Cybersecurity and data breaches
205 of 521 companies added a paragraph in Risk Factors that uses one of these words:
cybersecurity, cyber, ransomware, data breach, cyberattack, hackers.
The paragraph is in the latest 10-K and nothing like it was in the one before.
It counts text; it does not say how serious a risk is. Words in capitals only (such as AI) must be in capitals.
By sector
Sector is the SEC's industry description of the company. Each count opens that sector's quotes below.
| Sector | Companies | Compared |
|---|---|---|
| Computer Communications Equipment | 3 | 3 |
| Accident & Health Insurance | 2 | 2 |
| Computer Peripheral Equipment, NEC | 2 | 2 |
| Instruments For Meas & Testing of Electricity & Elec Signals | 2 | 2 |
| Men's & Boys' Furnishgs, Work Clothg, & Allied Garments | 2 | 2 |
| Rubber & Plastics Footwear | 2 | 2 |
| Air Courier Services | 1 | 1 |
| Aircraft Parts & Auxiliary Equipment, NEC | 1 | 1 |
| Apparel & Other Finishd Prods of Fabrics & Similar Matl | 1 | 1 |
| Bottled & Canned Soft Drinks & Carbonated Waters | 1 | 1 |
| Canned, Fruits, Veg, Preserves, Jams & Jellies | 1 | 1 |
| Electrical Industrial Apparatus | 1 | 1 |
| Electromedical & Electrotherapeutic Apparatus | 1 | 1 |
| Electronic Components & Accessories | 1 | 1 |
| Electronic Connectors | 1 | 1 |
| Engines & Turbines | 1 | 1 |
| Gas & Other Services Combined | 1 | 1 |
| General Industrial Machinery & Equipment, NEC | 1 | 1 |
| Grain Mill Products | 1 | 1 |
| Heavy Construction Other Than Bldg Const - Contractors | 1 | 1 |
| In Vitro & In Vivo Diagnostic Substances | 1 | 1 |
| Insurance Carriers, NEC | 1 | 1 |
| Leather & Leather Products | 1 | 1 |
| Meat Packing Plants | 1 | 1 |
| Misc Industrial & Commercial Machinery & Equipment | 1 | 1 |
| Miscellaneous Manufacturing Industries | 1 | 1 |
| Paints, Varnishes, Lacquers, Enamels & Allied Prods | 1 | 1 |
| Paper Mills | 1 | 1 |
| Real Estate Operators (No Developers) & Lessors | 1 | 1 |
| Retail-Drug Stores and Proprietary Stores | 1 | 1 |
| Retail-Eating & Drinking Places | 1 | 1 |
| Retail-Home Furniture, Furnishings & Equipment Stores | 1 | 1 |
| Retail-Radio, Tv & Consumer Electronics Stores | 1 | 1 |
| Retail-Retail Stores, NEC | 1 | 1 |
| Rolling Drawing & Extruding of Nonferrous Metals | 1 | 1 |
| Services-Advertising Agencies | 1 | 1 |
| Services-Detective, Guard & Armored Car Services | 1 | 1 |
| Services-Misc Health & Allied Services, NEC | 1 | 1 |
| Special Industry Machinery (No Metalworking Machinery) | 1 | 1 |
| Telephone & Telegraph Apparatus | 1 | 1 |
| Television Broadcasting Stations | 1 | 1 |
| Trucking & Courier Services (No Air) | 1 | 1 |
| Water Supply | 1 | 1 |
| Wholesale-Electronic Parts & Equipment, NEC | 1 | 1 |
| Wholesale-Medical, Dental & Hospital Equipment & Supplies | 1 | 1 |
| X-Ray Apparatus & Tubes & Related Irradiation Apparatus | 1 | 1 |
| Finance Services | 21 | 28 |
| Insurance Agents, Brokers & Service | 4 | 6 |
| Electrical Work | 2 | 3 |
| Retail-Auto Dealers & Gasoline Stations | 2 | 3 |
| Services-Computer Integrated Systems Design | 2 | 3 |
| Investment Advice | 5 | 8 |
| Biological Products, (No Diagnostic Substances) | 3 | 5 |
| Computer Storage Devices | 3 | 5 |
| Services-Computer Programming, Data Processing, Etc. | 3 | 5 |
| National Commercial Banks | 6 | 11 |
| Services-Prepackaged Software | 10 | 19 |
| Petroleum Refining | 3 | 6 |
| Electronic & Other Electrical Equipment (No Computer Equip) | 2 | 4 |
| Search, Detection, Navigation, Guidance, Aeronautical Sys | 2 | 4 |
| Security & Commodity Brokers, Dealers, Exchanges & Services | 2 | 4 |
| Services-Computer Processing & Data Preparation | 2 | 4 |
| Aircraft Engines & Engine Parts | 1 | 2 |
| Cutlery, Handtools & General Hardware | 1 | 2 |
| Industrial Organic Chemicals | 1 | 2 |
| Mining & Quarrying of Nonmetallic Minerals (No Fuels) | 1 | 2 |
| Oil & Gas Field Services, NEC | 1 | 2 |
| Optical Instruments & Lenses | 1 | 2 |
| Printed Circuit Boards | 1 | 2 |
| Pumps & Pumping Equipment | 1 | 2 |
| Radio & Tv Broadcasting & Communications Equipment | 1 | 2 |
| Retail-Auto & Home Supply Stores | 1 | 2 |
| Services-Computer Programming Services | 1 | 2 |
| Services-General Medical & Surgical Hospitals, NEC | 1 | 2 |
| Services-Medical Laboratories | 1 | 2 |
| Telephone Communications (No Radiotelephone) | 1 | 2 |
| Transportation Services | 1 | 2 |
| Trucking (No Local) | 1 | 2 |
| Semiconductors & Related Devices | 7 | 15 |
| Security Brokers, Dealers & Flotation Companies | 3 | 7 |
| Surgical & Medical Instruments & Apparatus | 4 | 10 |
| Industrial Instruments For Measurement, Display, and Control | 2 | 5 |
| Orthopedic, Prosthetic & Surgical Appliances & Supplies | 2 | 5 |
| Services-Business Services, NEC | 6 | 16 |
| Pharmaceutical Preparations | 4 | 11 |
| Electric Services | 5 | 15 |
| Electric & Other Services Combined | 4 | 12 |
| State Commercial Banks | 2 | 6 |
| Air-Cond & Warm Air Heatg Equip & Comm & Indl Refrig Equip | 1 | 3 |
| Computer & office Equipment | 1 | 3 |
| Electronic Computers | 1 | 3 |
| Life Insurance | 1 | 3 |
| Measuring & Controlling Devices, NEC | 1 | 3 |
| Plastic Materials, Synth Resins & Nonvulcan Elastomers | 1 | 3 |
| Services-Commercial Physical & Biological Research | 1 | 3 |
| Soap, Detergents, Cleang Preparations, Perfumes, Cosmetics | 1 | 3 |
| Real Estate Investment Trusts | 8 | 27 |
| Crude Petroleum & Natural Gas | 2 | 7 |
| Fire, Marine & Casualty Insurance | 3 | 12 |
| Retail-Eating Places | 1 | 4 |
| Hospital & Medical Service Plans | 1 | 5 |
| Laboratory Analytical Instruments | 1 | 5 |
| Retail-Variety Stores | 1 | 5 |
528 paragraphs · Computer Communications Equipment show all sectors
•we, or third parties on which we rely, could experience cybersecurity incidents, which could disrupt our operations, cause vulnerabilities in our products or services, compromise intellectual property or other sensitive data, or otherwise negatively impact our business.
Read in the 10-K filed Feb 17, 2026 ↗
We, or third parties on which we rely, could experience cybersecurity incidents relating to our information systems, or our products, services, or data, which could disrupt our operations or our ability to provide services, cause vulnerabilities or perceived vulnerabilities in our product, compromise intellectual property or other sensitive data, harm our reputation, damage customer or other relationships, delay our ability to recognize revenue, lead to significant costs, legal proceedings, legal liability, or enforcement actions, or otherwise negatively impact our business.
Read in the 10-K filed Feb 17, 2026 ↗
We, like all technology companies, depend upon information technology systems to conduct virtually all business operations, ranging from internal operations and product development activities to marketing and sales efforts and communications with customers and business partners. We could experience disruptions, cybersecurity breaches, and other cybersecurity incidents relating to our information systems, or our products, services, or data. We could also be impacted by cybersecurity incidents through third parties on which we rely. We have outsourced some business functions to third parties, including our manufacturers, logistics providers, and cloud service providers. We also rely upon distributors, resellers and system integrators to sell our products. We also depend upon our employees, and the technology our employees use to comply with the security measures we have instituted to prevent and mitigate cybersecurity incidents.
Read in the 10-K filed Feb 17, 2026 ↗
We, or third parties on which we rely, could experience disruptions, cybersecurity breaches, and other cybersecurity incidents with many different types of causes, including phishing schemes and other social engineering methods, fraud and other malfeasance, denial of service attacks, vulnerabilities or defects in design or manufacture, unintended technical errors, misconfigurations, “bugs,” viruses, ransomware and other malware, mishandling of data or other mistakes by employees or other insiders, and attacks by insiders or external parties. Sophisticated, or even unsophisticated, persons or organizations may attempt to compromise our systems, or third party systems on which we rely, and access, use, destroy, impair, or obtain confidential, personal, or otherwise sensitive or proprietary information and could compromise our systems, products, services and networks, or those of third parties on which we rely. Geopolitical tensions and conflicts, such as the Russia-Ukraine conflict, and deteriorating U.S.-China relations, may create a greater risk of cyberattacks against our company and our manufacturers, suppliers, logistics providers, banks and other business partners. Our acquisition of Awake Security and our provision of its NDR platform may result in us being a more attractive target for such attacks. We may also face increased risks of cybersecurity incidents in connection with personnel working remotely.
Read in the 10-K filed Feb 17, 2026 ↗
We may experience cybersecurity incidents that we do not detect, or that we do not detect for extended periods of time. The techniques used to carry out attacks are constantly evolving, and it may be more difficult to detect attacks involving techniques that we are not aware of or have not anticipated.
Read in the 10-K filed Feb 17, 2026 ↗
If we, or any of the aforementioned third parties, or any other third parties capable of introducing risks to our system or operations, experience a cyberattack or any other kind of cybersecurity incident, our ability to conduct our business effectively could be damaged in a number of ways, including:
Read in the 10-K filed Feb 17, 2026 ↗
We also expect laws, regulations, industry standards and other obligations worldwide relating to privacy, data protection and cybersecurity to continue to evolve, and that there will continue to be new, modified, and re-interpreted laws, regulations, standards, and other obligations in these areas. For example, the Network and Information Security Directive II, or NIS2, adopted in 2023, aims to enhance cybersecurity across critical infrastructure and essential services in the EU. It expands the scope of the 2016 NIS Directive to include additional sectors while enforcing stricter governance and accountability requirements. NIS2 requires all 27 EU member states to issue implementing legislation by October 2024; however, several EU
Read in the 10-K filed Feb 17, 2026 ↗
For additional information and a further discussion of impacts and risks related to cybersecurity matters, see the risk factors under the “Item 1A. Risk Factors— Risk Related to Cybersecurity, Privacy, and Regulatory Requirements” heading.
Read in the 10-K filed Sep 2, 2026 ↗
•The Cyber Incident has had and may continue to have an adverse effect on our business, reputation, customer, employee and partner relations, results of operations, financial condition and cash flows;
Read in the 10-K filed Nov 25, 2025 ↗
The Cyber Incident has had and may continue to have an adverse effect on our business, reputation, customer, employee and partner relations, results of operations, financial condition and cash flows
Read in the 10-K filed Nov 25, 2025 ↗
The Cyber Incident may harm our reputation, our customers, employee and partner relations and our operations and business. Customers may in the future defer purchasing or choose to cancel or not renew their agreements or subscriptions with us.
Read in the 10-K filed Nov 25, 2025 ↗
We may expend significant costs and expenses related to the Cyber Incident including in connection with our investigations, and to address the damage to our reputation, customer, employee and partner relations. If we are unable to maintain the trust of our current and prospective customers and partners, or our personnel continue to have to devote significant time to the Cyber Incident, our business, market share, results of operations and financial condition could be negatively affected.
Read in the 10-K filed Nov 25, 2025 ↗
As a result of the Cyber Incident and market forces beyond our control, the cost of our insurance may increase substantially, and we may not be able to obtain additional or comparable insurance coverage on commercially reasonable terms. In addition, governmental authorities investigating the Cyber Incident may seek to impose undertakings, injunctive relief, consent decrees, or other civil or criminal penalties, which could, among other things, materially increase our software development and related expenses or otherwise require us to alter how we operate our business. Further, any legislative or regulatory changes adopted in reaction to the Cyber Incident could require us to make modifications to the operation of our business that could have an adverse effect or increase or accelerate our compliance costs.
Read in the 10-K filed Nov 25, 2025 ↗
We have not seen any evidence of modification to our software supply chain, including our source code and our build release pipelines. We have confirmed that the threat actor exfiltrated files from our BIG-IP product development environment and engineering knowledge management platform. The discovery of new or different information regarding the Cyber Incident, including with respect to its scope and impact on our systems, products or customers, could increase our costs and liabilities related to the Cyber Incident and result in further damage to our business, reputation, intellectual property, results of operations and financial condition. The Cyber Incident also may embolden other threat actors to further target our systems, which could result in additional harm to our business. We cannot ensure that our steps to secure our systems, our product development environments and protect the security and integrity of the products that we deliver will be successful to protect against threat actors or cyberattacks or perceived by existing and prospective customers as sufficient to address the harm caused by the Cyber Incident.
Read in the 10-K filed Nov 25, 2025 ↗