breach, other security incident, compromise, damage, disruption, outage

Read in the 10-K filed Feb 27, 2026 ↗

customer or vendor information, could also stem from such incidents. Moreover, any significant cybersecurity event

Read in the 10-K filed Feb 27, 2026 ↗

or remediate effectively or in a timely manner. Further, we are subject to an increasing number of cybersecurity

Read in the 10-K filed Feb 27, 2026 ↗

providing complete and reliable information about cybersecurity incidents to customers, counterparties, and

Read in the 10-K filed Feb 27, 2026 ↗

regulators, as well as the public. Corporate actions may impact our cybersecurity risk profile. As part of the strategic

Read in the 10-K filed Feb 27, 2026 ↗

separation of our EMEA packaging business, we intend to assess and address these cybersecurity risks to ensure

Read in the 10-K filed Feb 27, 2026 ↗

certain aspects of cyber risks may be in place, such insurance coverage may be insufficient to cover all losses or all

Read in the 10-K filed Feb 27, 2026 ↗

The use of AI in our product initiatives and offerings or services, or in our internal business operations, may give rise to risks related to accuracy, bias, discrimination, intellectual property infringement, misappropriation or leakage of proprietary, confidential and personal information, defamation, data privacy, and cybersecurity. Any error, defect, or vulnerability in our AI-powered products or business processes could undermine the quality of our products and services, adversely impact our clients’ businesses, subject us or our clients to regulatory scrutiny, fines or litigation and cause reputational harm. We are exposed to similar risks in connection with the use of AI technology by our third-party vendors and clients.

Read in the 10-K filed Feb 12, 2026 ↗

Current and anticipated regulatory developments include requirements related to AI, cybersecurity, and digital operational resilience, as well as evolving ESG disclosure standards and cross-border data transfer restrictions. Global divergence in these regulations could create conflicting obligations and increase compliance complexity. These changes may require significant investment of management time and resources, impact product design and distribution, and materially increase compliance costs or capital requirements. Failure to comply with these evolving requirements could result in enforcement actions, reputational harm, and restrictions on our ability to operate in certain jurisdictions.

Read in the 10-K filed Feb 24, 2026 ↗

•Regulations promulgated from time-to-time to mitigate cybersecurity and information, technology and communication (ICT) risks, including regulations that could require asset managers and certain types of investment funds to adopt and implement procedures that are reasonably designed to address cybersecurity and ICT risks and to promptly report significant cybersecurity and ICT-related incidents to relevant regulators or even publicly. New cybersecurity and ICT-related requirements may raise our compliance costs, while compelled disclosure of cybersecurity or ICT-related incidents could cause us reputational harm.

Read in the 10-K filed Feb 24, 2026 ↗

We also face increasing risks associated with operational technology ("OT") systems, particularly in our work supporting critical infrastructure sectors in which we operate. These risks include cyber threats targeting legacy and modernized OT environments, challenges in integrating secure digital solutions with aging infrastructure, and the growing attack surface introduced by IoT ("internet of things") and IIoT ("industrial internet of things") devices. Additionally, we must navigate evolving regulatory requirements and ensure operational continuity in the face of potential system disruptions.

Read in the 10-K filed Nov 20, 2025 ↗

We are also subject to data sovereignty requirements imposed by the U.S. government, other sovereign governments, and, in some cases, by clients through specific contractual provisions. These requirements restrict how and where data is stored, processed, and accessed, particularly in relation to sensitive or classified information. Compliance with these requirements often necessitates localized infrastructure, specialized data handling protocols, and enhanced cybersecurity controls. Failure to comply with these requirements could result in contractual penalties, reputational harm, or the loss of current and future business opportunities with affected clients, all of which could have a material adverse effect on our business, financial condition and results of operations.

Read in the 10-K filed Nov 20, 2025 ↗

•Cybersecurity or data protection failures, including breaches of confidential or proprietary information;

Read in the 10-K filed Nov 20, 2025 ↗

As part of our broader digital transformation strategy, we are integrating artificial intelligence machine learning, data science and similar technologies (collectively, “AI”) to improve operational efficiency, enhance service delivery, and support data-driven decision-making across our core markets, including advisory services, infrastructure, environmental services, and defense. AI is being leveraged to optimize project workflows, automate repetitive tasks, and strengthen predictive analytics. These capabilities are expected to contribute to long-term value creation and competitive differentiation. However, the adoption of AI also introduces new regulatory compliance and cybersecurity considerations, including increased exposure to data breaches, adversarial attacks on AI models, and vulnerabilities in third-party AI platforms. While we believe that we have implemented robust cybersecurity controls, including threat detection, secure model development practices, and governance frameworks to responsibly and securely deploy AI technologies, we cannot be certain that such efforts will be successful.

Read in the 10-K filed Nov 20, 2025 ↗

We operate in a rapidly evolving, technology-driven environment, and if we do not timely identify, prioritize, develop, and successfully integrate new or enhanced technologies into our operations, our service quality, efficiency, and competitiveness could suffer. Technology initiatives can be complex and costly, with risks of delays, defects, and training hurdles. Anticipated benefits from these initiatives may not be realized on the expected timeline or at all. In addition, competitors may introduce and scale new technologies more quickly or effectively than we do, which could diminish our competitive position, compress margins, and result in lost business opportunities. The rapid evolution and adoption of artificial intelligence(AI) and any efforts we may make to incorporate it into our business may amplify cyber, legal, and operational risks. AI adoption may introduce or amplify risks, including inaccurate or biased outputs that are difficult to detect, governance and model-risk challenges, privacy and intellectual property concerns, and evolving legal disclosure obligations. AI can also increase cybersecurity exposure as threat actors leverage AI to enhance social-engineering and intrusion techniques. Implementing and maintaining AI capabilities can be complex and costly, anticipated benefits may not be realized and expected timelines or at all, and failures could harm our operations, reputation, results of operations, and financial condition.

Read in the 10-K filed Feb 24, 2026 ↗

The actual or perceived risk of theft, loss, fraudulent use or misuse of customer, employee or other data as a result of the foregoing or any other cybersecurity incident, as well as non-compliance with applicable industry standards or our contractual

Read in the 10-K filed Nov 14, 2025 ↗

Like other financial institution service providers, we continually face third-party attempts to discover and exploit system weaknesses or to circumvent our security measures. We regularly experience attacks and other malicious activities targeting our systems, services, infrastructure, and data, as well as those of our clients, third-party service providers, and other vendors. These activities continue to increase in frequency and sophistication. Despite implementing security controls and infrastructure designed to protect our systems and data, we have experienced cybersecurity incidents in the past and may experience them in the future. We cannot be certain that our efforts will be sufficient to combat all current and future technological risks and threats. These risks are further heightened by

Read in the 10-K filed Aug 28, 2026 ↗

JPMorganChase experiences numerous cyber attacks on its computer systems, software, networks and other technology assets. Cyber attacks could take many forms, and may be designed to:

Read in the 10-K filed Feb 13, 2026 ↗

Threat actors that perpetrate cyber attacks include individuals or groups that are:

Read in the 10-K filed Feb 13, 2026 ↗

JPMorganChase cannot guarantee that it will always detect cybersecurity threats to its systems or implement effective preventive measures against those threats. The reasons for this include:

Read in the 10-K filed Feb 13, 2026 ↗

The cybersecurity risks that JPMorganChase faces could be intensified by factors such as:

Read in the 10-K filed Feb 13, 2026 ↗

JPMorganChase could become increasingly vulnerable to cyber attacks if it does not, in a timely manner, identify and address emerging threats, known vulnerabilities or shortcomings in its cybersecurity controls, or if it fails to prioritize or complete enhancements to address them particularly in jurisdictions that could pose a heightened risk to its operations, including enhancements relating to:

Read in the 10-K filed Feb 13, 2026 ↗

Any of the above cybersecurity risks to which JPMorganChase may be exposed could also affect JPMorganChase’s vendors or other third parties with which it does business or is interconnected, including governmental entities and other market participants. A successful circumvention of JPMorganChase’s systems of any of those third parties could cause serious negative consequences, including:

Read in the 10-K filed Feb 13, 2026 ↗

•increased exposure to cyber attacks, system manipulation, or data loss if AI systems, particularly agentic systems, are not designed and implemented with appropriate safeguards to prevent systems from accessing sensitive data sources or system resources and taking actions

Read in the 10-K filed Feb 13, 2026 ↗

•intensified AI-enabled cyber threats, which may allow malicious actors to exploit vulnerabilities, reverse-engineer security patches, and conduct sophisticated social engineering attacks, potentially resulting in unauthorized access to sensitive information and data breaches, especially if JPMorganChase fails to adequately maintain, secure and upgrade its technological infrastructure in response to rapidly evolving technological advances

Read in the 10-K filed Feb 13, 2026 ↗

We continue to evaluate and, where appropriate, integrate AI technologies into our product offerings and internal operations to enhance innovation, efficiency, and customer value. While AI presents opportunities for advancement, its adoption also introduces a range of risks that could adversely impact our business, financial condition, and results of operations. These risks include, but are not limited to, competitive disadvantages if peers more effectively leverage AI to accelerate innovation, product development, or operational performance. The use of AI may also expose us to legal, regulatory, and reputational risks, particularly in jurisdictions with evolving or inconsistent regulatory frameworks governing AI, data privacy, and cybersecurity. Additionally, the deployment of AI tools, whether by us or by customers using our AI-enabled solutions may result in unintended consequences such as biased or inaccurate outputs, loss or compromise of confidential information or intellectual property, and challenges in asserting or defending intellectual property rights. These risks may be amplified by increasing regulatory scrutiny and potential compliance obligations, which could result in increased costs or limitations on our ability to deploy AI technologies. There can be no assurance that our use of AI will yield the anticipated benefits or that we will be able to effectively mitigate the associated risks.

Read in the 10-K filed Dec 17, 2025 ↗

In addition, federal and state governments and agencies have enacted, and continue to develop, broad data protection legislation, regulations, and guidance that require companies to increasingly implement, monitor and enforce reasonable cybersecurity measures.

Read in the 10-K filed Feb 20, 2026 ↗

cyber incidents, and as a result, unauthorized individuals have gained access to our clients’, and could improperly gain access

Read in the 10-K filed Feb 27, 2026 ↗

to our, confidential data through such third parties. Any cybersecurity incidents involving these third parties could impair the

Read in the 10-K filed Feb 27, 2026 ↗

infrastructure has increased, so have the risks associated with system vulnerabilities, data loss, cybersecurity incidents,

Read in the 10-K filed Feb 27, 2026 ↗

intelligence. See also “—Risks Related to Regulatory Matters—Privacy, data protection, cybersecurity and artificial intelligence

Read in the 10-K filed Feb 27, 2026 ↗

We continuously face various security threats on a regular basis, including ongoing cybersecurity threats to, and attacks

Read in the 10-K filed Feb 27, 2026 ↗

a security impact (including the deployment of harmful malware, ransomware, denial-of-service attacks, social engineering,

Read in the 10-K filed Feb 27, 2026 ↗

agents and escrow agents, may not be able to detect or protect against. These same cybersecurity breaches, cyberattack and

Read in the 10-K filed Feb 27, 2026 ↗

cyber intrusions could also be employed against our various stakeholders or other third parties, including attempts to

Read in the 10-K filed Feb 27, 2026 ↗

companies, and other third parties and materially and adversely impact us. The costs related to cyber or other security

Read in the 10-K filed Feb 27, 2026 ↗

Our cybersecurity risk management efforts and our investment in information technology may not be successful in

Read in the 10-K filed Feb 27, 2026 ↗

preventing cyber incidents, which could have a material adverse effect upon our reputation, business, operations, or financial

Read in the 10-K filed Feb 27, 2026 ↗

condition. The techniques used by cyber criminals change frequently, may not be recognized until launched, and can

Read in the 10-K filed Feb 27, 2026 ↗

originate from a wide variety of sources. Furthermore, if we experience a cybersecurity incident and fail to comply with the

Read in the 10-K filed Feb 27, 2026 ↗

Privacy, data protection, cybersecurity and artificial intelligence laws may increase compliance costs

Read in the 10-K filed Feb 27, 2026 ↗

Data privacy, data protection and cybersecurity have become priorities for regulators around the world, and rapidly

Read in the 10-K filed Feb 27, 2026 ↗

York State Department of Financial Services (“NYSDFS”) cybersecurity regulation, which requires covered entities to maintain

Read in the 10-K filed Feb 27, 2026 ↗

cybersecurity programs, conduct risk assessments, and satisfy certain incident reporting and governance requirements. In

Read in the 10-K filed Feb 27, 2026 ↗

November 2023, the NYSDFS finalized amendments to its cybersecurity regulations that significantly expanded the NYSDFS’

Read in the 10-K filed Feb 27, 2026 ↗

Failure to comply with applicable data privacy, data protection, cybersecurity, or artificial intelligence laws or related

Read in the 10-K filed Feb 27, 2026 ↗

relating to data privacy and cybersecurity matters have increased in recent years, and any significant enforcement action,

Read in the 10-K filed Feb 27, 2026 ↗

A failure in Boardwalk Pipelines’ computer systems or a cybersecurity attack on any of its computer systems, devices or telecommunications networks or those of certain third parties could cause substantial and catastrophic damage and may materially adversely affect its cash flows, financial condition and ability to operate its business.

Read in the 10-K filed Feb 10, 2026 ↗

Boardwalk Pipelines’ business is dependent upon its computer systems, devices and networks (operational and information technology), and those of its customers, suppliers and others with whom Boardwalk Pipelines does business, to collect, process and store the data necessary to conduct almost all aspects of its business, including the operation of its pipeline and storage facilities and the recording and reporting of commercial and financial information. Despite Boardwalk Pipelines’ security measures, the information and operational technology and infrastructure it relies on may be vulnerable to attacks by third parties, such as hackers, cybercriminals, nation-states, insiders or other third parties, or breached due to human error, malfeasance or other disruptions. Through government intelligence reports, Boardwalk Pipelines is aware of credible global threats to third-party, U.S. critical infrastructure sectors on which it depends, such as the telecommunications sector.

Read in the 10-K filed Feb 10, 2026 ↗

Cybersecurity threat actors have attacked and continue to threaten energy infrastructure. The U.S. government has issued public and industry-directed warnings that indicate that energy assets might be specific targets of cybersecurity attacks, which are increasing in sophistication, magnitude and frequency. Vulnerabilities in one environment may affect other interconnected systems. A cybersecurity incident that impacts a third party with whom Boardwalk Pipelines does business may impact Boardwalk Pipelines.

Read in the 10-K filed Feb 10, 2026 ↗

Some cyber incidents, such as surveillance, may go unnoticed for a long period of time. Any investigation of a cybersecurity attack or other security incident will be inherently unpredictable and complex, and it may take significant time before the completion of any investigation and availability of full and reliable information. During such time, Boardwalk Pipelines may not know the extent of the harm or how best to remediate it, and certain errors or actions could be repeated or compounded before they are discovered and remediated, any or all of which could further increase the costs and consequences of a cybersecurity attack or other security incident, and its remediation efforts may not be successful.

Read in the 10-K filed Feb 10, 2026 ↗

As the cybersecurity threat landscape continues to evolve, Boardwalk Pipelines may be required to expend significant additional resources to continue to modify or enhance its protective measures or to investigate and remediate any information security vulnerabilities. Advances in computer capabilities, discoveries in the field of artificial intelligence, cryptography, inadequate facility security or other developments may result in a compromise or breach of the technology Boardwalk Pipelines uses to safeguard its operational and information technology systems and confidential, personal, or otherwise protected information. As the breadth and complexity of the technologies Boardwalk Pipelines uses continue to grow, including as a result of the use of mobile devices, cloud services, artificial intelligence, open-source software, social media and the increased reliance on devices connected to the internet, the potential risk of cyberattacks and cybersecurity incidents also increases. No security measure is infallible. Despite ongoing efforts to improve its ability to protect its systems from compromise, Boardwalk Pipelines may not be able to protect all of its diverse systems. Boardwalk Pipelines’ efforts to improve security and protect data and its systems may also identify previously undiscovered instances of security breaches or other cyber incidents.

Read in the 10-K filed Feb 10, 2026 ↗

TSA has issued a series of security directives applicable to pipeline owners and operators, which require the implementation of a variety of cybersecurity measures and reporting. Other regulators, such as PHMSA and the SEC, have also established requirements for reporting certain cybersecurity incidents. As cybersecurity incidents continue to evolve, more legislation could be enacted to seek to mitigate cybersecurity threats. This may require Boardwalk Pipelines to expend additional resources to continue to modify or enhance its protective measures or to investigate and remediate vulnerabilities to cybersecurity incidents at significantly increased costs. Boardwalk Pipelines cannot predict the potential impact to its business of potential future legislation, regulations or orders relating to cybersecurity.

Read in the 10-K filed Feb 10, 2026 ↗

As a government contractor and a provider of information technology services operating in multiple regulated industries and geographies, we and our service providers, suppliers and subcontractors collect, store, transmit, and otherwise process personal, confidential, proprietary, and sensitive information, including protected health information, personnel information, personal information, classified information, controlled unclassified information, intellectual property and financial information, concerning our business, employees, and customers. Therefore, we are continuously exposed to unauthorized attempts to compromise access, release or otherwise compromise such information through cyber-attacks and other

Read in the 10-K filed Feb 17, 2026 ↗

Not every risk or liability we face is or can be protected by insurance, and for those risks we insure, the limits of coverage that are reasonably obtainable may not be sufficient to cover all actual losses or liabilities incurred. We are limited in the amount of insurance we can obtain to cover certain risks, such as cybersecurity risks and natural hazards, including earthquakes, fires,

Read in the 10-K filed Feb 17, 2026 ↗

The Company’s operations rely on the continued performance and security of its information technology systems. System failures, cybersecurity incidents, disruptions, or other issues affecting information technology systems could impair data processing, service delivery, billing, and customer communications. The Company also relies on third parties for critical services, including transportation, supplies, and data processing and expects them to comply with applicable laws and regulations, including environmental, health and safety, and privacy and data security laws. Failures by these providers, whether operational, legal, or cybersecurity-related, and issues affecting their information technology systems, could disrupt services, compromise personal or other confidential information, expose the Company to liability and could materially impact its business, even if the Company is not responsible for the underlying cause of any such failure or issue. In addition, the Company may be subject to regulatory, contractual, or other obligations arising from any such failure or issues. Despite contingency plans, risks remain, and a significant information technology system disruption could adversely affect the Company’s reputation, operations, financial condition, and profitability.

Read in the 10-K filed Feb 24, 2026 ↗

The Company continues to face cybersecurity threats, including ransomware attempts, data breaches, and phishing and social engineering attempts targeting its systems and its employees, and those of third-party vendors. Increasingly sophisticated methods, including the use of AI by threat actors, heighten these risks. The Company has implemented a formal cybersecurity program; however, threat actors’ techniques continue to evolve and may not be identifiable until deployed, which could limit the Company’s ability to prevent unauthorized access, data compromise, service disruption, or fraudulent activity. The Company may be unable to anticipate and/or implement appropriate controls needed to protect against these evolving threats or be required to expend additional resources to prepare for and respond to any cybersecurity vulnerabilities. Evolving threats may outpace defenses, requiring ongoing investment in security measures. Data and cybersecurity incidents, including those involving third parties, such as the AMCA Incident, could result in data loss, service disruption, reputational harm, litigation, regulatory penalties, and increased insurance costs. Remote work arrangements further elevate exposure to cyber risks.

Read in the 10-K filed Feb 24, 2026 ↗

In addition, we are required to procure certain materials and components, including microelectronic components, from U.S. Government-approved supply sources. Heightened regulatory requirements that may apply to these sources can further limit the subcontractors and suppliers we may utilize. Legislation, regulatory changes or other governmental actions, including product certification or stewardship requirements, sourcing restrictions, tariffs, export controls, embargoes, product authenticity, cybersecurity regulation, and environmental standards may all impact our subcontractors and suppliers.

Read in the 10-K filed Feb 12, 2026 ↗

We could be negatively impacted by a security breach of our Information Technology (“IT”) networks and related systems. We face the risk of a security breach, whether through cyber-attack on our IT infrastructure, insider threat, or threats to the physical security of our facilities and employees or other significant disruption of our IT networks and related systems or those of our suppliers or subcontractors. The risk of a security breach or disruption, particularly through cyber-attack or cyber intrusion, including by computer hackers, foreign governments and cyber terrorists, is persistent. The volume, intensity and sophistication of threats from around the world remains elevated. These risks may increase as AI capabilities improve.

Read in the 10-K filed Feb 12, 2026 ↗

As a government contractor with access to national security or other sensitive government information, we face a heightened risk of a security breach or disruption from threats to gain unauthorized access to our and our customers’ proprietary information on our IT networks and related systems, our classified networks, and to the IT networks and related systems that we operate, maintain and secure for certain of our customers. We have implemented various measures to manage the risk of a security breach or disruption. See “Item 1C. Cybersecurity" in this Report for further discussion of our risk management and strategy related to cybersecurity threats.

Read in the 10-K filed Feb 12, 2026 ↗

Our efforts and measures have not been entirely effective in the case of every cyber security incident, but no incident has had a material negative impact on us to date. Even the most well-protected information, networks, systems and facilities remain potentially vulnerable because attempted security breaches, particularly cyber-attacks and cyber intrusions, or disruptions will occur in the future, and because the techniques used in such attempts are constantly evolving and generally are not recognized until launched against a target, and in some cases are designed not to be detected and, in fact, may not be detected. In some cases, the resources of foreign governments may be behind such attacks due to the nature of our business and the industries in which we operate. Accordingly, we may be unable to anticipate these techniques or to implement adequate security controls or other preventative measures and future cyber security incidents may have a material negative impact on us. A security breach or other significant disruption involving these types of information and IT networks and related systems could:

Read in the 10-K filed Feb 12, 2026 ↗

We must also rely on the safeguards of varying levels put in place by customers, suppliers, vendors, subcontractors or other third parties to minimize the impact of cyber threats, other security threats or business disruptions. These third parties may have varying levels of cybersecurity expertise and safeguards. Our commercial arrangements with these third parties include processes designed to require that the third parties and their employees and agents agree to maintain certain standards for the storage, protection and transfer of confidential, personal and proprietary information. However, we remain at risk of a data breach due to the intentional or unintentional non-compliance by a third party’s employee or agent, the breakdown of a third party’s data protection processes, which may not be as sophisticated as ours, or a cyber-attack on a third party’s information network and systems.

Read in the 10-K filed Feb 12, 2026 ↗

We face certain significant risk exposures and potential liabilities that may not be covered adequately by insurance or indemnity. We are exposed to liabilities that are unique to the products and services we provide. A significant portion of our business relates to designing, developing and manufacturing advanced defense, technology and communications systems and products. New technologies associated with these systems and products may be untested or unproven. Components of certain defense systems and products we develop are inherently dangerous. Failures of satellites, missile systems, air traffic control systems, electronic warfare systems, space superiority systems, command, control, computers, communications, cyber, ISR, homeland security applications and aircraft have the potential to cause loss of life and extensive property damage. Other examples of unforeseen problems that

Read in the 10-K filed Feb 12, 2026 ↗

could result, either directly or indirectly, in the loss of life or property or otherwise negatively affect revenue and profitability include loss on launch of spacecraft, premature failure of products that cannot be accessed for repair or replacement, problems with quality and workmanship, country of origin, delivery of subcontractor components or services and unplanned degradation of product performance. In addition, problems and delays in development or delivery as a result of issues with respect to design, technology, licensing and patent rights, labor, learning curve assumptions or materials and components could prevent us from achieving contractual requirements. In many circumstances, we may receive indemnification from the U.S. Government. We generally do not receive indemnification from foreign governments. Although we maintain insurance for certain risks, including certain cybersecurity exposures, the amount of our insurance coverage may not be adequate to cover all claims or liabilities, and we may be forced to bear substantial costs from an accident or incident. It also is not possible for us to obtain insurance to protect against all operational risks and liabilities. Substantial claims resulting from an incident in excess of U.S. Government indemnity and our insurance coverage would harm our financial condition, results of operations, cash flows and equity. Other factors that may affect revenue and profits include loss of follow-on work, and, in the case of certain contracts, liquidated damages, penalties and repayment to the customer of contract cost and fee payments we previously received. Moreover, any accident or incident for which we are liable, even if fully insured, could negatively affect our standing with our customers and the public, thereby making it more difficult for us to compete effectively, and could significantly impact the cost and availability of adequate insurance in the future.

Read in the 10-K filed Feb 12, 2026 ↗

Cyber-attacks are growing in their frequency, sophistication, and intensity, and are becoming increasingly difficult to detect, mitigate, or prevent. Cyber-attacks come in many forms, including the deployment of harmful malware, exploitation of vulnerabilities (including those of third-party software or systems), denial-of-service attacks, the use of social engineering (including phishing), and other means to compromise the confidentiality, integrity, and availability of IT systems, confidential information, and other data. Breaches

Read in the 10-K filed Feb 12, 2026 ↗

We are subject to an evolving cybersecurity, privacy, and AI regulatory environment, and failure to comply with new or existing requirements, including federal cybersecurity incident disclosure obligations, could result in regulatory enforcement and further financial or reputational harm. Emerging laws and regulations governing AI, including the European Union AI Act, China's generative AI regulations, and potential U.S. federal and state AI legislation, may impose new compliance obligations, restrict certain uses of AI technology, or require transparency regarding AI-driven decision-making. Data localization and sovereignty requirements in certain jurisdictions may require us to store and process data locally, increasing operational complexity and costs. Sovereign AI initiatives, under which governments require AI systems to be developed, trained, or operated within national borders using local data, could limit our ability to deploy centralized AI tools globally and may require significant investment in region-specific infrastructure. Our cybersecurity insurance may not cover all losses or liabilities related to cyberattacks. Furthermore, a sophisticated attack could persist undetected within our systems for an extended period before being discovered, potentially amplifying its impact.

Read in the 10-K filed Mar 17, 2026 ↗

Bitcoin trading venues operate under varying regulatory regimes, and in some jurisdictions may be subject to limited oversight, inconsistent disclosure requirements or evolving regulatory standards. Governance, transparency, internal controls and risk management practices differ significantly across trading platforms. As a result, confidence in bitcoin markets could decline if prominent exchanges experience fraud, insolvency, cybersecurity incidents, operational failures or government-imposed restrictions.

Read in the 10-K filed Mar 2, 2026 ↗

•impact of evolving risks related to artificial intelligence, cybersecurity and data privacy across our products, operations, regulatory compliance, intellectual property, talent, and transactions;

Read in the 10-K filed May 21, 2026 ↗

We face significant and evolving risks related to AI across our products, operations, cybersecurity, regulatory compliance, intellectual property, confidential information, privacy, workforce, customer transactions, and customer demand, any of which could adversely affect our business, results of operations, financial condition and reputation.

Read in the 10-K filed May 21, 2026 ↗

AI also amplifies cybersecurity threats. As AI and machine learning evolve, they may lead to the development of dramatically more effective security tools, and cyber‑attackers may leverage these tools to enhance attack methods, identify novel security vulnerabilities, develop malicious code, sophisticated phishing attempts, and convincing deep fakes that manipulate our content or the voices or images of our leaders. Threats may also be introduced by our employees', our customers’, or our partners’ use of AI tools, including where AI‑generated source code incorporated into products or systems introduces malicious code or security vulnerabilities. We may be unaware of an incident, its magnitude or its effects until significant harm is done.

Read in the 10-K filed May 21, 2026 ↗

We also face AI‑related risks in acquisitions and strategic relationships, including regulatory violations or cybersecurity risks arising from an acquired company’s or partner’s use of AI. In addition, competition for talent with AI expertise has intensified, and our ability to attract, retain and train personnel with appropriate AI skills and literacy is critical to our innovation and product roadmap.

Read in the 10-K filed May 21, 2026 ↗

In recent years, there has been an increased focus on corporate responsibility matters, including greenhouse gas emissions and climate-related risks, renewable energy, water stewardship, waste management, data privacy, cybersecurity, trade controls, responsible sourcing and supply chain, use of products for illegal or unethical purposes, human rights, and

Read in the 10-K filed May 21, 2026 ↗

respond rapidly enough to prevent a negative impact on our business. The techniques used to obtain unauthorized access to, or disrupt, information technology systems continue to evolve and may be further amplified by the use of AI and other emerging technologies by malicious actors. Like all organizations, we routinely experience attempted interference with the integrity of, and interruptions in, our technology systems via events such as cyber-attacks, malicious intrusions, or other breakdowns. The consequences of such an event could mean data breaches, interference with the integrity of our products and data, the compromising of our intellectual property or other proprietary information, operational disruptions, the need to implement manual processes or other temporary workarounds, or other significant disruptions.

Read in the 10-K filed Jun 18, 2026 ↗

efforts will be successful. Our business and operations span numerous geographies around the world and involve thousands of employees, contractors, vendors, developers, partners, and other third parties, including AI and cloud services. At any given time, we face known and unknown cybersecurity risks and threats that are not fully mitigated, and we discover vulnerabilities in our security efforts.

Read in the 10-K filed Jan 29, 2026 ↗

Proposed acquisitions are subject to risks and uncertainties before closing. Our diligence may not identify all risks, including environmental liabilities, geologic or reserve quality, title, access constraints, water or power availability, legacy tax or legal exposures, labor and workforce issues, or cybersecurity vulnerabilities. Transactions may require antitrust and other regulatory approvals and could be delayed, conditioned, or prohibited. Required divestitures or other remedies can reduce expected benefits. Target businesses may depend on permits, licenses, mineral or water rights, easements, leases, or other approvals that must be transferred, renewed, or re-issued; these processes can be uncertain, time-consuming and costly. Volatile debt and equity market conditions, interest-rate movements, and changes in our credit ratings can affect the availability and cost of financing.

Read in the 10-K filed Feb 19, 2026 ↗

achieve the level of synergies, cost savings or operating efficiencies we forecast from the acquisition. Integration requires the alignment of cultures, safety and operating practices, internal controls, information technology and cybersecurity, procurement, logistics networks, and sales and pricing processes. We may not realize our expected cost or revenue strategies due to customer or supplier reactions, regulatory or permitting limits, or market changes.

Read in the 10-K filed Feb 19, 2026 ↗

•delays or defects in information technology integration, cybersecurity controls, or data privacy compliance can disrupt operations, increase costs, or expose us to cyber incidents;

Read in the 10-K filed Feb 19, 2026 ↗

We depend on information technology; cybersecurity, data-protection, and systems-reliability risks — including at our third party vendors — could disrupt operations, compromise data, increase costs, or otherwise adversely affect our business and results.

Read in the 10-K filed Feb 19, 2026 ↗

are being considered by various U.S. states. These laws and regulations impose operational requirements, including disclosures to consumers about personal data practices, opt-out and consent choices and required contractual terms with certain third parties, as well as obligations to provide notice to individuals, third parties, and/or regulators in the event of certain cybersecurity incidents involving personal data. In China, for instance, the Personal Information Protection Law also imposes requirements on the collection, use, and cross-border transfer of personal information, and noncompliance may result in penalties and operational restrictions.

Read in the 10-K filed Feb 27, 2026 ↗

Regulators and legislators are also increasingly scrutinizing and restricting certain personal data transfers and transactions involving foreign countries. For example, the Department of Justice’s January 8, 2025, rule on “Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons,” prohibits data brokerage transactions involving certain sensitive personal data categories, including health data, genetic data, and biospecimens, to countries of concern, including China. The regulations also restrict certain investment agreements, employment agreements and vendor agreements involving such data and countries of concern, absent specified cybersecurity controls. Actual or alleged violations of these rules may be punishable by criminal and/or civil sanctions, result in exclusion from participation in federal and state programs or restrict our ability to use certain vendors, sites, investigators, or service providers in global clinical trials.

Read in the 10-K filed Feb 20, 2026 ↗

The integration of AI Technologies into our and our vendors’ systems (potentially without the vendor disclosing such use to us) subjects us to the risk that the providers of AI Technologies may not meet existing or evolving legal, regulatory or industry standards relating to privacy, data protection, cybersecurity, intellectual property, product safety, human oversight, or algorithmic accountability. Compliance with these requirements may require substantial investments in governance, documentation, monitoring, testing, or operational controls, and may limit our ability to deploy or scale certain AI-enabled tools or features.

Read in the 10-K filed Feb 20, 2026 ↗

In addition, bad actors globally use increasingly sophisticated methods, including AI Technologies, to engage in illegal activities involving the theft and misuse of personal information, confidential information and intellectual property. The use of GenAI models in our internal or third-party systems may create new attack surfaces or methods for adversaries, which could impact us and our vendors. These factors may lead to breaches of security or privacy, reduced system performance or availability, loss of intellectual property, unauthorized disclosure of confidential or proprietary information. Sophisticated cyber-attacks, including those leveraging AI, could exacerbate these risks.

Read in the 10-K filed Feb 20, 2026 ↗

Our increasing reliance on software-as-a-service ("SaaS") cloud solutions and other cloud-based vendors to support critical business operations also exposes us to risks associated with the availability, security, and resilience of these third-party platforms. These arrangements create dependencies on the vendors’ ability to maintain continuous service and protect against outages, disruptions or cyber incidents and on the sufficiency of their security controls and incident response. In addition, managing and integrating multiple cloud environments with our internal systems increases the risk of configuration errors or vulnerabilities that could be exploited.

Read in the 10-K filed Feb 9, 2026 ↗

Our investment in AI-related capabilities may not yield the anticipated benefits. Developing, acquiring, or integrating AI-driven tools and talent into our operations will require significant capital expenditures and operational resources, and there is no assurance that these investments will generate a return sufficient to justify their cost. Additionally, the deployment of AI technologies in our design and manufacturing processes may introduce new and unforeseen risks, including design errors, security vulnerabilities, intellectual property concerns, and regulatory compliance challenges that could increase our costs, expose us to liability, or delay product launches. See also, “Costs related to defective products could have a material adverse effect on us” and “Cybersecurity risks could adversely affect our business and disrupt our operations” for additional information.

Read in the 10-K filed Mar 11, 2026 ↗

In addition to datacenters we own or operate, we rely on third-party providers, including colocation facilities, leased datacenters, and cloud infrastructure providers, to support portions of our operations. If any of these providers fail to meet our requirements, or experience service interruptions, operational failures, capacity constraints, physical damage, cybersecurity incidents, or other disruptions, our ability to provide services, maintain system performance, or meet customer expectations could be negatively impacted.

Read in the 10-K filed Jul 29, 2026 ↗

Additionally, AI algorithms or training methodologies may be flawed, and datasets may contain irrelevant, insufficient, or biased information, which can cause errors in outputs. Failures to develop, deploy, or use AI technologies in a safe, responsible, and effective manner, whether by us, our customers, suppliers, partners, or third-party AI providers, could result in product quality issues, operational disruptions, legal liability, regulatory scrutiny, or reputational harm. We manage AI-related risks through our existing cybersecurity, privacy, legal, compliance, information governance, and enterprise risk management processes. However, these processes may not identify or mitigate all risks associated with evolving AI technologies, regulations, and industry practices.

Read in the 10-K filed Oct 9, 2026 ↗

Abandonment of Established Revenue Streams: By exiting our healthcare business, we are moving away from industry-specific revenue streams that provided a degree of predictability. Our future financial performance will now be primarily driven by the market price of Bitcoin, which is notoriously volatile and subject to factors entirely outside our control, and the performance of our Bitcoin-related operations, which may also be positively or negatively impacted by the price of Bitcoin. Legacy Liabilities: Despite our pivot, we may be subject to potential “tail” liabilities related to our former healthcare operations, including potential medical malpractice claims, HIPAA data breach liabilities, or clinical trial disputes. The costs associated with defending or settling these legacy claims could diminish the cash reserves we intend to allocate toward our Bitcoin strategy. Investor Base Misalignment: Investors who purchased our stock for exposure to the healthcare sector may sell their shares as a result of this strategy shift, leading to increased downward pressure on our Common Stock price and heightened volatility during the transition period. Execution Risk: We may be unable to successfully divest or liquidate our remaining healthcare assets at favorable valuations, which could limit our ability to execute our Bitcoin acquisition targets on our planned timeline.

Read in the 10-K filed Mar 30, 2026 ↗

Insurance coverage for digital assets is limited and may not be available on commercially reasonable terms. The insurance market for digital asset risks is undeveloped, and insurers may be unwilling to provide coverage for theft, hacking, or fraud. Our Bitcoin strategy may increase costs or limit availability of directors and officers (“D&O”) insurance, errors and omissions (“E&O”) insurance, and cyber liability insurance. If we are unable to obtain adequate coverage, we could be exposed to significant uninsured losses. Additionally, successful execution of our strategy depends on attracting and retaining personnel with specialized expertise in digital assets, blockchain technology, and cryptocurrency custody. The market for such expertise is highly competitive, and if we are unable to attract, retain, or develop qualified personnel, our ability to manage holdings and respond to security threats could be materially impaired.

Read in the 10-K filed Mar 30, 2026 ↗

Our digital ticketing and data-driven advertising operations are vulnerable to sophisticated cyber-attacks and network failures.

Read in the 10-K filed Mar 30, 2026 ↗

Cybersecurity incidents or Security Incidents affecting our investment advisory operations could result in the loss, unavailability, destruction, alteration, prevention of access to, disclosure, or dissemination of, or damage or unauthorized access to client assets or confidential information, and we could experience material adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions, litigation (including class actions and mass arbitration), fines and penalties, disruptions of our business operations, loss of revenue or profits, and reputational harm.

Read in the 10-K filed Mar 30, 2026 ↗

Our investment advisory operations depend on our and our third-party service providers’ information technology systems to manage client accounts, execute trades, maintain records, and communicate with clients and counterparties. These systems contain sensitive client information, including personal financial data, investment holdings, and transaction histories. Cybersecurity incidents, including hacking, phishing, ransomware, and other attacks, could compromise the confidentiality, integrity, or availability of our systems and data. A successful cybersecurity incident or other Security Incident could result in unauthorized access to client accounts, theft of client assets (including digital assets), disclosure of confidential client information, and disruption of our advisory operations. The SEC has issued guidance emphasizing investment advisers’ obligations to adopt cybersecurity policies and procedures, and has brought enforcement actions against advisers for cybersecurity failures. Additionally, we may be subject to state data breach notification laws and other data protection requirements. Any significant cybersecurity or other Security Incident could result in client losses, regulatory enforcement actions, litigation, notification costs, remediation expenses, and severe reputational damage, which could have a material adverse effect on our advisory business and client relationships.

Read in the 10-K filed Mar 30, 2026 ↗

Risks Related to Cybersecurity, Information Technology, and Intellectual Property

Read in the 10-K filed Mar 30, 2026 ↗

Security Incidents, malicious internet-based activity, online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of our and our customers’ data and information technology systems, and those of the third parties with whom we work. Security Incidents are increasing in frequency, persistence, and sophistication, conducted by criminal hackers, hacktivists, state-sponsored actors, and insiders using techniques such as hacking, social engineering, phishing, ransomware, and advanced persistent threats. These incidents may target our systems, our third-party service providers, or partners and can affect our ability to operate effectively and the integrity and continued availability of our information systems, data, and services. We may experience Security Incidents due to human error, malfeasance, insider threats, or system vulnerabilities. The risk of Security Incidents has been heightened by remote and hybrid working arrangements, as more of our employees utilize network connections, computers, and devices outside our premises or network, including while working at home, while in transit, or in public locations. Any breach of our operations or those of others in the Bitcoin industry could materially and adversely affect our business.

Read in the 10-K filed Mar 30, 2026 ↗

We and the third parties with whom we work are subject to a variety of evolving Security Incident threats, including but not limited to social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, or hardware failures, loss of data or other information technology assets, adware, attacks enhanced or facilitated by artificial intelligence (“AI”), including through increased speed, scale, or sophistication, telecommunications failures, earthquakes, fire, flood, power loss, system failures, computer viruses, software errors, physical or electronic break-ins or malicious hacks or attacks on our systems (such as denial of service attacks), and other similar threats. Additionally, our confidential and sensitive data of the Company and our clients may be leaked, disclosed, or revealed as a result of or in connection with our employees’, personnel’s, or vendors’ use of AI technology.

Read in the 10-K filed Mar 30, 2026 ↗

The proper functioning of our information technology infrastructure is critical to the efficient operation of our business. Our IT systems are vulnerable to Security Incidents, viruses, malware, ransomware, physical and electronic break-ins, and similar disruptions. We also outsource certain IT infrastructure to third parties, including cloud-based services, encryption and authentication technology, employee email, content delivery to clients, and other functions, which introduces additional cybersecurity risks. In some cases, our operations may depend on the continued availability and performance of these third-party services. We may not have the financial resources to update and maintain our IT infrastructure, and any failure could adversely impact operations. In addition, our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. Unauthorized acquisition, access, use or disclosure involving unsecured PHI could result in significant notification and remediation costs, as well as HIPAA violations and significant fines. Failure of IT systems could delay billing, disrupt operations, compromise confidential information, and result in financial losses, litigation, regulatory enforcement, and reputational harm.

Read in the 10-K filed Mar 30, 2026 ↗

In the ordinary course of business, we collect, receive, store, process, generate, use, transfer, disclose, and otherwise handle personal data and other sensitive information, including PHI in connection with aspects of our healthcare operations. Our privacy and data security obligations include numerous federal, state, and foreign data privacy and security laws, including data breach notification laws, consumer protection laws, and comprehensive state privacy laws. These laws impose obligations including specific privacy notice disclosures, data subject rights (such as access, correction, and deletion rights), opt-out mechanisms for targeted advertising and profiling, and requirements for data privacy impact assessments. Complying with these obligations requires us to devote significant resources, which may necessitate changes to our services, information technologies, systems, and practices and to those of any third parties that process sensitive data on our behalf.

Read in the 10-K filed Mar 30, 2026 ↗

The introduction of artificial intelligence ("AI") and machine-learning technologies, particularly generative AI, into internal processes, third-party services and/or new and existing offerings may result in new or expanded risks and liabilities, including due to enhanced governmental or regulatory scrutiny, litigation, compliance issues, ethical concerns, confidentiality or security risks, as well as other factors that could adversely affect our business, reputation and financial results. In addition, our personnel could, unbeknownst to us, improperly utilize AI and machine learning-technology while carrying out their responsibilities. The use of AI in third-party services and the development of our products and services could also cause loss of intellectual property, as well as subject us to risks related to intellectual property infringement or misappropriation, data privacy and cybersecurity. The use of artificial intelligence can lead to unintended consequences, including generating content that appears correct but is factually inaccurate, misleading or otherwise flawed, or that results in unintended biases and discriminatory outcomes, which could harm our reputation and business and expose us to risks related to inaccuracies or errors in the output of such technologies.

Read in the 10-K filed Dec 17, 2025 ↗

NEE and FPL use AI technologies in various aspects of their operations, including, without limitation, financial analysis, strategic planning, field work intelligence, work scheduling, grid optimization, energy forecasting, customer service and operations management. The use of and reliance on AI may present certain risks such as, but not limited to, AI tools may malfunction, produce inaccurate or biased outputs, or behave unpredictably, and introduce NEE and FPL to additional cybersecurity threats and data privacy risks. In addition, as NEE and FPL rely on third-party vendors for certain AI tools, platforms and collaborations, NEE and FPL could experience third-party vendor issues such as disruptions in vendor relationships, performance issues, cybersecurity threats or disputes over intellectual property rights. Further, the regulatory environment governing AI is also evolving, and future legislation or agency rulemaking may impose new compliance obligations or restrict certain AI applications, increasing costs to comply with such requirements and failure to do so could result in regulatory enforcement, penalties or reputational harm. While AI technologies offer the potential to enhance operational efficiency, accelerate growth and lower costs, these benefits may not be realized and the use of and reliance on AI may present certain risks, both of which could materially adversely affect NEE’s and FPL’s business, financial condition, results of operations and prospects.

Read in the 10-K filed Feb 13, 2026 ↗

•Failure to comply with cybersecurity laws and regulations and the resulting impact on our reputation and business.

Read in the 10-K filed Feb 11, 2026 ↗

Moreover, as we develop, deploy and integrate AI, including internally developed and third-party AI tools, into our operations, digital platforms and business processes, we may face increased cybersecurity, privacy, data governance, operational and compliance risks, including risks related to unauthorized use or misuse of AI tools, data loss or unauthorized access to or disclosure of personal, confidential or proprietary information, inaccurate, biased or unintended outputs, including in certain employment-related uses, system vulnerabilities and rapidly evolving laws, regulations and standards relating to AI, privacy, cybersecurity and data use. In addition, threat actors may use AI to increase the speed, scale and sophistication of cyberattacks, including phishing, impersonation, credential theft, exploitation of known or previously unknown software vulnerabilities and other automated, targeted or coordinated attacks against our systems or those of our vendors and other third parties.

Read in the 10-K filed Jul 15, 2026 ↗

The Company’s use of, or failure to effectively adopt, AI systems in its operations, services and products poses operational, competitive, cybersecurity, legal and compliance risks that could adversely affect the Company.

Read in the 10-K filed Feb 24, 2026 ↗

Customer demand continues to be influenced by cloud adoption, digital transformation initiatives, cybersecurity requirements, and increasing use of artificial intelligence and data-driven applications, driving significant changes in storage architectures and solution requirements. The emergence of artificial intelligence workloads has introduced additional competitive dynamics, particularly in areas related to data readiness, performance, scalability, and integration with compute and cloud ecosystems. Additionally, cloud service providers offer storage on demand without requiring capital expenditure, which meets rapidly evolving business needs and has altered the competitive landscape. We also face competition from alternative architectures or approaches that may reduce or eliminate demand for some of our offerings.

Read in the 10-K filed Jun 5, 2026 ↗

In response to evolving and increasing security threats, the U.S. government has imposed, and may impose in the future, requirements relating to product security, supply chain security, and cyber/information security that have impacted, and may in the future impact NetApp. Failure to meet these requirements as they apply to us and our products may result in delays or inability to sell our products to government entities.

Read in the 10-K filed Jun 5, 2026 ↗

cybersecurity threats and also may suffer cybersecurity incidents or other security breaches. Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. In addition, supply-chain attacks have increased in frequency and severity, and third parties’ infrastructure in our supply chain or our third-party partners’ supply chains may become compromised. A cybersecurity incident at a third-party service provider could result in unauthorized access to or disclosure of personal data for which NetApp has protection obligations, potentially triggering breach notification requirements across multiple jurisdictions and exposing NetApp to regulatory enforcement actions, fines, and litigation.

Read in the 10-K filed Jun 5, 2026 ↗

Individuals, groups of hackers and sophisticated organizations, including nation-states and nation-state-supported actors, and other threat actors have engaged and are expected to continue to engage in cyber-attacks. Additionally, some actors are using AI technology to launch more automated, targeted and coordinated attacks. Due to geopolitical conflicts

Read in the 10-K filed Feb 25, 2026 ↗

Further, we also rely on innovation in our IT and our use of or inability to adopt and deliver new technological capabilities and enhancements in line with strategic objectives, including artificial intelligence and machine learning, may put us at a competitive disadvantage (including delayed implementation and utilization that causes us to lag behind our competitors); cause us to miss opportunities to innovate or achieve efficiencies; or adversely impact our business, reputation, results of operations, and financial condition. The use of emerging technologies, including artificial intelligence, entails risks including risks relating to the possibility of intellectual property infringement or misappropriation; data privacy; potential for inaccuracy; bias; new or enhanced governmental or regulatory scrutiny, requirements, litigation, or other liability; ethical concerns; negative perceptions as to automation and artificial intelligence; cybersecurity concerns; or other complications or liabilities that could adversely affect our business, reputation, results of operations, or financial results.

Read in the 10-K filed Feb 25, 2026 ↗

If we fail to keep pace with technological developments, or if competitors or new market entrants adopt new technologies more quickly or effectively, or if our clients develop their own AI-related capabilities, our services could become less attractive to clients, our competitive position could be harmed, and our revenues and profitability could decline. In addition, the use of emerging technologies presents risks related to intellectual property, ethics, data privacy, cybersecurity and regulatory compliance. Any failure to address these risks effectively could adversely affect our reputation, client relationships, business results of operations and financial condition.

Read in the 10-K filed Feb 20, 2026 ↗

We are increasingly incorporating AI tools and capabilities into our business operations where we believe appropriate, which may subject us to significant competitive, legal, regulatory and other risks. There can be no assurance that our use of AI tools will enhance our business operations or result in a benefit to us. Our competitors may be more successful in their use of AI tools, including by developing superior products or improving their operations with the assistance of AI. Additionally, there could be adverse impacts from inaccurate or flawed algorithms. Our use of AI tools could also result in the loss of confidential information or intellectual property or an inability to claim or enforce intellectual property rights, as well as subject us to risks related to intellectual property infringement or misappropriation, data privacy, cybersecurity, and the unauthorized use of Company data. The jurisdictions in which we conduct business have and may adopt laws and regulations related to AI, which could cause us to incur greater compliance costs, limit our use of AI tools, or subject us to legal liabilities.

Read in the 10-K filed Feb 9, 2026 ↗

craft sophisticated cybersecurity attacks. Any of the foregoing could irreparably damage our reputation and business, which could have a material adverse effect on our results of operations. We maintain cyber risk insurance, although an insufficiency or unavailability of insurance coverage could adversely affect our cash flows and overall profitability. Furthermore, our efforts to comply with evolving laws and regulations related to cybersecurity may be costly and any failure to comply could result in investigations, proceedings, investor lawsuits and reputational damage.

Read in the 10-K filed Feb 9, 2026 ↗

•We are subject to business, financial and reputational risks related to cybersecurity incidents and data breaches.

Read in the 10-K filed Jun 22, 2026 ↗

The Company is exposed to cybersecurity, digital infrastructure and data security risks.

Read in the 10-K filed Feb 18, 2026 ↗

The Company relies on technology to enable its business operations. The increasing use of digital technology, information technology and operational technology, including services and networks maintained by the Company as well as third parties, exposes the Company to evolving threats, including unauthorized access, ransomware or other malware, service disruptions, threats to the security of facilities and infrastructure, cyber terrorism, critical infrastructure attacks, supply chain attacks and other attacks on third-party vendors. Cyber incidents, whether from insiders or external actors, such as criminals, hacktivists or nation state threat actors, could disrupt operations or compromise sensitive information, which may impact the Company’s reputation, result in regulatory penalties or result in financial losses.

Read in the 10-K filed Feb 18, 2026 ↗

Technology failures, network disruptions and breaches of data security could disrupt the Company’s operations in numerous ways, including by causing accidents, delays or losses and impacts to the Company’s workforce, customers and local communities, impeding processing of transactions and reporting financial results, and leading to the unintentional disclosure of Company, partner, customer or employee information. In addition, the Company faces risks related to the unauthorized access, theft or misuse of proprietary information, including intellectual property, trade secrets and sensitive business data. These risks may arise not only from external actors but also from current or former insiders, including former employees, contractors or other parties with prior access to the Company’s systems. Loss or compromise of proprietary information could adversely impact the Company’s competitive position, strategic initiatives or business relationships. The Company also has exposure to cybersecurity risks where its systems, data and proprietary information are accessed, collected, hosted and/or processed by third-party cloud and other service providers. The Company also faces increased risk with the growing sophistication of artificial intelligence capabilities, which may improve or expand the existing capabilities of

Read in the 10-K filed Feb 18, 2026 ↗

cyber threat actors. While the Company uses advanced technologies, including AI-based tools, to strengthen its defenses and support business operations, such measures may not be successful in preventing or mitigating cyber threats.

Read in the 10-K filed Feb 18, 2026 ↗

•Customer trends toward vendor consolidation in cybersecurity may favor competitors offering broader platforms.

Read in the 10-K filed Sep 10, 2026 ↗

Customer trends toward vendor consolidation in cybersecurity may favor competitors offering broader platforms.

Read in the 10-K filed Sep 10, 2026 ↗

Enterprise cybersecurity buyers are increasingly seeking to consolidate their vendors to reduce costs, complexity, and integration challenges. While our platformization strategy is designed to benefit from this trend, consolidation may also create opportunities for competitors, including large cybersecurity platform vendors, cloud hyperscalers, and enterprise software companies, to offer broader bundled solutions that include capabilities in categories where we compete, such as identity security and observability. If customers choose to consolidate with vendors offering more comprehensive suites, or if competitors more successfully utilize acquisitions or partnerships to combine capabilities, we may be at a competitive disadvantage. Furthermore, organizations continuously evaluate their information security priorities and may allocate budgets to solutions offered by our competitors, or may not adopt or expand the use of our solutions, which could adversely affect our business, financial condition, and operating results.

Read in the 10-K filed Sep 10, 2026 ↗

In addition, frontier or foundational AI model providers, or similar companies with advanced large language model capabilities, have entered or may enter the cybersecurity and observability markets, whether directly, through partnerships, or by enabling third parties to build competing security applications on top of their models. These companies possess substantial capital, technical talent, and have developed, or proprietary access to, foundational or frontier AI models. Their ability to rapidly iterate on model capabilities, attract AI research talent, and leverage significant compute infrastructure may allow them to introduce competing security capabilities more quickly or at lower cost than we can. If these or other AI companies develop and commercialize security products or embed security functionality into their broader AI platforms, customers may choose to consolidate their security spend with such providers rather than purchase our solutions, which could adversely affect our revenue, market share, and competitive position.

Read in the 10-K filed Sep 10, 2026 ↗

Vulnerabilities within our AI systems may be identified by researchers or malicious actors before we detect or remediate them, which could result in security incidents, data privacy issues, reputational damage, or loss of customer confidence. Advances in AI have also increased the speed, scale, and sophistication of cybersecurity threat activity, including reducing the time between vulnerability discovery and exploitation. To the extent customers, investors, or other market participants perceive that AI can automate or commoditize aspects of cybersecurity functions, the perceived value of certain cybersecurity solutions could diminish, and customer buying patterns, competitive dynamics, and demand for our products, subscriptions, and support offerings could be adversely affected. Investor and market perceptions regarding AI-related disruption to the cybersecurity industry could adversely affect our business and operating results, or the trading price of our common stock, even if these perceptions do not reflect actual changes in our business, customer demand, competitive positions, or financial performance.

Read in the 10-K filed Sep 10, 2026 ↗

The cybersecurity industry is undergoing a transformation as customers increasingly expect AI-native solutions that are designed from the ground up to leverage AI capabilities. If we fail to anticipate, invest in, or execute on the transition to AI-native platforms, or if our competitors develop AI-native offerings that achieve greater market acceptance, we may miss critical opportunities for growth and market leadership, and our business, including our gross margin, and competitive position could be materially harmed.

Read in the 10-K filed Sep 10, 2026 ↗

Our products and subscriptions are subject to regulatory requirements in a number of foreign jurisdictions, and the scope and complexity of these requirements continue to expand. For example, in China, our products may be required to comply with cybersecurity and data security laws, including the Cybersecurity Law, the Data Security Law, and related regulations, and may be subject to network security review, critical information infrastructure protection requirements, and mandatory product certifications. Other jurisdictions impose similar requirements, including local testing and certification requirements, in-country data storage or processing mandates, source code review or escrow obligations, and restrictions on the use of foreign-developed encryption or security technologies. Compliance with these requirements is costly and time-consuming, and the regulatory landscape in many jurisdictions is evolving and subject to change with limited or no notice. If we are unable to obtain or maintain required certifications, approvals, or authorizations in a timely manner, or if new or revised requirements render our products or subscriptions non-compliant, we may be unable to sell, deploy, or support our products in affected markets, which could result in lost revenue opportunities, reputational harm, and a material adverse effect on our business, financial condition, and operating results.

Read in the 10-K filed Sep 10, 2026 ↗

We are also subject to federal, state, provincial, and foreign laws regarding cybersecurity and the protection of our systems and confidential information. Many jurisdictions have enacted laws, such as the GDPR and the E.U. Network and Information Systems Directive II, requiring companies to adopt cybersecurity risk management measures and notify regulators (and individuals) of data breaches or cybersecurity incidents. If our data security measures fail to adequately protect our systems or confidential information, we could be liable to both our customers and their users for

Read in the 10-K filed Sep 10, 2026 ↗

The Utility relies on technology to operate its business, including complex operational, interconnected networks and information technology systems that support critical functions. The Utility also depends on information technology systems to help it monitor and operate the electric grid, detect ignitions and collect other wildfire-related information, process transactions, track and collect revenues, manage customer billing and energy usage data, maintain internal control over financial reporting, and produce accurate and timely financial statements and regulatory filings. These information technology systems allow the Utility to create, collect, use, disclose, store, and otherwise process sensitive information, including regarding customers, employees, and other individuals. These systems can be damaged or disrupted by malicious events such as cyber or physical attacks, or by technology failure.

Read in the 10-K filed Feb 12, 2026 ↗

Risks relating to computer cyber-terrorism, crisis on a national or global scale, climate change or other catastrophic events

Read in the 10-K filed Feb 18, 2026 ↗

such cybersecurity incidents could result in litigation, reputational impacts, regulatory action and potential liability and additional costs and operational consequences of implementing further data protection measures. For information on our cybersecurity risk management, strategy and governance, see ITEM 1C.- Cybersecurity.

Read in the 10-K filed Feb 24, 2026 ↗

Numerous and evolving information security threats, including advanced persistent threats and ransomware, pose a risk to the security of our systems, networks and services, as well as to the confidentiality, availability and integrity of our data and of our critical business operations. The techniques, tools and tactics used in cyber-attacks evolve rapidly, including

Read in the 10-K filed Feb 19, 2026 ↗

Artificial intelligence (“AI”) and machine-learning technology continue to advance rapidly, presenting both opportunities and risks. If we cannot incorporate these rapidly advancing technologies as quickly or effectively as other companies, our competitive position and business results may suffer. Incorporation of these new technologies into our processes may result in new or expanded risks, including risks related to regulatory compliance, litigation, ethical concerns, confidentiality or cybersecurity, among other factors that could potentially adversely impact our business, reputation and financial results. The use of AI in the development of our products and services could increase the risk of loss or theft of our intellectual property and could subject us to incremental risks related to data privacy and cybersecurity. The use of AI can lead to unintended consequences, including generating content that appears correct but is factually inaccurate, misleading or otherwise flawed, or that results in unintended biases and discriminatory outcomes, which could harm our stakeholders, our reputation and our business. Additionally, we face risks of competitive disadvantage if our competitors are able to more effectively use AI to create products or services at a lower cost or higher quality compared to PPG’s competing products or services.

Read in the 10-K filed Feb 19, 2026 ↗

Because AI technologies remain in the early stages of development and industry standards are still emerging, their use, whether by PPL, its subsidiaries or third-party vendors, presents inherent risks. Although we seek contractual protections and conduct due diligence with third-party vendors that incorporate AI technologies into their products or services, we may not have full visibility into, awareness of, or control over, the underlying data, supply chain dependencies, model training practices, performance, security safeguards, or compliance posture of such AI enabled tools. AI algorithms that we or our third-party vendors use may be flawed or may be based on datasets that are biased or insufficient, which may introduce risks involving data quality, data integrity, cybersecurity, adversarial manipulation, intellectual property, regulatory compliance, biased outcomes, or improper handling of sensitive information.

Read in the 10-K filed Feb 20, 2026 ↗

These limitations, failures, or inaccurate results generated as a result of our employees', contractors' or vendors' use or misuse of AI technologies could lead to operational interruptions or otherwise adversely affect our business, reputation, or financial results. In addition, the development, testing, and deployment of AI capabilities may require significant computational resources, specialized personnel, and additional investment, resulting in increased costs. We may not be able to recover these costs through our regulatory proceedings. Rapid advances in AI capabilities, as well as the emerging regulatory landscape in the United States and internationally, may also require modifications to our systems, adoption of enhanced governance processes or implementation of new safeguards. Future laws, regulations, Executive Orders, or industry standards relating to AI (which may be conflicting), including those addressing transparency, data usage, cybersecurity, accountability, or risk management, could materially affect how we design, procure, or use AI technologies and could increase compliance costs. In addition, the pace of AI innovation and regulation is unpredictable, and we cannot foresee all potential impacts of AI technologies or future laws and regulations or compliance requirements, and their associated costs and consequences. Any of the risks described above could adversely affect our business operations, reputation, or financial results.

Read in the 10-K filed Feb 20, 2026 ↗

have insufficient recourse against such third parties from which such breaches originate. We have experienced cybersecurity events resulting in, among other things, the compromise of personal and confidential information, including sensitive health information, of our employees, customers and other stakeholders.

Read in the 10-K filed Feb 12, 2026 ↗

Furthermore, there has been increased scrutiny as well as enacted and proposed additional laws and regulations, including from state regulators, regarding the use of personal and confidential information. These laws and regulations are increasing in complexity and number, change frequently, and may be subject to interpretation by different regulators and courts. See “Business—Regulation—Privacy and Cybersecurity Regulation” for a discussion of the applicable laws and regulations (including those requiring notice, disclosure or remediation) relating to cybersecurity events.

Read in the 10-K filed Feb 12, 2026 ↗

Cybersecurity incidents and other disruptions could compromise our information and systems resulting in disruption of operations, financial loss and reputational harm.

Read in the 10-K filed Feb 20, 2026 ↗

The regulatory landscape governing cybersecurity continues to evolve, and federal, state and international authorities are increasing their oversight of cybersecurity practices, incident reporting and the protection of critical energy infrastructure. Requirements related to operational technology, supply chain security, data governance and timely disclosure of cyber incidents are becoming more prescriptive, and additional rulemaking may further expand our compliance obligations. As cyber threats targeting the energy sector grow in frequency and sophistication, we are required to devote additional resources to maintain and enhance our cybersecurity programs and controls. Failure to comply with applicable cybersecurity laws and regulations, or to effectively identify, prevent or respond to a cyber event, could result in operational disruptions, increased costs, regulatory enforcement actions or adverse effects on our business.

Read in the 10-K filed Feb 20, 2026 ↗

AI technologies also may expose us to legal, regulatory, cybersecurity, privacy, intellectual property, operational and reputational risks. AI algorithms, models or training methodologies may be flawed, and datasets or outputs may be inaccurate, insufficient, biased, misleading or otherwise controversial. Our use of AI tools in our internal operations, or the use of AI-enabled products, tools or technologies by our customers, developers, vendors or other third parties, may result in inadvertent disclosure or misuse of confidential, proprietary, personal or competitively sensitive information, reliance on inaccurate or flawed outputs, cybersecurity or privacy incidents, claims of infringement or misuse of data, regulatory scrutiny, litigation or use that is inconsistent with our expectations, policies, controls or applicable laws and regulations.

Read in the 10-K filed Nov 4, 2026 ↗

evolving, both in the U.S. and internationally, and includes regulatory schemes targeted specifically at AI as well as new and existing provisions in intellectual property, privacy, cybersecurity, consumer protection, employment and other laws applicable to the use of AI and changes in interpretation of the foregoing. These evolving laws and regulations could require changes in our implementation of AI technology and increase our compliance costs and the risk of non-compliance. AI models, particularly generative AI models, may, and often do, produce output or take action that is incorrect, that result in the release of personal, confidential or proprietary information, that reflect or introduce discrimination, errors or biases included in the data on which they are trained or prompts or algorithms on which they rely, that infringe on the intellectual property rights of others or that is otherwise harmful. In addition, the complexity of many AI models makes it challenging to understand why they are generating particular outputs. This limited transparency increases the challenges associated with assessing the proper operation of AI models, understanding and monitoring the capabilities of the AI models, reducing erroneous output, eliminating bias and complying with applicable laws and regulations, including those that require documentation or explanation of the basis on which decisions are made. Additionally, if we do not have sufficient rights to use AI models, the data on which they are trained or prompts or algorithms on which they rely or the output thereof, we could also incur liability through the violation of applicable laws and regulations, third-party intellectual property, privacy or other rights or contracts to which we are a party.

Read in the 10-K filed Feb 24, 2026 ↗

Further, we currently rely, and expect to continue to rely, on AI models developed by third parties, and are and would be dependent in part on the manner in which those third parties develop, train and deploy their models, which involves risks arising from any discrimination, errors or bias in the models and the data on which they are trained or prompts or algorithms on which they rely, as well as the risk of inadvertent disclosure or incorporation of our personal, confidential or proprietary information into publicly available training sets. Any of these risks may impact our ability to realize the benefit of such information or adequately maintain, protect and enforce our intellectual property rights, and could result in regulatory compliance failures and otherwise harm our competitive position and business. The use of AI by companies has resulted in, and may in the future result in, systems failures or errors and cyber-attacks or other similar incidents. We may not be able to sufficiently mitigate, remediate or detect any of the foregoing limitations or risks given our and other market participants’ evolving experience with using AI, the pace of technological change, and rapid adoption of AI by our third-party vendors, clients, counterparties or competitors. Any of these risks could expose us to liability or adverse legal or regulatory consequences and harm our reputation and the public perception of our business or the effectiveness of our security measures.

Read in the 10-K filed Feb 24, 2026 ↗

We are also exposed to risks arising from the use of AI technologies by bad actors to commit fraud and misappropriate funds and to facilitate cyber-attacks and other similar incidents. Generative AI, if used to perpetrate fraud or launch cyberattacks or other similar incidents, could create panic at a particular financial institution or securities exchange, which could pose a threat to financial stability.

Read in the 10-K filed Feb 24, 2026 ↗

These dynamics can lead to higher and more volatile commodity and energy prices, strained global supply chains, increased inflationary pressures and weaker economic growth both globally and in the United States. Financial markets may experience abrupt swings in asset valuations, higher risk premiums and periods of reduced liquidity. Geopolitical events can also spur elevated cyber threats, including state-sponsored and opportunistic cyber-attacks aimed at critical infrastructures and financial systems. Such attacks could disrupt our operations, compromise sensitive data, increase compliance and remediation costs and harm customer relationships.

Read in the 10-K filed Feb 24, 2026 ↗

Certain natural disasters, mechanical failures, cyber incidents, evolving climate and ESG requirements, and other events outside of our control could adversely affect us.

Read in the 10-K filed Mar 2, 2026 ↗

The demand for power to support data centers, including AI/HPC workloads, has increased significantly, and we believe that by allocating a portion of our available power capacity to AI/HPC customers, while continuing to operate our bitcoin mining business, may create long-term value for our stockholders. We are in the process of developing scalable data center platforms at our Corsicana Facility and Rockdale Facility. As we pursue this expansion, we may face reputational harm, liability exposure, and adverse financial impacts arising from perceptions that we are shifting away from our core bitcoin-mining business, challenges associated with execution or integration, or increased scrutiny from investors and participants in the broader digital asset industry. Any perception that we are deprioritizing bitcoin mining could adversely affect our relationships with certain stakeholders, including investors, employees, and members of the crypto community. Data center customers also generally have heightened expectations regarding uptime, data integrity, cybersecurity, sustainability, and operational reliability. Any failure to meet these expectations, or any adverse incident involving our data center operations, could damage our reputation and credibility and negatively affect customer relationships. If we are unable to maintain or enhance our reputation, successfully execute our data-center strategy, or adapt to

Read in the 10-K filed Mar 2, 2026 ↗

Certain natural disasters, external events, mechanical failures, cyber incidents, and evolving climate, energy and Environmental, Social and Governance (“ESG”) requirements could adversely affect our business, financial condition, results of operations, cash flows, and prospects.

Read in the 10-K filed Mar 2, 2026 ↗

We are increasingly evaluating and deploying AI technologies, including generative AI and machine learning, across various aspects of our business. AI presents evolving risks that may be difficult to predict or mitigate. These risks include heightened data privacy, cybersecurity, and data protection risks, as the use of AI may involve processing sensitive data and, in some cases, sharing data with third-party providers. Such use may increase the risk of unauthorized access to, misuse, or disclosure of confidential information or personal data, introduce system vulnerabilities, and enable more sophisticated fraud and cyber-attacks. Any such event could result in operational disruptions, remediation costs, litigation, regulatory scrutiny, and reputational damage.

Read in the 10-K filed May 21, 2026 ↗

We rely on third-party AI platforms and services, including proprietary and open-source large language models and other AI technologies provided by companies such as OpenAI, Anthropic, Google, and Microsoft. These providers may change their terms of service, increase pricing, discontinue services, experience outages, decline to provide certain indemnities, or make changes to their AI models that adversely affect our products or operations. As AI becomes more central to our offerings, our exposure to pricing changes from these providers increases, and we may not be able to pass such cost increases on to our customers. We have limited control over these third-party AI systems and their updates, and any disruption in access to these services could have a significant impact on our business. The use of AI applications may result in cybersecurity incidents that implicate the personal data of end users of such applications. Any such cybersecurity incidents related to our use of AI applications could adversely affect our reputation and results of operations. AI also presents emerging ethical issues, and if our use of AI becomes controversial, we may experience brand, reputational, or competitive harm, or legal liability.

Read in the 10-K filed Feb 24, 2026 ↗

We are advancing AI across our product and service offerings, and we are in the initial phases of expanding AI into the core functions of our business. The development and deployment of AI presents both risks and opportunities, and the implementation process could adversely impact the operations of our business as a whole. AI algorithms utilized in the deployment may be flawed or based on datasets that are biased or insufficient, and do not adequately take into account the underlying nature of our business. Failure to adequately train our employees during the deployment of AI could adversely impact our business or result in delays or errors in our offerings. Our competitiveness could also be negatively impacted by our failure to timely develop or deploy AI in our products and services, particularly if our competitors are successful in AI advancements in their products and services. The development of AI technology will require significant investment in resources and human capital and could increase our costs. There is uncertainty related to the legal and regulatory landscape surrounding rapidly evolving AI technologies, particularly in the areas of cybersecurity, intellectual property, and privacy and data protection. Failure to comply or appropriately respond to this developing landscape may result in increased legal liability, adverse regulatory action, or reputational damage.

Read in the 10-K filed Feb 24, 2026 ↗

We have deployed ETH using one or more decentralized finance protocols. All trading and investment activity involves risk, which is heightened in the case of decentralized finance due to the irrevocable nature of blockchain transactions and the possibility of errors in smart contracts. Decentralized finance protocols also attract hackers and persons looking to exploit flaws in or the ability to misuse smart contracts. We also may incur losses in connection with our decentralized finance activity due to human error or our inability to predict future price movements. Any losses we sustain in connection with decentralized finance activities could cause an adverse impact on our financial condition, results of operations, and the market price of our Common Stock.

Read in the 10-K filed Mar 9, 2026 ↗

If we or our third-party service providers experience a security breach or cyberattack and unauthorized parties obtain access to our ETH, or if our private keys are lost or destroyed, or other similar circumstances or events occur, we may lose some or all of our ETH and our financial condition and results of operations could be materially adversely affected.

Read in the 10-K filed Mar 9, 2026 ↗

All of the ETH and ETH-related digital assets we own is held in custody accounts at institutional-grade digital asset custodians. Security breaches and cyberattacks are of particular concern with respect to our ETH and ETH-related digital assets. ETH and other blockchain-based cryptocurrencies and the entities that provide services to participants in the ETH ecosystem have been, and may in the future be, subject to security breaches, cyberattacks, or other malicious activities. A successful security breach or cyberattack could result in:

Read in the 10-K filed Mar 9, 2026 ↗

Further, any actual or perceived data security breach or cybersecurity attack directed at other companies with digital assets or companies that operate digital asset networks, regardless of whether we are directly impacted, could lead to a general loss of confidence in the broader blockchain ecosystem or in the use of the Ethereum network to conduct financial transactions, which could negatively impact us.

Read in the 10-K filed Mar 9, 2026 ↗

Attacks upon systems across a variety of industries, including industries related to ETH, are increasing in frequency, persistence, and sophistication, and, in many cases, are being conducted by sophisticated, well-funded and organized groups and individuals, including state actors. The techniques used to obtain unauthorized, improper or illegal access to systems and information (including personal data and digital assets), disable or degrade services, or sabotage systems are constantly evolving, may be difficult to detect quickly, and often are not recognized or detected until after they have been launched against a target. These attacks may occur on our systems or those of our third-party service providers or partners. We may experience breaches of our security measures due to human error, malfeasance, insider threats, system errors or vulnerabilities or other irregularities. Threats can come from a variety of sources, including criminal hackers, hacktivists, state-sponsored intrusions, industrial espionage, and insiders. In addition, certain types of attacks could harm us even if our systems are left undisturbed. For example, certain threats are designed to remain dormant or undetectable, sometimes for extended periods of time, or until launched against a target and we may not be able to implement adequate preventative measures. The risk of cyberattacks could also be increased by cyberwarfare in connection with the ongoing Russia-Ukraine and Israel-Hamas conflicts, or other future conflicts, including potential proliferation of malware into systems unrelated to such conflicts. Any future breach of our operations or those of others in the ETH industry, including third-party services on which we rely, could materially and adversely affect our business.

Read in the 10-K filed Mar 9, 2026 ↗

Cybersecurity incidents and other issues related to our information systems, technology and data may affect us materially and adversely.

Read in the 10-K filed Mar 9, 2026 ↗

Cybersecurity incidents and cyberattacks have been occurring globally at a more frequent and severe level and will likely continue to increase in frequency in the future. The digital asset industry is a particular target for cybersecurity incidents, which may occur through intentional or unintentional acts by individuals or groups having authorized or unauthorized access to our systems or our clients’ or counterparties’ information, which may include confidential information. These individuals or groups include employees, vendors and customers, as well as hackers. The information and technology systems used by us and our service providers, and other third parties, are vulnerable to damage or interruption from, among other things: hacking, ransomware, malware and other computer viruses; denial of service attacks; network failures; computer and telecommunication failures; phishing attacks; infiltration by unauthorized persons; security breaches; usage errors by their respective professionals; power outages; terrorism; and catastrophic events such as fires, tornadoes, floods, hurricanes and earthquakes. It is difficult or impossible to defend against every risk being posed by changing technologies, as well as criminals’ intent to commit cybercrime, and these efforts may not be successful in anticipating, preventing, detecting or stopping attacks, or reacting in a timely manner. The increasing sophistication and resources of cybercriminals and other non-state threat actors and increased actions by nation-state actors make it difficult to keep up with new threats and could result in a breach of security. Such threats may see their frequency increased, and effectiveness enhanced, by the use of artificial intelligence. Further, cybersecurity risks may be heightened as a result of ongoing global conflicts such as the Russia-Ukraine conflict or the ongoing Israel-Hamas conflict. Additionally, we cannot guarantee that our insurance coverage would be sufficient to cover any such losses.

Read in the 10-K filed Mar 9, 2026 ↗

To the extent the operation of our systems relies on our third-party service providers, through either a connection to, or an integration with, third parties’ systems, the risk of cybersecurity attacks and loss, corruption, or unauthorized access to or publication of our information or the confidential information and personal data of customers and employees may increase. Third-party risks may include insufficient security measures, data location uncertainty, and the possibility of data storage in inappropriate jurisdictions where laws, security measures or other controls may be inadequate or in which there are uncertainties regarding governmental intervention and use of such data, and our ability to monitor our third-party service providers’ data security practices are limited. Although we generally have agreements relating to cybersecurity and data privacy in place with our third-party service providers, they are limited in nature and we cannot guarantee that such agreements will prevent the accidental or unauthorized access to or disclosure, loss, destruction, disablement or encryption of, use or misuse of or modification of data (including personal data) or enable us to obtain adequate or any reimbursement from our third-party service providers in the event we should suffer any such incidents. Due to applicable laws and regulations or contractual obligations, we may be held responsible for any information security failure or cybersecurity attack attributed to our vendors as they relate to the information we share with them. A vulnerability in or related to a third-party service provider’s software or systems, a failure of our third-party service providers’ safeguards, policies or procedures, or a breach of a third-party service provider’s software or systems could result in the compromise of the confidentiality, integrity or availability of our systems or the data housed in our third-party solutions.

Read in the 10-K filed Mar 9, 2026 ↗

The security of the information and technology systems used by us and our service providers may continue to be subjected to cybersecurity threats that could result in material failures or disruptions in our business. If these systems are compromised, become inoperable for extended periods of time or cease to function properly, we or a service provider may have to make a significant investment to fix or replace them. The failure of these systems or of disaster recovery plans for any reason could cause significant interruptions in operations and result in a failure to maintain the security, confidentiality or privacy of sensitive data, including personal information relating to stockholders (and the beneficial owners of stockholders). Such a failure could harm our reputation, subject us to legal claims and otherwise materially and adversely affect our investment and trading strategies and our value.

Read in the 10-K filed Mar 9, 2026 ↗

ETH and ETH-related digital assets are controllable only by the possessor of both the unique public key and private key(s) relating to the local or online digital wallet in which the ETH and ETH-related digital assets are held. While the ETH blockchain ledger requires a public key relating to a digital wallet to be published when used in a transaction, private keys must be safeguarded and kept private in order to prevent a third party from accessing the ETH and ETH-related digital assets held in such wallet. To the extent the private key(s) for a digital wallet are lost, destroyed, or otherwise compromised and no backup of the private key(s) is accessible, neither we nor our custodians will be able to access the ETH and ETH-related digital assets held in the related digital wallet. Furthermore, we cannot provide assurance that our digital wallets, nor the digital wallets of our custodians held on our behalf, will not be compromised as a result of a cyberattack. ETH, as well as other digital assets and blockchain technologies, have been, and may in the future be, subject to security breaches, cyberattacks, or other malicious activities.

Read in the 10-K filed Mar 9, 2026 ↗

Our information technology systems and those of our third-party service providers, business partners, and licensees—including those supporting point-of-sale, mobile platforms, payment systems, delivery, rewards, and administrative functions—store personal, financial, and confidential data from customers, employees, business partners, and licensees, as well as proprietary business information. Although we have put in place policies, procedures, and technological safeguards designed to protect the security of this information, we cannot guarantee that this information will not be improperly disclosed or accessed. Like other prominent retail companies, we have experienced cyber-attacks (e.g., phishing) and other attempts to breach or gain unauthorized access to our systems, as have our third-party service providers, business partners, and licensees. We expect such threats to continue and evolve, especially with the rapid evolution and increased adoption of artificial intelligence.

Read in the 10-K filed Nov 14, 2025 ↗

Unauthorized access, theft, or destruction of data or any breach, ransomware attack or other incident affecting our systems—whether through external attacks or internal methods—could result in reputational harm, loss of customers, business disruption, regulatory investigations, litigation (including class actions), and significant financial costs. It may take considerable time for us to investigate and evaluate the full impact of incidents, particularly for sophisticated attacks. Responding to cybersecurity incidents may require substantial investments in technology, personnel, legal compliance, and customer support, including notification and credit monitoring. These costs could materially impact our financial results and divert resources from strategic initiatives. Media reports of actual or perceived vulnerabilities—whether involving us or our third-party service providers, business partners, or licensees—can damage our brand and business, regardless of an incident’s scope or validity.

Read in the 10-K filed Nov 14, 2025 ↗

We rely extensively on interconnected information technology systems to support our operations, including point-of-sale, mobile ordering, payments, supply chain management, loyalty programs, and administrative functions. We also depend on third-party providers for key systems and services, which may lack full redundancy within or across markets. Our growth initiatives—particularly those involving digital engagement and convenience-led formats—depend heavily on the reliability and performance of these systems. Any failure, inadequacy, inefficiency, or interruption could disrupt operations and adversely affect financial results. Our contractual and operational safeguards may not be effective in preventing the failure of these systems or services to operate effectively and be available. Failures—whether due to outages, cyber-attacks, software flaws, misconfigurations, or other disruptions—could materially impact product availability, operational efficiency, and financial performance. If our incident response and recovery plans are ineffective or delayed, remediation efforts may incur significant, unplanned costs.

Read in the 10-K filed Nov 14, 2025 ↗

Emerging technologies, including artificial intelligence and machine learning, may not deliver expected efficiencies and could introduce new risks, such as those related to cybersecurity, data privacy, inaccuracies, hallucinations, bias or discrimination and intellectual property infringement, which may become more pronounced as the Company’s reliance on such technologies increases.

Read in the 10-K filed Nov 14, 2025 ↗

the permanent loss of digital assets with no practical means of recovery. Because blockchain technology is relatively new, it is difficult to predict how it might be vulnerable to cybersecurity and fraud risks that could affect our business.

Read in the 10-K filed Feb 25, 2026 ↗

We expect to engage with third-party service providers to facilitate certain activities related to digital assets. These relationships present additional risks, including operational, reputational, and compliance risks that could adversely affect our business. Internal and third-party systems needed to effect client activity in digital assets are vulnerable to operational failures, cyberattacks, and fraud, and we may be held responsible for deficiencies in the controls or regulatory compliance of third-party service providers, even where we do not have direct oversight of their operations. Failure or breach of our or third-party service providers’ systems, cybersecurity controls, or operational processes could result in loss of client digital assets, which may not be recoverable in full or at all. Many crypto industry participants are relatively early-stage companies with limited history. There is no guarantee they will perform as reliably or efficiently as anticipated. Regulatory change could also affect the ability of third-party service providers to continue to operate or provide services for Schwab clients. Such events could result in material financial losses, legal or regulatory claims, and reputational harm, even if we are not at fault.

Read in the 10-K filed Feb 25, 2026 ↗

Geopolitical conflicts and evolving international trade and regulatory conditions have adversely affected, and may continue to adversely affect, the global economy and financial markets. Governments in various jurisdictions have implemented, and may continue to implement, sanctions, trade restrictions, export controls, or other regulatory measures that can disrupt global supply chains and increase costs. While we do not have operations in regions experiencing geopolitical conflict, these conditions have contributed to, and may continue to contribute to, the volatility in the availability and cost of raw materials, transportation, and energy. Prolonged or escalating geopolitical conflicts could also result in cyber incidents, further supply chain disruptions, reduced consumer confidence and demand, foreign currency exchange rate volatility, and additional barriers to international trade. Any of these factors could adversely affect our business, financial condition, results of operations, or cash flows, and may exacerbate other risks described in this section.

Read in the 10-K filed Jun 9, 2026 ↗

the ruble. Continuation or escalation of the conflict may also exacerbate this and other risk factors identified in this Form 10-K, including cybersecurity, regulatory, and reputational risks.

Read in the 10-K filed Jan 23, 2026 ↗

Solventum has begun to deploy AI in its products and services, including as part of its research and development efforts, and Solventum expects to continue to explore additional uses as AI continues to develop. In addition, Solventum intends to devote significant resources to develop and deploy cloud, edge and software solutions in its healthcare solutions. For example, Solventum has incorporated AI into certain products in the Health Information Systems business segment and certain of its digital offerings and expects to continue to build AI into additional products. Any disruption or failure in the AI, machine learning, or other emerging technologies Solventum deploys or uses in its products and services, including as part of its research and development efforts, could adversely impact Solventum’s business, including as a result of flawed AI algorithms, insufficient or biased datasets, malfunctions or manipulations, unintentional release of confidential information, or product or service delays or recalls. In addition, any failure to successfully deploy or use such technologies in Solventum’s products and services, or to adapt to medical technology industry trends and developments related to such technologies in a timely manner (or at all), particularly as competitors incorporate such technologies into new and existing products and services, could adversely affect customer demand for Solventum’s products and its competitiveness. The deployment of AI, machine learning or other emerging technologies into Solventum’s products and services will require additional investment and increase its costs. Furthermore, the rapid advancement of technology, including AI, creates additional risks as Solventum includes such technology into its products and services, including from confidentiality, privacy, data protection, cybersecurity and compliance perspectives, and raises intellectual property issues and operational, technological and other concerns. Any of the above factors could adversely affect Solventum’s business, financial condition, results of operations and cash flows.

Read in the 10-K filed Feb 27, 2026 ↗

We face evolving cybersecurity, technology resiliency and data security and governance risks, including with respect to increasing use of artificial intelligence.

Read in the 10-K filed Feb 26, 2026 ↗

In addition to security and privacy risks related to data, we face challenges related to data governance, including the need to manage our data with the aim to meet regulatory requirements and create a foundation for the use of artificial intelligence tools. Our current and potential future uses of such tools (and use by our vendors and agents) may expose us to heightened security and privacy risks as well as operational, legal, and reputational risks. Data produced by or contained in artificial intelligence tools may contain inaccuracies, and our investments in such technologies and related organizational changes may not deliver the expected benefits, which could result in operational disruptions, inefficiencies, unexpected costs and regulatory disallowances. Beginning in January 2027, our businesses that are subject to the California Consumer Privacy Act will also be subject to new regulations related to, among other things, the use of artificial intelligence tools to automate certain decisions. These regulations may limit some potential applications of such technologies, particularly with respect to previously collected personal data. The regulations require companies to disclose any covered use of such technologies and how the relevant decisions will be made and to allow consumers to opt out of such use, subject to limited exceptions. The regulations also require companies to conduct risk assessments before initiating certain data processing activities, disclose information about these assessments to the California Privacy Protection Agency, conduct an annual cybersecurity audit and submit a written compliance certification to the agency.

Read in the 10-K filed Feb 26, 2026 ↗

The FERC enforces mandatory reliability standards developed by the North American Electric Reliability Corporation, including standards designed to protect the power system against potential disruptions from cyber and physical security breaches. Under the Energy Policy Act of 2005, the FERC can impose penalties (up to $1.6 million per day per violation) for any failure to comply with these standards, which could have a material adverse effect on Sempra’s and SDG&E’s results of operations, financial condition, cash flows and/or prospects.

Read in the 10-K filed Feb 26, 2026 ↗

Oncor is subject to periodic audits of its compliance with operations and critical infrastructure protection standards, including reliability and cybersecurity standards, as well as periodic inspections of its facilities for compliance with weatherization standards. Oncor is also required to report to the PUCT on its reliability and weather preparedness. If Oncor is found to be noncompliant with applicable reliability, service quality, weatherization or other standards, it could be subject to reputational harm, regulatory scrutiny or sanctions, including monetary penalties.

Read in the 10-K filed Feb 26, 2026 ↗

Transactions of this nature also involve a number of risks and financial, accounting, tax, regulatory, strategic, client relationship, managerial, operational, cybersecurity, cultural and employment challenges, which could adversely affect our consolidated results of operations and financial

Read in the 10-K filed Feb 19, 2026 ↗

We rely extensively on information technology systems, networks, and cloud-based platforms, including those operated by vendors, suppliers, and other third parties, to support our business operations. We and our third party providers are regularly subject to cybersecurity threats and attempted cyberattacks of varying types and degrees of sophistication, including phishing, social engineering, malware, ransomware, unauthorized access attempts, and other malicious activities. Such threats are common across our industry, continue to increase in frequency and sophistication, and may be difficult to prevent, detect, or mitigate, particularly as AI capabilities evolve to allow increasingly complex cyberattacks. Actual or perceived cybersecurity vulnerabilities or software or firmware defects affecting our products or services could also expose our customers’ systems, data, or operations to unauthorized access or other adverse impacts. This risk may be heightened as our products are deployed in increasingly interconnected enterprise, cloud, edge, and data center environments.

Read in the 10-K filed Aug 4, 2026 ↗

We have implemented security measures designed to prevent, detect, and respond to cybersecurity threats, but these measures may not be effective against all threats or prevent every incident. We cannot guarantee that our or our third party providers’ products, systems, components, software, or infrastructure are free of exploitable defects, bugs, or vulnerabilities, and use of AI technologies by us or our customers, suppliers, or other third parties may increase the complexity and effectiveness of cybersecurity threats and introduce new vulnerabilities into systems, software, products, and business processes. A cybersecurity incident or other compromise of our products, systems, or AI technologies used in our business, or those of our customers or third party providers, could result in unauthorized access to, disclosure, loss, misuse, or corruption of proprietary, confidential, or personal information, including intellectual property or information about our manufacturing, financials, customers, or employees. Cybersecurity incidents, as well as efforts to prevent, detect, or respond to such incidents, also may impair the functionality of our products, information technology systems, manufacturing operations, supply chain activities, product development efforts, or other critical business functions, or result in increased costs associated with investigation, containment, remediation and recovery, product updates, customer support, customer claims, contractual disputes, litigation, indemnification obligations, regulatory investigations, fines or penalties, damage to our reputation, and reduced sales or profitability. Any of these events, whether affecting our systems directly, the products and services we provide, or the systems of third parties on which we depend, could have a material adverse effect on our business, financial condition, and results of operations.

Read in the 10-K filed Aug 4, 2026 ↗

Armed conflicts and geopolitical tensions may also result in sanctions, export restrictions, tariffs or other trade restrictions, limit or restrict our ability to access certain markets and disrupt key logistics networks, including air and ocean freight travel routes. These developments have increased, and could further increase, costs for energy, rare earth minerals, materials, components and transportation, constrain manufacturing capacity and require us to reconfigure aspects of our global supply chain. Geopolitical instability may also heighten cybersecurity risks, including state-sponsored attacks, which could disrupt our operations or those of our suppliers, customers or partners, and further adversely affect demand for our products.

Read in the 10-K filed Aug 4, 2026 ↗

The security and accessibility of our SUI assets are, in part, dependent on the integrity and reliability of the cryptocurrency custodians and exchanges used to hold, trade, or manage SUI. We currently utilize BitGo as custodian to hold all of our SUI assets. BitGo is a digital asset security firm established in 2013. Many cryptocurrency custodians, including BitGo, are relatively new and unregulated, and may be subject to internal control failures, including inadequate cybersecurity measures, poor risk management practices, or operational errors. Such failures can lead to asset loss, theft, suspension or freezing of accounts, delays in executing trades, or compromised private information. If a custodian or exchange we utilize to hold our SUI experiences an internal control failure, we may suffer partial or total loss of our SUI holdings, incur financial losses, experience disruptions in liquidity, or face reputational harm. Further, the regulatory environment relating to internal controls at cryptocurrency custodians and exchanges remains uncertain and fragmented, increasing the risk of internal control failures. There can be no assurance that our SUI assets will not be affected by such incidents, and the occurrence of internal control failures could materially adversely impact our financial condition and results of operations.

Read in the 10-K filed Feb 27, 2026 ↗

If we or our third-party service providers experience a security breach or cyberattack and unauthorized parties obtain access to our SUI, or if our private keys are lost or destroyed, or other similar circumstances or events occur, we may lose some or all of our SUI and our financial condition and results of operations could be materially adversely affected.

Read in the 10-K filed Feb 27, 2026 ↗

Substantially all of the SUI we own is held in custody accounts at BitGo, a well-known custodian. Security breaches and cyberattacks are of particular concern with respect to our SUI. SUI and other blockchain-based cryptocurrencies and the entities that provide services to participants in the SUI ecosystem have been, and may in the future be, subject to security breaches, cyberattacks, or other malicious activities. For example, in October 2021 it was reported that hackers exploited a flaw in the account recovery process and stole from the accounts of at least 6,000 customers of the Coinbase exchange, although the flaw was subsequently fixed and Coinbase reimbursed affected customers. Similarly, in November 2022, hackers exploited weaknesses in the security architecture of the FTX Trading digital asset exchange and reportedly stole over $400 million in digital assets from customers. A successful security breach or cyberattack could result in:

Read in the 10-K filed Feb 27, 2026 ↗

Further, any actual or perceived data security breach or cybersecurity attack directed at other companies with digital assets or companies that operate digital asset networks, regardless of whether we are directly impacted, could lead to a general loss of confidence in the broader Sui ecosystem or in the use of the Sui network to conduct financial transactions, which could negatively impact us.

Read in the 10-K filed Feb 27, 2026 ↗

Attacks upon systems across a variety of industries, including industries related to SUI, are increasing in frequency, persistence, and sophistication, and, in many cases, are being conducted by sophisticated, well-funded and organized groups and individuals, including state actors. The techniques used to obtain unauthorized, improper or illegal access to systems and information (including personal data and digital assets), disable or degrade services, or sabotage systems are constantly evolving, may be difficult to detect quickly, and often are not recognized or detected until after they have been launched against a target. These attacks may occur on our systems or those of our third-party service providers or partners. We may experience breaches of our security measures due to human error, malfeasance, insider threats, system errors or vulnerabilities or other irregularities. In particular, we expect that unauthorized parties will attempt to gain access to our systems and facilities, as well as those of our partners and third-party service providers, through various means, such as hacking, social engineering, phishing and fraud. Threats can come from a variety of sources, including criminal hackers, hacktivists, state-sponsored intrusions, industrial espionage, and insiders. In addition, certain types of attacks could harm us even if our systems are left undisturbed. For example, certain threats are designed to remain dormant or undetectable, sometimes for extended periods of time, or until launched against a target and we may not be able to implement adequate preventative measures. Further, there has been an increase in such activities due to the increase in work-from-home arrangements. The risk of cyberattacks could also be increased by cyberwarfare in connection with the ongoing Russia-Ukraine and Israel-Hamas conflicts, or other future conflicts, including potential proliferation of malware into systems unrelated to such conflicts. Any future breach of our operations or those of others in the Sui industry, including third-party services on which we rely, could materially adversely affect our financial condition and results of operations.

Read in the 10-K filed Feb 27, 2026 ↗

We may use generative artificial intelligence and/or machine learning (collectively, “AI”) tools in our operations. If our peers use AI tools to optimize operations and we fail to utilize AI tools in a comparable manner, we may be competitively disadvantaged. However, while AI tools may facilitate optimization and operational efficiencies, they also have the potential for inaccuracy, bias, infringement or misappropriation of intellectual property, and risks related to data privacy and cybersecurity. The use of AI tools may introduce errors or inadequacies that are not easily detectable, including deficiencies, inaccuracies or biases in the data used for AI training, or in the content, analyses or recommendations generated by AI applications. The results of such errors or inadequacies may adversely affect our business, financial condition and results of operations. The legal requirements relating to AI continue to evolve and remain uncertain, including how legal developments could impact our business and ability to enforce our proprietary rights or protect against infringement of those rights. Cybersecurity threat actors may utilize AI tools to automate and enhance cybersecurity attacks against us. The integration of AI tools in the digital asset industry may present significant opportunities and risks for our vendors, investors or contract counterparties, similar to those risks described above.

Read in the 10-K filed Feb 27, 2026 ↗

Any disruptions or failures of our systems or other services that we use, including as a result of a natural disaster, fire, cyberattack (including the potential increase in risk for such attacks due to cyberwarfare in connection with the ongoing Russia-Ukraine and Israel-Hamas conflicts), act of terrorism, geopolitical conflict (including due to the ongoing Russia-Ukraine, Israel-Hamas and U.S.-Venezuela conflicts and any potential conflict involving China and Taiwan), pandemic, the effects of climate change, or other catastrophic event, as well as power outages, telecommunications infrastructure outages, a decision by one of our third-party service providers to materially change the pricing or terms of their services, or other unanticipated problems with our third-party services that we use, such as a failure to meet service standards, could severely impact our ability to conduct our business operations, or result in a material weakness in our internal control over financial reporting, any of which could materially adversely affect our future operating results.

Read in the 10-K filed Feb 27, 2026 ↗

The regulatory landscape surrounding artificial intelligence is rapidly evolving and the Company’s use of artificial intelligence may be subject to new legal or regulatory requirements, which may impose prohibitions or additional compliance burdens on the Company. For example, the Company’s artificial intelligence efforts may subject it to heightened compliance and legal as well as other risks related to technology integration, accuracy, program bias, data sourcing, intellectual property infringement or misappropriation, data privacy, and cybersecurity, among others. Moreover, the Company may experience brand or reputational harm if it fails to appropriately manage its use of artificial intelligence in compliance with applicable laws and regulations or successfully execute on strategies leveraging artificial intelligence.

Read in the 10-K filed Feb 24, 2026 ↗

derived from “open source” software that generally is made publicly available by its developers or other third parties. Risks related to the use of open source software include, but are not limited to, the introduction of cybersecurity vulnerabilities into our products or development platforms, our noncompliance with applicable licensing terms, subjecting certain of our derivative works or software enhancements to public disclosure and/or unfavorable licensing conditions, potential restrictions on our ability to market the firmware associated with our products, and enhanced governmental or other third-party scrutiny of our products.

Read in the 10-K filed Nov 7, 2025 ↗

The risks in this area continue to grow, and we expect cyber events will continue to accelerate in frequency and impact as threat actors increasingly use AI and other techniques to circumvent security controls, evade detection and remove forensic evidence.

Read in the 10-K filed Nov 12, 2025 ↗

Attempts by malicious actors to gain unauthorized access to our information technology systems have become more sophisticated and are sometimes successful. These attempts, which might be related to industrial or foreign government espionage, crime, activism, or other motivations, include covertly introducing malware into our computers and computer networks, performing reconnaissance, impersonating authorized users, extortion, fraud, and stealing, corrupting or restricting our access to data, among other activities. We have in the past experienced cyber-attacks including some loss of confidentiality and some loss of availability and integrity, although these attacks have not had material impact on our business. Our customers and suppliers have also experienced successful cyber-attacks, which in some cases resulted in payments by or to us being

Read in the 10-K filed Feb 20, 2026 ↗

As AI technologies continue to evolve, future adoption of more autonomous capabilities may introduce additional legal, regulatory, operational, cybersecurity, safety, and reputational risks. If we are unable to effectively address the risks associated with the development, deployment, use, or governance of AI technologies, our business, results of operations, financial condition, and reputation could be adversely affected. Additionally, there can be no assurances that the use of AI technologies will enhance our products and service or be beneficial to our business, including our efficiency, safety, or profitability.

Read in the 10-K filed Nov 9, 2026 ↗

•compliance with anti-corruption laws, cybersecurity, data privacy regulations, customs and trade regulations;

Read in the 10-K filed Feb 19, 2026 ↗

The Company has experienced, and may continue to experience, failures and disruptions affecting the stability, performance, security, and availability of its applications, operating systems, and infrastructure. These include degraded processing performance, data quality issues, loss of network connectivity, software malfunctions and misconfigurations, and interruptions in the availability and reliability of cloud-based and other third-party systems and services. The Company’s substantial and increasing reliance on cloud service providers and other external technology vendors heightens exposure to risks outside of its control, including system outages, downtime, cyber-attacks, and adverse financial and operating conditions at those providers and vendors. The Company’s expanding use of AI tools and related technologies introduces additional operational risks, including reliance on data integrity and model performance as well as third-party AI services that may fail, degrade, or produce inaccurate or unexpected outputs.

Read in the 10-K filed Feb 24, 2026 ↗

Failures to properly maintain, upgrade, or secure applications, operating systems, and infrastructure may increase the Company’s susceptibility to cybersecurity threats, including supply chain attacks, and may impair the Company’s ability to meet business continuity and resiliency objectives. AI-enabled technologies may further expand the cyber-attack surface and velocity, including exposure to adversarial manipulation, data poisoning, and vulnerabilities in third-party AI and other platforms. These events have resulted in adverse client impacts, including the inability to access account information or conduct transactions through ATM, online, or mobile channels, the exposure of confidential, proprietary, personal, and other sensitive information, the posting of duplicative or delayed transactions, and delays in obtaining assistance through call centers. The Company cannot assure that similar or more severe operational or technology failures and disruptions, including AI-related failures or third-party service interruptions, will not occur in the future or that their effects can be prevented, contained, or remediated in a timely manner.

Read in the 10-K filed Feb 24, 2026 ↗

Regulatory and other legal frameworks surrounding AI continue to evolve and remain uncertain. If we do not have sufficient rights to use models, prompts, algorithms, and datasets on which our AI technologies rely or the related decisions, predictions, analysis, or other output, we could incur significant damages, substantial fees, deprivation of access, or considerable expense through a violation of applicable law, third-party intellectual property, privacy, or other rights, or other violations. New or changing statutes, regulations, or industry standards and practices may increase costs, restrict use cases, or require significant changes to our deployment or our existing systems and controls. If we fail to appropriately respond to changes within the AI landscape, including changing public sentiment, we could face legal, regulatory, or brand and stakeholder risk that may negatively impact our business, operations, financial results, financial condition, or reputation. In addition, the use of AI by companies has resulted in, and may in the future result in, cybersecurity breaches, attacks, and other similar incidents as well as data privacy violations.

Read in the 10-K filed Feb 24, 2026 ↗

We and our third-party providers experience cyber-attacks and other attempts to gain unauthorized access to our products, services, and systems and data on a regular basis, and we anticipate continuing to be subject to such attempts as cyber-attacks

Read in the 10-K filed Feb 26, 2026 ↗

We are increasingly integrating AI technologies, including generative AI and machine learning, across various aspects of our business, which presents evolving risks that may be difficult to predict or mitigate. AI technologies may produce inaccurate, biased, or unreliable outputs, cause or contribute to the violation of intellectual property rights, and may be prone to cybersecurity incidents or service interruptions. If our use of AI technologies produces deficient, inaccurate, controversial, or misleading outputs, or has other unintended consequences, we could be subject to legal liability, regulatory action, and competitive or reputational harm.

Read in the 10-K filed Aug 13, 2026 ↗

Because the TRX token has no physical existence beyond the record of transactions on the TRON blockchain, a variety of technical factors related to the TRON blockchain could also impact the price of the TRX token. For example, malicious attacks by hackers, hard “forks” of the TRX token blockchain into multiple blockchains, and advances in digital computing, algebraic geometry, and quantum computing could undercut the integrity of the TRON blockchain and negatively affect the price of the TRX token. The liquidity of the TRX token may also be reduced and damage to the public perception of the TRX token may occur, if financial institutions were to deny or limit banking services to businesses that hold TRX tokens, provide TRX token-related services or accept the TRX token as payment, which could also decrease the price of the TRX token. Actions by U.S. banking regulators, such as the issuance in February 2023 by Federal banking agencies of the “Interagency Liquidity Risk Statement,” which cautioned banks on contagion risks posed by providing services to digital assets customers, and similar actions, have in the past resulted in or contributed to reductions in access to banking services for cryptocurrency-related customers and service providers, or the willingness of traditional financial institution to participate in markets for digital assets. The liquidity of the TRX token may also be impacted to the extent that changes in applicable laws and regulatory requirements negatively impact the ability of exchanges and trading venues to provide services for TRX tokens and other digital assets.

Read in the 10-K filed Mar 25, 2026 ↗

TRX tokens are controllable only by the possessor of both the unique public key and private key(s) relating to the local or online digital wallet in which a TRX token is held. While the TRON blockchain ledger requires a public key relating to a digital wallet to be published when used in a transaction, private keys must be safeguarded and kept private in order to prevent a third party from accessing the TRX tokens held in such wallet. To the extent the private key(s) for a digital wallet are lost, destroyed, or otherwise compromised and no backup of the private key(s) is accessible, we will not be able to access the TRX tokens held in the related digital wallet. Furthermore, we cannot provide assurance that our digital wallets will not be compromised as a result of a cyberattack.

Read in the 10-K filed Mar 25, 2026 ↗

If we or our third-party service providers experience a security breach or cyberattack and unauthorized parties obtain access to our TRX tokens, we may lose some or all of our TRX tokens and our financial condition and results of operations could be materially adversely affected.

Read in the 10-K filed Mar 25, 2026 ↗

Security breaches and cyberattacks are of particular concern with respect to our TRX tokens. Blockchain-based digital assets have been, and may in the future be, subject to security breaches, cyberattacks, or other malicious activities. A successful security breach or cyberattack could result in a partial or total loss of our TRX tokens. Such a loss could have a material adverse effect on our financial condition and results of operations.

Read in the 10-K filed Mar 25, 2026 ↗

As of March 18, 2026, the TRON blockchain and TRX tokens have not experienced any material security breaches or protocol-level cyberattacks that compromised the integrity of the network. TRON currently maintains a public bug bounty program on HackerOne and has undergone an external security audit of its Java-Tron node software by ChainSecurity. However, the TRON blockchain and TRX token, similar to other digital assets and blockchain technologies, may in the future be, subject to security breaches, cyberattacks, or other malicious activities. For example, in November 2022, hackers exploited weaknesses in the security architecture of the FTX Trading digital asset exchange and reportedly stole over $400 million in digital assets from customers. A successful security breach or cyberattack could result in:

Read in the 10-K filed Mar 25, 2026 ↗

Further, any actual or perceived data security breach or cybersecurity attack directed at other companies with digital assets or companies that operate digital asset networks, regardless of whether we are directly impacted, could lead to a general loss of confidence in the broader TRON blockchain ecosystem or in the use of the TRON blockchain to conduct financial transactions, which could negatively impact us.

Read in the 10-K filed Mar 25, 2026 ↗

Attacks upon systems across a variety of industries are increasing in frequency, persistence, and sophistication, and, in many cases, are being conducted by sophisticated, well-funded and organized groups and individuals, including state actors. The techniques used to obtain unauthorized, improper or illegal access to systems and information (including personal data and digital assets), disable or degrade services, or sabotage systems are constantly evolving, may be difficult to detect quickly, and often are not recognized or detected until after they have been launched against a target. These attacks may occur on our systems or those of our third-party service providers or partners. We may experience breaches of our security measures due to human error, malfeasance, insider threats, system errors or vulnerabilities or other irregularities. In particular, unauthorized parties have attempted, and we expect that they will continue to attempt, to gain access to our systems and facilities, as well as those of our partners and third-party service providers, through various means, such as hacking, social engineering, phishing and fraud. In the past, hackers have successfully employed a social engineering attack against one of our service providers and misappropriated our digital assets, although, to date, such events have not been material to our financial condition or operating results. Threats can come from a variety of sources, including criminal hackers, hacktivists, state-sponsored intrusions, industrial espionage, and insiders. In addition, certain types of attacks could harm us even if our systems are left undisturbed. For example, certain threats are designed to remain dormant or undetectable, sometimes for extended periods of time, or until launched against a target and we may not be able to implement adequate preventative measures. Further, there has been an increase in such activities due to the increase in work-from-home arrangements since the onset of the COVID-19 pandemic. The risk of cyberattacks could also be increased by cyberwarfare in connection with the ongoing Russia-Ukraine and Israel-Hamas conflicts, or other future conflicts, including potential proliferation of malware into systems unrelated to such conflicts. Any future breach of our operations or those of others in the digital asset industry, including third-party services on which we rely, could materially and adversely affect our business.

Read in the 10-K filed Mar 25, 2026 ↗

In 2023, the PRC government initiated a series of regulatory actions and statements to regulate business operations in certain areas in Mainland China, including cracking down on illegal activities in the securities market, enhancing supervision over Mainland China-based companies listed overseas using the variable interest entity structure, adopting new measures to extend the scope of cybersecurity reviews, and expanding the efforts in anti-monopoly enforcement. We are subject to PRC laws and regulations related to the current or future business operations of our subsidiary in Hong Kong and any changes in such laws and regulations and interpretations may impair its ability to operate profitably, which could result in a material negative impact on its operations and/or the value of our Common Stock or other securities.

Read in the 10-K filed Mar 25, 2026 ↗

SRM Ltd has two independent contractors in Hong Kong, which is a part of the PRC. In 2023, the PRC government initiated a series of regulatory actions and statements to regulate business operations in certain areas in China with little advance notice, including cracking down on illegal activities in the securities market, enhancing supervision over China-based companies listed overseas using a VIE structure, adopting new measures to extend the scope of cybersecurity reviews, and expanding its efforts in anti-monopoly enforcement. Since these statements and regulatory actions are new, it is highly uncertain how soon the legislative or administrative regulation making bodies will respond and what existing or new laws or regulations or detailed implementations and interpretations will be modified or promulgated, if any. It is also highly uncertain what the potential impact such modified or new laws and regulations will have on our Hong Kong subsidiary. These actions could result in a material change in the Hong Kong aspects of our operations and/or to the value of our Common Stock or other securities.

Read in the 10-K filed Mar 25, 2026 ↗

Furthermore, on July 10, 2021, the CAC issued a revised draft of the Measures for Cybersecurity Review for public comment, which required that, among others, in addition to any “operator of critical information infrastructure”, any “data processor” controlling personal information of no less than one million users which seeks to list in a foreign stock exchange should also be subject to cybersecurity review, and further elaborated the factors to be considered when assessing the national security risks of the relevant activities. On December 28, 2021, the CAC, the National Development and Reform Commission (“NDRC”), and several other administrations jointly issued the revised Measures for Cybersecurity Review, which became effective and replaced the existing Measures for Cybersecurity Review on February 15, 2022. According to the Revised Review Measures, if an “online platform operator” that is in possession of personal data of more than one million users intends to list in a foreign country, it must apply for a cybersecurity review. Based on a set of Q&A published on the official website of the State Cipher Code Administration in connection with the issuance of the Revised Review Measures, an official of the said administration indicated that an online platform operator should apply for a cybersecurity review prior to the submission of its listing application with non-PRC securities regulators. Moreover, the CAC released the draft of the Regulations on Network Data Security Management in November 2021 for public consultation, which among other things, stipulates that a data processor listed overseas must conduct an annual data security review by itself or by engaging a data security service provider and submit the annual data security review report for a given year to the municipal cybersecurity department before January 31 of the following year. Given the recency of the issuance of the Revised Review Measures and their pending effectiveness, there is a general lack of guidance and substantial uncertainties exist with respect to their interpretation and implementation. It remains unclear whether a Hong Kong company which collects personal information from PRC individuals shall be subject to the Revised Review Measures. We do not currently expect the Revised Review Measures to have an impact on our business, our operations or our offerings as we do not believe that our subsidiary would be deemed to be an “operator of critical information infrastructure” or a “data processor” controlling personal information of no less than one million users, that would be required to file for cybersecurity review before listing in the U.S.. However, there remains uncertainty in the interpretation and enforcement of relevant PRC cybersecurity laws and regulations. If the Revised Review Measures are adopted into law in the future and if our subsidiary is deemed to be an “operator of critical information infrastructure” or a “data processor” controlling personal information of no less than one million users, our operation and the listing of our Common Stock or other securities in the U.S. could be subject to CAC’s cybersecurity review.

Read in the 10-K filed Mar 25, 2026 ↗

As of the date of this Annual Report, Hong Kong does not have similar regulations as of the PRC to extend oversight and control over offerings that are conducted overseas. Hong Kong does not have similar regulation as of the Trial Measures and the Guidance Rules and Notice, and Measures for Cybersecurity Review of the PRC. However, the legal and operational risks associated in Mainland China apply to operations in Hong Kong, and we face the risks and uncertainties associated with the complex and evolving PRC laws and regulations and as to whether and how the recent PRC government statements and regulatory developments, such as those relating to data and cyberspace security and anti-monopoly concerns, would be applicable to a company such as our subsidiary and our Company, given the Hong Kong aspects of our subsidiary in Hong Kong and the possibility that the Chinese government may exercise significant oversight over the conduct of business in Hong Kong. In the event we or our subsidiary were to become subject to PRC laws and regulations, we could incur material costs to ensure compliance, and we or our subsidiary might be subject to fines, experienced evaluation of securities or delisting, restrictions on securities offerings, and/or no longer be permitted to continue business operations as presently conducted. In the event that (i) the PRC government expands the categories of industries and companies whose foreign securities offerings are subject to review by the CSRC or the CAC or if applicable laws, regulations or interpretations change and we are required to obtain such permissions or approvals, (ii) we inadvertently conclude that relevant permissions or approvals were not required or (iii) we did not receive or maintain relevant permissions or approvals required, any action taken by the PRC government could significantly limit or completely hinder our operations in Hong Kong and our ability to offer or continue to offer securities to investors and could cause the value of our Common Stock or other securities to decline.

Read in the 10-K filed Mar 25, 2026 ↗

In 2023, the PRC government initiated a series of regulatory actions and statements to regulate business operations in certain areas in Mainland China, including a cracking down on illegal activities in the securities market, enhancing supervision over Mainland China-based companies listed overseas using the VIE structure, adopting new measures to extend the scope of cybersecurity reviews, and expanding the efforts in anti-monopoly enforcement. Given the recent statements by the Chinese government indicating an intent to exert more oversight and control over offerings that are conducted overseas and/or foreign investment in Mainland China-based issuers, any extension of these actions, statements or policies into Hong Kong could potentially significantly interfere with, alter, limit or hinder our current presence in Hong Kong.

Read in the 10-K filed Mar 25, 2026 ↗

•efforts by hackers or sophisticated groups, such as criminal organizations, state-sponsored organizations or nation-states, to launch coordinated cyberattacks on internally built infrastructure or on third-party cloud-computing platform providers, including malicious code, ransomware, destructive malware, supply chain attacks and distributed denial-of-service attacks;

Read in the 10-K filed Feb 24, 2026 ↗

In the normal course of business, we experience, and have experienced, cyberattacks and other security incidents, which have in the past and may in the future cause harm to our business. For example, in 2022, one such incident resulted in threat actors obtaining employee credentials and accessing customer data, and required us to notify affected customers and regulators and take steps to remediate the incident. While to date the security events we have experienced have not had a material financial impact, we may experience significant and material future incidents. Any security incident can result in loss, corruption, unavailability, or other unauthorized processing of confidential information or sensitive personal information. Any such event, or the perception that it has occurred, may also result in damage to our reputation, erosion of customer trust, loss of customers, litigation, regulatory investigation, fines, penalties, and other consequences and liabilities that could adversely affect our business, results of operation and financial condition. Laws and regulations require us to maintain security measures, and we may have contractual or other legal obligations to notify customers, government agencies, impacted individuals or other relevant stakeholders of security breaches or other incidents, which disclosures are costly and may cause widespread negative publicity and resulting harm, among other adverse consequences. Further, the detection, prevention, and remediation of known and potential security incidents, including determining whether an incident is notifiable or reportable, may not be straightforward and result in additional direct or indirect costs to respond or alleviate the consequences of the actual or perceived incident, such as additional infrastructure capacity spending to mitigate system degradation or reallocation of resources from development activities. We maintain errors, omissions and cyber liability insurance policies covering certain security and privacy damages, but such insurance may not be sufficient to cover the potentially significant losses resulting from a security breach or other incident, may be denied with respect to a particular claim, or may not remain available in the future on acceptable terms or at all.

Read in the 10-K filed Feb 24, 2026 ↗

We are subject to increasing legal, regulatory, and contractual obligations relating to privacy, data protection and cybersecurity that affect how we process personal data in the jurisdictions where we and our customers operate. Our obligations change frequently due to new or modified laws and regulations, as well as court rulings interpreting or invalidating them. These evolving obligations involve significant compliance costs and operational challenges, and increasingly expose us to enforcement actions and other proceedings or actions, sanctions, and litigation, as well as regulatory and public scrutiny of our practices relating to personal information. We expect the increasing breadth and depth, and changing nature of, these obligations to continue to require significant resources, including to review our technology, systems and processes against changing requirements. They may also limit our ability to use personal data for new products, including those relying on AI-related technologies.

Read in the 10-K filed Feb 24, 2026 ↗

In the United States, for example, the California Consumer Privacy Act (as amended by the California Privacy Rights Act of 2020, the “CCPA”) provides our customers, employees, and other individuals certain rights related to their personal information. The federal government has also proposed, and numerous other states are considering or have proposed and/or enacted, laws and regulations addressing privacy and cybersecurity. Internationally, the regulatory landscape is increasingly complex and fragmented and compliance increasingly financially burdensome. For example, in the European Union (“EU”), the General Data Protection Regulation (“GDPR”) imposes significant requirements regarding the processing of personal information, including related to transparency, individuals’ privacy rights, compliance contracting, data minimization, data breach notification, data retention, security, and international data transfers. Other international privacy and data protection laws also impose strict requirements, such as related to marketing communications and deployment of cookies. Together, this patchwork of global requirements presents significant compliance challenges, and subjects us to possible fines, sanctions, litigation, and other adverse consequences. For example, under the GDPR, regulators may impose temporary or definitive bans on data transfers or other processing, require deletion, and impose significant fines, potentially ranging up to 4% of our worldwide revenue.

Read in the 10-K filed Feb 24, 2026 ↗

Negative publicity or perceptions involving us or our brands, products, associates, operations, vendors, spokespersons, or marketing and other partners may negatively impact our reputation and adversely affect our ability to attract and retain guests, associates, vendors, and/or other partners. Failure to detect, prevent, or mitigate issues that might give rise to reputational risk or failure to adequately address negative publicity or perceptions could adversely impact our business, results of operations, and financial condition. Issues that might pose a reputational risk include failure of our cybersecurity measures to protect against cybersecurity incidents; product liability and product recalls; inaccurate claims regarding the sustainability or content/ingredients of the products sold in our stores, including in connection with our Conscious Beauty program; our social media activity; our handling of issues relating to corporate responsibility matters, including our responses to such matters; failure to comply with applicable laws and regulations or enforce our own policies; public stances on controversial social or political issues; concerns surrounding labor, environmental, workplace

Read in the 10-K filed Mar 26, 2026 ↗

From time to time, we may make strategic acquisitions and participate in joint ventures and partnerships. Acquisitions, joint ventures, and partnerships we have entered into, or may enter into in the future, may involve significant challenges and risks, including that the acquisitions, joint ventures, or partnerships do not advance our business strategy or fail to produce satisfactory returns on investment. Other risks could include difficulties in integrating acquisitions with our operations, applying internal control processes to these acquisitions (including those related to cybersecurity), managing strategic investments, and/or combining business cultures; regulatory or compliance exposure until appropriate processes and controls are implemented; integration costs and significant attention from management and personnel; failing to realize the anticipated benefits of acquisitions, joint ventures, or partnerships, or the realization of benefits being significantly delayed, including because the businesses acquired may not be complementary or compatible with our business strategy or may not enhance our market position, footprint, or capability set; and due diligence evaluations of potential transactions not identifying all of the business, legal, compliance, and financial risks to accurately estimate the impact of a particular acquisition, joint venture, or partnership, including potential exposure to regulatory sanctions resulting from an acquisition target’s or business partner’s previous activities.

Read in the 10-K filed Mar 26, 2026 ↗

In addition, we are increasing our utilization of artificial intelligence ("AI") to optimize our operations, improve the customer experience and support decision-making. The rapid evolution and increased adoption of AI technologies has and may continue to intensify our cybersecurity risks. AI technologies often require access to large volumes of sensitive data. If our AI systems are compromised through cyberattacks or unauthorized access, it could result in data breaches, a loss of proprietary information, or violations of data protection laws. Additionally, leveraging AI capabilities for our internal functions may introduce additional operational vulnerabilities by producing inaccurate outcomes, recommendations or other suggestions based on flaws in the underlying data, or other unintended results.

Read in the 10-K filed Feb 17, 2026 ↗

Legislators and regulators worldwide are increasingly adopting or revising privacy, data protection, data transfer, cybersecurity and AI laws, creating a complex, fragmented, evolving and often inconsistent global compliance landscape. Privacy laws in numerous jurisdictions, impose specific requirements for cross-border data transfers, transparency, automated decision making, data localization and substantial compliance and audit obligations. In Europe, data protection authorities continue to enforce the General Data Protection Regulation with record-setting fines. Similarly, new cybersecurity laws and regulations continue to come into force globally, and Visa continues to enter new markets where certain services are subject to new cybersecurity legal requirements. These laws and regulations often impose both specific cybersecurity control and governance requirements as well as incident reporting obligations. As we develop more integrated and personalized products and services, acquire new companies and expand our data profile across additional data types, sources, channels and partners, the impact of these laws on our business will continue to grow. Noncompliance with any of these regimes could result in regulatory penalties, significant legal liability and enforcement actions.

Read in the 10-K filed Nov 5, 2026 ↗

Our and our partners’ use of AI across data platforms, data storage, data transfer, products, services, and operational processes depends in part on third-party tools, models and infrastructure that we do not fully control. These technologies may process confidential, proprietary, sensitive or personal information and may introduce or amplify cybersecurity, data governance, privacy, data residency, sovereignty, licensing and operational risks. We are subject to an increasingly fragmented and expanding set of laws governing the development, procurement, deployment and use of AI technologies. Risks associated with the development and procurement of AI include intellectual property, data collection, third-party and training data risks, as well as risks relating to the security, integrity and performance of third-party AI models, including open-source models. Our reliance on third-party AI tools, models, infrastructure and data processing environments may further limit our ability to monitor, control or remediate how confidential or personal information is accessed, retained, used, transferred or secured.

Read in the 10-K filed Nov 5, 2026 ↗

The emergence of agentic commerce, in which autonomous AI agents initiate and execute transactions on behalf of users, presents novel regulatory, privacy, cybersecurity and fraud risks. Legal frameworks governing autonomous agents remain nascent, and the interplay between payments regulations, data privacy laws and evolving AI rules creates uncertainty around compliance obligations and liability exposure. As agentic commerce scales, there could be increased instances of unauthorized, erroneous or disputed payments, or fraud. Agentic commerce may also introduce challenges in monitoring cross-border, prohibited or high-risk transactions subject to conflicting regulatory requirements.

Read in the 10-K filed Nov 5, 2026 ↗

The global proliferation of privacy, cybersecurity and AI regulation requires us to continuously monitor and adapt our privacy, cybersecurity, data use and AI management, governance and compliance practices. Our development and implementation of governance frameworks aimed at complying with fragmented and emerging laws and regulations applicable to these areas may not be successful to mitigate all of these emerging risks. If our AI-enabled data practices are, or are perceived to be, inadequately governed, inaccurate or non-compliant, we could face reputational harm, regulatory scrutiny, enforcement actions or legal claims. Failure to adapt our data governance practices to keep pace with evolving AI technologies, data processing practices, cybersecurity threats, and regulatory requirements could harm our ability to compete, decrease the value of our products and services to clients, and adversely affect our future growth.

Read in the 10-K filed Nov 5, 2026 ↗

and procedures used to obtain unauthorized access, or to disable or degrade systems change frequently, have become increasingly more complex and sophisticated, and may be difficult to detect for periods of time, we may not anticipate these acts or respond adequately or timely. New and emerging technologies, such as AI and quantum computing, could strengthen threat actor capabilities and cybersecurity risks in ways that are difficult to anticipate, detect or mitigate. For example, cybercriminals have increasingly demonstrated advanced capabilities, such as use of zero-day vulnerabilities, and rapid integration of new technology (such as GenAI and agentic AI) are being used by threat actors to create sophisticated attacks that are increasingly automated, targeted, coordinated and more difficult to defend against. Rapid adoption and novel uses of GenAI and agentic commerce across the marketplace may also introduce unique and unpredictable security risks to our systems, data and the payments ecosystem. Our own use and deployment of AI technologies could expand our cybersecurity attack surface, increasing exposure to breaches, fraud, unauthorized transactions and other vulnerabilities. For example, frontier AI labs have reported instances of AI agents conducting unauthorized cyber exploitation without direction. Such agents deployed by our Company, clients, partners, vendors, and others could circumvent cybersecurity controls and compromise our systems, data, operations and the payments ecosystem. Advances in quantum computing may introduce cryptography risks that could threaten the security of our information and systems or could require significant investment in technology to effectively mitigate these risks.

Read in the 10-K filed Nov 5, 2026 ↗

information about the cyber incident to our clients, partners and regulators, as well as to the public. In the event we are found to be out of compliance, we could be subject to monetary damages, civil and criminal penalties, litigation, investigations and proceedings, and damage to our reputation and brand.

Read in the 10-K filed Nov 5, 2026 ↗

As we expand our data product offerings into new jurisdictions, we are required to assess, monitor, and comply with additional laws and regulations related to our collection and processing of data, which may include new registration, consent, and notification obligations. In addition to our own processing of personal data, our customers expect that our solutions can be used to enable their compliance with applicable data protection, data privacy, and cybersecurity laws and regulations.

Read in the 10-K filed Mar 20, 2026 ↗

Our operations depend on the reliable supply of natural gas, electricity, and water. We consume significant amounts of natural gas, electricity, and water to operate our refineries and plants, and the prices thereof can have a measurable effect on the total cost of our operations. Volatility in the prices for natural gas and electricity, in particular, is an ongoing risk to such costs. We also purchase other commodities whose prices may vary depending on the prices of natural gas, electricity, and water. The availability and prices of natural gas, electricity, and water have been, and could continue to be, affected by numerous events, such as (as applicable) government regulations or actions (including sanctions); rationing and curtailment; rate increases; weather (e.g., droughts, hurricanes, and periods of extreme heat or cold); logistics interruptions; electric grid outages; cybersecurity incidents; intermittent electricity generation (particularly from wind and solar); hostilities; terrorism; protests; human error; population and industry growth; infrastructure or supply mismanagement; and supply and demand imbalances.

Read in the 10-K filed Feb 25, 2026 ↗

The legal and regulatory landscape surrounding AI technologies is rapidly evolving and uncertain, including in the areas of intellectual property, cybersecurity and privacy and data protection. Compliance with new or changing laws, regulations or industry standards relating to AI may impose significant costs and may limit our ability to develop, deploy or use AI technologies. Failure to appropriately respond to this evolving landscape may result in legal liability, regulatory action, or brand and reputational harm.

Read in the 10-K filed Feb 20, 2026 ↗

The use of AI technology by third-parties, including our vendors, and our use of AI technology, tools, and services could expose us to cybersecurity, operational, intellectual property and regulatory risks that could adversely affect our business, reputation or financial results.

Read in the 10-K filed Feb 5, 2026 ↗

The use of AI technology by third parties may increase our exposure to cybersecurity and data protection risks. For example, recent advances in AI technology and tools have made, and will continue to make, cyber-attacks more sophisticated, harder to defend, and easier and faster to launch. These tools permit rapid exploitation of vulnerabilities, which hinders our ability to defend against such exploitation. In addition, the use and integration of AI technology into the products and services that we procure could create or exacerbate vulnerabilities, potentially resulting in unauthorized access to our systems including our sensitive or proprietary information. For more details on these risks, see our risk factor “Attempted security breaches, including from the exploitation of vulnerabilities, cyber-attacks and Distributed Denial of Service (“DDoS”) attacks against our systems and services increase our costs, expose us to potentially material liability, and could materially harm our business and reputation.”

Read in the 10-K filed Feb 5, 2026 ↗

technology systems because of software or hardware malfunctions, computer viruses, cyber-attacks, employee theft or

Read in the 10-K filed Feb 13, 2026 ↗

Cyber-attacks and incidents are increasing in their frequency, sophistication, and intensity, and are difficult to detect.

Read in the 10-K filed Feb 13, 2026 ↗

Cyber-attacks are carried out by well-resourced groups and individuals with a wide range of motives and expertise. Due to

Read in the 10-K filed Feb 13, 2026 ↗

the nature of some cyber-attacks and incidents, there is a risk that they may remain undetected for a period of time. Recent

Read in the 10-K filed Feb 13, 2026 ↗

well as an increased number of cyber extortion attacks with higher financial ransom demand amounts and increasing

Read in the 10-K filed Feb 13, 2026 ↗

sophistication and variety of ransomware techniques. Cyber-attacks and incidents also include manufacturing, hardware or

Read in the 10-K filed Feb 13, 2026 ↗

service providers to adequately safeguard their systems and prevent cyber-attacks or data privacy incidents could disrupt our

Read in the 10-K filed Feb 13, 2026 ↗

Like many companies, we have experienced immaterial cybersecurity incidents, including temporary service

Read in the 10-K filed Feb 13, 2026 ↗

will prevent breakdowns or breaches in our systems that could adversely affect our business. While we maintain cyber

Read in the 10-K filed Feb 13, 2026 ↗

result from an interruption or breach of our systems and those of critical third parties. Cybersecurity incidents can cause the

Read in the 10-K filed Feb 13, 2026 ↗

Furthermore, the deployment of artificial intelligence systems could expose us to increased cybersecurity threats, such as data

Read in the 10-K filed Feb 13, 2026 ↗

not limited to: (i) foreign currency fluctuations and challenges with respect to the repatriation of foreign earnings and cash; (ii) treatment of international currency gains or losses under certain tests required for us to maintain our status as a REIT; (iii) impact from international trade disputes and the associated impact on our managers’, tenants’ and borrowers’ supply chain and consumer spending levels; (iv) changes in foreign political, regulatory and economic conditions; (v) challenges in staffing and labor and managing international operations, including negotiating with foreign labor unions; (vi) challenges of complying with a wide variety of foreign laws and regulations, including those relating to real estate, corporate governance, operations, licensing, taxes, data privacy (including U.K. GDPR), cybersecurity, employment and legal proceedings; (vii) changes in regulatory and environmental requirements, taxes, tariffs, trade wars and laws; (viii) foreign ownership restrictions with respect to operations in foreign countries; (ix) local businesses and cultural factors that differ from our usual standards and practices; (x) differences in lending practices and the willingness of domestic or foreign lenders to provide financing; (xi) regional or country-specific business cycles and political and economic instability; and (xii) failure to comply with applicable laws and regulations in the United States that affect foreign operations, such as the U.S. Foreign Corrupt Practices Act.

Read in the 10-K filed Feb 6, 2026 ↗

Uncertainty around the safety and security of new and emerging AI applications may require additional investment in the development of proprietary datasets, machine learning models and systems to test for security, accuracy, bias and other variables, which are often complex, may be costly and could impact our operating results. Cybersecurity threat actors may also utilize AI tools to automate and enhance cybersecurity attacks against us and could lead to data breaches, loss of confidential or sensitive information, and financial or reputational harm.

Read in the 10-K filed Feb 6, 2026 ↗

In addition to the risks inherent in all information technology systems—including cybersecurity, data confidentiality, system integrity, and availability—the unique characteristics of AI can amplify existing risks and introduce new risks. These include an elevated risk of intellectual property loss or infringement, whether through inadvertent disclosure, unauthorized training on proprietary data, or improper use of third-party content. AI tools lower the barrier to access and replication, increasing the likelihood of intellectual property leakage, copyright violations, and regulatory non-compliance. Additionally, ML or AI-based systems may be subject to novel cybersecurity risks, including attempts to manipulate model outputs, poison data, or extract sensitive information, which could compromise the confidentiality, integrity, or availability of our systems and data.

Read in the 10-K filed Feb 26, 2026 ↗

Cyberattacks, including through the use of ransomware and other forms of malware, distributed denial of services attacks, credential harvesting, social engineering and other means for obtaining unauthorized access to or disrupting the operation of our

Read in the 10-K filed Feb 17, 2026 ↗

The rapid evolution and increased adoption of artificial intelligence technologies may intensify our cybersecurity risks by increasing the frequency and severity of cyberattacks against us or other companies and by making cyberattacks more difficult to detect, contain or mitigate.

Read in the 10-K filed Feb 17, 2026 ↗

In addition, as AI technologies are increasingly used across the industry, including in connection with data analytics, automation, customer service, and decision-support features, the speed, scale, and complexity of data processing may increase, which may heighten data privacy risks. AI-enabled or agentic AI features may be targeted, misused, or produce outputs or inferences that implicate personal data in ways that are difficult to anticipate or control, potentially resulting in regulatory scrutiny, litigation, or reputational harm, even in the absence of a data breach.

Read in the 10-K filed Mar 6, 2026 ↗

In addition, armed conflicts and heightened geopolitical tensions can result in sanctions, export controls, tariffs and other trade restrictions, limit or restrict our ability to access certain markets and disrupt critical logistics networks, including air and ocean freight routes. For example, the escalation of the conflict involving Iran and heightened tensions in the Middle East could cause disruption to critical logistics and supply routes, which could affect the availability and cost of materials used in our business. Additionally, China has imposed export restrictions on rare earth minerals and related materials critical to semiconductor and hard drive manufacturing. These developments have increased, and could further increase, costs for, or limit the availability of, energy, rare earth minerals, materials, components and transportation, constrain manufacturing capacity and may require us to redesign products or reconfigure aspects of our global supply chain. Geopolitical instability may also elevate cybersecurity risks, including state-sponsored attacks, which could disrupt our operations or those of our suppliers, customers or partners, and further adversely affect demand for our products.

Read in the 10-K filed Aug 14, 2026 ↗

technologies. These may include highly convincing phishing or social engineering attacks that use AI-generated deepfakes, the exploitation of vulnerabilities in electronic identity validation security programs via AI-replicated images or voices, or the inadvertent incorporation of malicious or hallucinated content generated by AI tools into our systems or those of our customers or partners. Separately, the AI technologies that we employ for business purposes may be vulnerable to prompt-injection or other adversarial attacks, which could result in unauthorized access to or leakage of sensitive information. Geopolitical tensions or conflicts may also create heightened risk of cybersecurity incidents.

Read in the 10-K filed Aug 14, 2026 ↗

For more information about our cybersecurity risk management, governance and oversight, see “Item 1C: Cybersecurity.”

Read in the 10-K filed Mar 26, 2026 ↗

For more information about our cybersecurity risk management, governance and oversight, see “Item 1C: Cybersecurity.”

Read in the 10-K filed Mar 26, 2026 ↗

•Inability to deliver energy across transmission facilities, including due to congestion, outages, extreme weather, physical or cyber events, delays in construction or upgrades, permitting or siting challenges, or interconnection constraints.

Read in the 10-K filed Feb 25, 2026 ↗

Advancements in artificial intelligence and large language models may increase cybersecurity threats and operational risks. Threat actors may use artificial intelligence to enhance their attacks, increasing the frequency, sophistication and potential impact of cyber incidents affecting our IT and OT environment.

Read in the 10-K filed Feb 25, 2026 ↗

A cybersecurity incident or other damage or disruption to IT and communications networks, or involving our connected products and services, may have adverse effects on us, our customers or third parties on which we rely by interfering with operations and services, potentially with public health and safety risks involving certain of our

Read in the 10-K filed Feb 25, 2026 ↗

The workforce reduction and reorganization may disrupt our operations and adversely affect employee morale and productivity. The departure of employees, including experienced personnel, may result in the loss of institutional knowledge and expertise, and remaining employees may experience increased workloads, which could lead to increased error rates, reduced innovation and attrition of key talent. Our ability to successfully operate with a reduced workforce is expected to depend in part on the effectiveness, reliability and adoption of our proactive intelligence and AI tools. These technologies may not perform as expected, may require more time or expense to implement effectively, may introduce operational or cybersecurity risks, or may fail to enhance productivity and maintain operational efficiency as expected. These actions could increase the risk of operational disruptions, service interruptions, control failures or other significant events, particularly during transition periods, as responsibilities are reassigned and processes are adjusted. We expect to continue to invest in employees we wish to retain and attract, including through increased compensation. In addition, evolving regulatory requirements and public scrutiny relating to AI technologies could increase compliance costs or limit our ability to deploy such tools as intended.

Read in the 10-K filed Feb 26, 2026 ↗

We incorporate (and expect to continue incorporating) AI capabilities in the development of new technologies and products and continue to expand the use of AI in our business and operations. Generative AI technologies are new and rapidly evolving technologies that could deliver significant benefits, but also present a number of operational, compliance, ethical, and reputational risks. AI algorithms are currently known to sometimes generate, among other things, irrelevant, nonsensical, deficient, factually inaccurate, biased or infringing content and results. In addition, if the manners in which we deploy and use AI become controversial, we may experience reputational harm to our brand, competitive harm or legal liability. In addition, we are subject to a growing number of cybersecurity and AI safety laws in markets in which we operate. For example, some of our European operations are subject to NIS2 which imposes cybersecurity requirements on “essential entities.” The EU AI Act prohibits certain AI systems that are categorized as “High Risk,” and requires certain disclosures about the use of AI tools. In the United States, there are emerging state AI laws and regulations that may impose additional requirements and restrictions in connection with the use of AI systems, including their use for "high risk" or "consequential" decision making. These rapidly changing regulatory complexities may increase our compliance costs. Moreover, there is risk that confidential information, including material non-public information, trade secrets or personal identifiable information, is input into AI applications, resulting in such information becoming accessible by third parties, including our competitors.

Read in the 10-K filed Feb 12, 2026 ↗