Cybersecurity and data breaches

By sector

Sector is the SEC's industry description of the company. Each count opens that sector's quotes below.

528 paragraphs · Computer Storage Devices show all sectors

Customer demand continues to be influenced by cloud adoption, digital transformation initiatives, cybersecurity requirements, and increasing use of artificial intelligence and data-driven applications, driving significant changes in storage architectures and solution requirements. The emergence of artificial intelligence workloads has introduced additional competitive dynamics, particularly in areas related to data readiness, performance, scalability, and integration with compute and cloud ecosystems. Additionally, cloud service providers offer storage on demand without requiring capital expenditure, which meets rapidly evolving business needs and has altered the competitive landscape. We also face competition from alternative architectures or approaches that may reduce or eliminate demand for some of our offerings.

Read in the 10-K filed Jun 5, 2026 ↗

In response to evolving and increasing security threats, the U.S. government has imposed, and may impose in the future, requirements relating to product security, supply chain security, and cyber/information security that have impacted, and may in the future impact NetApp. Failure to meet these requirements as they apply to us and our products may result in delays or inability to sell our products to government entities.

Read in the 10-K filed Jun 5, 2026 ↗

cybersecurity threats and also may suffer cybersecurity incidents or other security breaches. Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. In addition, supply-chain attacks have increased in frequency and severity, and third parties’ infrastructure in our supply chain or our third-party partners’ supply chains may become compromised. A cybersecurity incident at a third-party service provider could result in unauthorized access to or disclosure of personal data for which NetApp has protection obligations, potentially triggering breach notification requirements across multiple jurisdictions and exposing NetApp to regulatory enforcement actions, fines, and litigation.

Read in the 10-K filed Jun 5, 2026 ↗

We rely extensively on information technology systems, networks, and cloud-based platforms, including those operated by vendors, suppliers, and other third parties, to support our business operations. We and our third party providers are regularly subject to cybersecurity threats and attempted cyberattacks of varying types and degrees of sophistication, including phishing, social engineering, malware, ransomware, unauthorized access attempts, and other malicious activities. Such threats are common across our industry, continue to increase in frequency and sophistication, and may be difficult to prevent, detect, or mitigate, particularly as AI capabilities evolve to allow increasingly complex cyberattacks. Actual or perceived cybersecurity vulnerabilities or software or firmware defects affecting our products or services could also expose our customers’ systems, data, or operations to unauthorized access or other adverse impacts. This risk may be heightened as our products are deployed in increasingly interconnected enterprise, cloud, edge, and data center environments.

Read in the 10-K filed Aug 4, 2026 ↗

We have implemented security measures designed to prevent, detect, and respond to cybersecurity threats, but these measures may not be effective against all threats or prevent every incident. We cannot guarantee that our or our third party providers’ products, systems, components, software, or infrastructure are free of exploitable defects, bugs, or vulnerabilities, and use of AI technologies by us or our customers, suppliers, or other third parties may increase the complexity and effectiveness of cybersecurity threats and introduce new vulnerabilities into systems, software, products, and business processes. A cybersecurity incident or other compromise of our products, systems, or AI technologies used in our business, or those of our customers or third party providers, could result in unauthorized access to, disclosure, loss, misuse, or corruption of proprietary, confidential, or personal information, including intellectual property or information about our manufacturing, financials, customers, or employees. Cybersecurity incidents, as well as efforts to prevent, detect, or respond to such incidents, also may impair the functionality of our products, information technology systems, manufacturing operations, supply chain activities, product development efforts, or other critical business functions, or result in increased costs associated with investigation, containment, remediation and recovery, product updates, customer support, customer claims, contractual disputes, litigation, indemnification obligations, regulatory investigations, fines or penalties, damage to our reputation, and reduced sales or profitability. Any of these events, whether affecting our systems directly, the products and services we provide, or the systems of third parties on which we depend, could have a material adverse effect on our business, financial condition, and results of operations.

Read in the 10-K filed Aug 4, 2026 ↗

Armed conflicts and geopolitical tensions may also result in sanctions, export restrictions, tariffs or other trade restrictions, limit or restrict our ability to access certain markets and disrupt key logistics networks, including air and ocean freight travel routes. These developments have increased, and could further increase, costs for energy, rare earth minerals, materials, components and transportation, constrain manufacturing capacity and require us to reconfigure aspects of our global supply chain. Geopolitical instability may also heighten cybersecurity risks, including state-sponsored attacks, which could disrupt our operations or those of our suppliers, customers or partners, and further adversely affect demand for our products.

Read in the 10-K filed Aug 4, 2026 ↗

In addition, armed conflicts and heightened geopolitical tensions can result in sanctions, export controls, tariffs and other trade restrictions, limit or restrict our ability to access certain markets and disrupt critical logistics networks, including air and ocean freight routes. For example, the escalation of the conflict involving Iran and heightened tensions in the Middle East could cause disruption to critical logistics and supply routes, which could affect the availability and cost of materials used in our business. Additionally, China has imposed export restrictions on rare earth minerals and related materials critical to semiconductor and hard drive manufacturing. These developments have increased, and could further increase, costs for, or limit the availability of, energy, rare earth minerals, materials, components and transportation, constrain manufacturing capacity and may require us to redesign products or reconfigure aspects of our global supply chain. Geopolitical instability may also elevate cybersecurity risks, including state-sponsored attacks, which could disrupt our operations or those of our suppliers, customers or partners, and further adversely affect demand for our products.

Read in the 10-K filed Aug 14, 2026 ↗

technologies. These may include highly convincing phishing or social engineering attacks that use AI-generated deepfakes, the exploitation of vulnerabilities in electronic identity validation security programs via AI-replicated images or voices, or the inadvertent incorporation of malicious or hallucinated content generated by AI tools into our systems or those of our customers or partners. Separately, the AI technologies that we employ for business purposes may be vulnerable to prompt-injection or other adversarial attacks, which could result in unauthorized access to or leakage of sensitive information. Geopolitical tensions or conflicts may also create heightened risk of cybersecurity incidents.

Read in the 10-K filed Aug 14, 2026 ↗