Cybersecurity and data breaches

By sector

Sector is the SEC's industry description of the company. Each count opens that sector's quotes below.

376 paragraphs · Electric Services show all sectors

AEP and its regulated utility businesses face physical security and cybersecurity risks as the owner-operators of generation, transmission and/or distribution facilities and as participants in commodities trading. AEP and its regulated utility businesses own assets deemed as critical infrastructure, the operation of which is dependent on information technology systems. Further, the computer systems that run these facilities are not completely isolated from external networks. Parties that wish to disrupt the U.S. bulk power system or AEP operations could view these computer systems, software or networks as targets for cyber-attack. The Federal government has notified the owners and operators of critical infrastructure, such as AEP, that the conflict between Russia and Ukraine has increased the likelihood of a cyber-attack on such systems. In addition, the electric utility business requires the collection of sensitive customer data, as well as confidential employee and shareholder information, which is subject to electronic theft or loss.

Read in the 10-K filed Feb 13, 2025 ↗

A security breach of AEP or its regulated utility businesses’ physical assets or information systems, interconnected entities in RTOs, or regulators could impact the operation of the generation fleet and/or reliability of the transmission and distribution system. AEP and its regulated utility businesses could be subject to financial harm associated with ransomware theft or inappropriate release of certain types of information, including sensitive customer, vendor, employee, trading or other confidential data. A successful cyber-attack on the systems that control generation, transmission, distribution or other assets could severely disrupt business operations, preventing service to customers or collection of revenues. The breach of certain business systems could affect the ability to correctly record, process and report financial information. A major cyber incident could result in significant expenses to investigate and repair security breaches or system damage and could lead to litigation, fines, other remedial action, heightened regulatory scrutiny and damage to AEP’s reputation. In addition, the misappropriation, corruption or loss of personally identifiable information and other confidential data could lead to significant breach notification expenses and mitigation expenses such as credit monitoring.

Read in the 10-K filed Feb 13, 2025 ↗

AEP and its third-party vendors have been subject, and will likely continue to be subject, to attempts to gain unauthorized access to their technology systems and confidential data or to attempts to disrupt utility and related business operations. While there have been immaterial incidents of phishing, unauthorized access to technology systems, financial fraud and disruption of remote access across the AEP subsidiaries, there has been no material impact on business or operations from these attacks to date. Similarly, some of AEP’s third-party vendors have experienced cybersecurity incidents, though such incidents have not, to AEP’s knowledge, resulted in a material impact to AEP to date. However, AEP cannot guarantee that security efforts will detect or prevent future breaches, operational incidents, or other breakdowns of technology systems and network infrastructure and cannot provide any assurance that such incidents will not have a material adverse effect in the future. While AEP maintains insurance relating to cybersecurity events, such insurance is subject to a number of exclusions and may be insufficient to offset any losses, costs or damages experienced. Also, the market for cybersecurity insurance is relatively new and coverage available for cybersecurity events is evolving as the industry matures.

Read in the 10-K filed Feb 13, 2025 ↗

•increased risk to our cybersecurity program as a result of an increase in cyberattacks during the pandemic and increased remote working arrangements (for further information, see “— Risk Factors Affecting Safety and Security Risks”);

Read in the 10-K filed Feb 20, 2025 ↗

Over the last several years, there has been an increase in the frequency of cyber-attacks by terrorists, hackers, international activist organizations, foreign governments and individuals. These and other unauthorized parties may attempt to gain access to our network systems or facilities, or those of third parties with whom we do business, including directly through our network infrastructure or through fraud, trickery, or other forms of deception against our employees, contractors and temporary staff. Additionally, our information and information technology systems and those of our vendors and service providers may be increasingly vulnerable to data security breaches, damage and/or interruption due to viruses, ransomware, unauthorized physical access, theft of access devices, human error, malfeasance, faulty password management or other malfunctions and disruptions. Further, hardware, software, or applications we develop or procure from third parties may contain defects in design or manufacture or other problems that could unexpectedly compromise information and/or security.

Read in the 10-K filed Feb 27, 2025 ↗

As a source of critical infrastructure, the energy industry is at heightened threat of cyber-attacks, which are becoming increasingly more difficult to anticipate and prevent due to their rapidly evolving nature. We cannot anticipate, detect, or implement fully preventive measures against all cybersecurity threats because the techniques used are increasingly sophisticated and constantly evolving and in some cases, assisted by artificial intelligence.

Read in the 10-K filed Feb 27, 2025 ↗

Our generation, transmission and distribution infrastructure, as well as the transmission facilities of third parties with whom we are interconnected, may be increasingly vulnerable to such attacks as a result of the rapidly evolving and increasingly sophisticated means by which attempts to defeat security measures and gain access to our information technology systems may be made. As our transmission facilities are interconnected with those of third parties, the operation of our facilities could be adversely affected by cyber-attacks or other unexpected or uncontrollable events occurring on the systems of such third parties.

Read in the 10-K filed Feb 27, 2025 ↗

Any actual or perceived cyber-attack, data security breach, damage, interruption and/or defect could: (i) disable our generation, transmission and/or distribution services for a significant period of time; (ii) delay development and construction of new facilities or capital improvement projects; (iii) adversely affect our customer operations; (iv) expose us to increased risk of lawsuits; (v) expose us to increased risk of regulatory penalties; (vi) expose us to increased risk of loss of potential or existing customers; (vii) expose us to increased risk of damage relating to loss of proprietary information; (viii) corrupt data; and/or (ix) result in unauthorized access to the information stored in our data centers and on our networks and those of our vendors and service providers, including company proprietary information, supplier information, employee data and personal customer data, causing the information to be publicly disclosed, lost or stolen or result in incidents that could result in economic loss and liability and harmful effects on the environment and human health, including loss of life.

Read in the 10-K filed Feb 27, 2025 ↗

As cyber threats continually evolve and become more difficult to detect and successfully defend against, there can be no assurance that we can implement or maintain adequate preventive measures, accurately assess the likelihood of a cyber-incident or quantify potential liabilities or losses. Also, we may not discover any data security breach and loss of information for a significant period of time after the data security breach occurs, particularly when the breach has occurred on the systems of our vendors and service providers.

Read in the 10-K filed Feb 27, 2025 ↗

and damage to our reputation. Threats to our systems and operations continue to emerge as new ways to compromise components of our systems or networks are developed. Additionally, cybersecurity risks also threaten our supply chains, including aspects that are not under our control, such as the incorporation of opensource software in systems or software that we use, that despite our efforts do not meet our current security standards.

Read in the 10-K filed Feb 13, 2025 ↗