Cybersecurity and data breaches

By sector

Sector is the SEC's industry description of the company. Each count opens that sector's quotes below.

528 paragraphs · Computer & office Equipment show all sectors

In the ordinary course of business, we store sensitive data, including intellectual property, personal data, our proprietary business information and that of our employees, contractors, customers, vendors, partners, suppliers, and other third parties with whom we do business. In addition, we store sensitive data through cloud-based services that may be hosted by third parties and in data center infrastructure maintained by third parties. We have been, and expect to be, subject to cyberattacks and other attempted intrusions into our networks and systems by a wide range of actors, including, but not limited to, nation state actors, criminal enterprises, terrorist organizations, and other organizations or individuals, as well as errors, wrongful conduct or malfeasance by employees and third-party service providers, (collectively, “malicious parties”) who have at times been able to circumvent or bypass our cyber security measures. Geopolitical tensions or conflicts may also heighten the risk of such cyberattacks or exacerbate system vulnerabilities, considering our continued hybrid work environment and our globally dispersed operations, employees, contractors, suppliers, developers, partners, and other third parties.

Read in the 10-K filed Dec 18, 2025 ↗

Additional impacts from cybersecurity incidents have included and could include reimbursement of remediation costs to our customers, suppliers, or distributors; lost revenue resulting from the unauthorized use of proprietary information or the failure to retain or attract business partners following an incident; increased insurance premiums; and damage to our competitiveness, reputation, stock price, and long-term shareholder value. To the extent we carry insurance coverage for such possibilities, we cannot be certain that any such coverage will be adequate or otherwise protect us with respect to claims, expenses, fines, penalties, business loss, data loss, litigation, regulatory actions, or other impacts arising from security breaches or incidents, or that such coverage will continue to be available on acceptable terms or at all.

Read in the 10-K filed Dec 18, 2025 ↗

The cybersecurity threat landscape is rapidly evolving and becoming increasingly sophisticated, and there can be no assurance that our controls and procedures will be sufficient to address future threats or remediate future incidents. Further, there has been an increase in the frequency and sophistication of attacks, and we expect these activities to continue to increase, including malicious actors potentially leveraging AI to develop malicious code or sophisticated phishing attempts. It is possible that such incidents may embolden other malicious actors to perpetrate future attacks that may result in material misappropriation, system disruptions or shutdowns, malicious alteration, or destruction of our confidential or personal information or that of third parties. Additionally, the proliferation of generative AI models within the internal systems, processes, and tools of HPE, our suppliers, our customers, or other third parties with whom we do business may create new attack methods for threat actors. The emergence of deepfakes and advanced social engineering tactics presents new challenges in preventing deception and unauthorized access, underscoring the importance of advanced verification and detection mechanisms. Zero-day vulnerabilities may include newly discovered security flaws in software that are exploited before patches are released, requiring proactive monitoring and immediate remediation efforts. Quantum computing may in the future present a risk to our business by potentially breaking traditional cryptographic methods on which we rely, thereby necessitating the shift to quantum-resistant encryption techniques.

Read in the 10-K filed Dec 18, 2025 ↗

Malicious parties may also be able to otherwise develop and deploy viruses, worms, ransomware, and other malicious software programs that attack our products or otherwise exploit any security vulnerabilities of our products, including within our cloud-based environments and offerings, such that we may be unable to anticipate such malicious parties’ techniques, implement adequate preventative measures, or remediate any intrusion on a timely or effective basis even if our security measures are appropriate, reasonable, and comply with applicable legal requirements. Advanced persistent threats can include

Read in the 10-K filed Dec 18, 2025 ↗

Our suppliers, vendors, partners, and other third parties with whom we do business also face similar cybersecurity threats, risks, and concerns as those set forth above, which introduces vulnerabilities to our business and operations, including our manufacturing supply chain. Although HPE requires strict cybersecurity and data controls through its contractual agreements with third parties, if these third parties do not have adequate safeguards or their safeguards fail, it may result in breaches of their systems, networks, or applications, potentially leading to breaches of our networks and systems or unauthorized access to or disclosure of our and/or our customers' confidential data, thereby compromising us and our customers. While HPE relies on independent audit reports, in addition to our own security assessments and diligence of third parties with whom we do business as part of our third-party risk management practices, these efforts may not detect or identify all cybersecurity risks or vulnerabilities.

Read in the 10-K filed Dec 18, 2025 ↗

Additionally, some of our business processes depend upon the IT systems and processes of third parties, and the interfaces between those and our IT systems, as well as hosted SaaS applications from third parties. For example, we receive a broad range of information technology services, such as applications, including support, development and maintenance; infrastructure management and support, including for server storage and network devices; and end user support. Some of these services are provided to us through cloud providers, third party providers, and off-site facilities that may be vulnerable to damage or interruption, including performance problems from earthquakes, hurricanes, floods, fires, power loss, telecommunications failures, equipment failures, adverse events caused by operator error, cybersecurity attacks, pandemics, and similar events. In addition, because we lease certain off-site data center facilities, we cannot be assured that we will be able to

Read in the 10-K filed Dec 18, 2025 ↗