Cybersecurity and data breaches
205 of 521 companies added a paragraph in Risk Factors that uses one of these words:
cybersecurity, cyber, ransomware, data breach, cyberattack, hackers.
The paragraph is in the latest 10-K and nothing like it was in the one before.
It counts text; it does not say how serious a risk is. Words in capitals only (such as AI) must be in capitals.
By sector
Sector is the SEC's industry description of the company. Each count opens that sector's quotes below.
| Sector | Companies | Compared |
|---|---|---|
| Computer Communications Equipment | 3 | 3 |
| Accident & Health Insurance | 2 | 2 |
| Computer Peripheral Equipment, NEC | 2 | 2 |
| Instruments For Meas & Testing of Electricity & Elec Signals | 2 | 2 |
| Men's & Boys' Furnishgs, Work Clothg, & Allied Garments | 2 | 2 |
| Rubber & Plastics Footwear | 2 | 2 |
| Air Courier Services | 1 | 1 |
| Aircraft Parts & Auxiliary Equipment, NEC | 1 | 1 |
| Apparel & Other Finishd Prods of Fabrics & Similar Matl | 1 | 1 |
| Bottled & Canned Soft Drinks & Carbonated Waters | 1 | 1 |
| Canned, Fruits, Veg, Preserves, Jams & Jellies | 1 | 1 |
| Electrical Industrial Apparatus | 1 | 1 |
| Electromedical & Electrotherapeutic Apparatus | 1 | 1 |
| Electronic Components & Accessories | 1 | 1 |
| Electronic Connectors | 1 | 1 |
| Engines & Turbines | 1 | 1 |
| Gas & Other Services Combined | 1 | 1 |
| General Industrial Machinery & Equipment, NEC | 1 | 1 |
| Grain Mill Products | 1 | 1 |
| Heavy Construction Other Than Bldg Const - Contractors | 1 | 1 |
| In Vitro & In Vivo Diagnostic Substances | 1 | 1 |
| Insurance Carriers, NEC | 1 | 1 |
| Leather & Leather Products | 1 | 1 |
| Meat Packing Plants | 1 | 1 |
| Misc Industrial & Commercial Machinery & Equipment | 1 | 1 |
| Miscellaneous Manufacturing Industries | 1 | 1 |
| Paints, Varnishes, Lacquers, Enamels & Allied Prods | 1 | 1 |
| Paper Mills | 1 | 1 |
| Real Estate Operators (No Developers) & Lessors | 1 | 1 |
| Retail-Drug Stores and Proprietary Stores | 1 | 1 |
| Retail-Eating & Drinking Places | 1 | 1 |
| Retail-Home Furniture, Furnishings & Equipment Stores | 1 | 1 |
| Retail-Radio, Tv & Consumer Electronics Stores | 1 | 1 |
| Retail-Retail Stores, NEC | 1 | 1 |
| Rolling Drawing & Extruding of Nonferrous Metals | 1 | 1 |
| Services-Advertising Agencies | 1 | 1 |
| Services-Detective, Guard & Armored Car Services | 1 | 1 |
| Services-Misc Health & Allied Services, NEC | 1 | 1 |
| Special Industry Machinery (No Metalworking Machinery) | 1 | 1 |
| Telephone & Telegraph Apparatus | 1 | 1 |
| Television Broadcasting Stations | 1 | 1 |
| Trucking & Courier Services (No Air) | 1 | 1 |
| Water Supply | 1 | 1 |
| Wholesale-Electronic Parts & Equipment, NEC | 1 | 1 |
| Wholesale-Medical, Dental & Hospital Equipment & Supplies | 1 | 1 |
| X-Ray Apparatus & Tubes & Related Irradiation Apparatus | 1 | 1 |
| Finance Services | 21 | 28 |
| Insurance Agents, Brokers & Service | 4 | 6 |
| Electrical Work | 2 | 3 |
| Retail-Auto Dealers & Gasoline Stations | 2 | 3 |
| Services-Computer Integrated Systems Design | 2 | 3 |
| Investment Advice | 5 | 8 |
| Biological Products, (No Diagnostic Substances) | 3 | 5 |
| Computer Storage Devices | 3 | 5 |
| Services-Computer Programming, Data Processing, Etc. | 3 | 5 |
| National Commercial Banks | 6 | 11 |
| Services-Prepackaged Software | 10 | 19 |
| Petroleum Refining | 3 | 6 |
| Electronic & Other Electrical Equipment (No Computer Equip) | 2 | 4 |
| Search, Detection, Navigation, Guidance, Aeronautical Sys | 2 | 4 |
| Security & Commodity Brokers, Dealers, Exchanges & Services | 2 | 4 |
| Services-Computer Processing & Data Preparation | 2 | 4 |
| Aircraft Engines & Engine Parts | 1 | 2 |
| Cutlery, Handtools & General Hardware | 1 | 2 |
| Industrial Organic Chemicals | 1 | 2 |
| Mining & Quarrying of Nonmetallic Minerals (No Fuels) | 1 | 2 |
| Oil & Gas Field Services, NEC | 1 | 2 |
| Optical Instruments & Lenses | 1 | 2 |
| Printed Circuit Boards | 1 | 2 |
| Pumps & Pumping Equipment | 1 | 2 |
| Radio & Tv Broadcasting & Communications Equipment | 1 | 2 |
| Retail-Auto & Home Supply Stores | 1 | 2 |
| Services-Computer Programming Services | 1 | 2 |
| Services-General Medical & Surgical Hospitals, NEC | 1 | 2 |
| Services-Medical Laboratories | 1 | 2 |
| Telephone Communications (No Radiotelephone) | 1 | 2 |
| Transportation Services | 1 | 2 |
| Trucking (No Local) | 1 | 2 |
| Semiconductors & Related Devices | 7 | 15 |
| Security Brokers, Dealers & Flotation Companies | 3 | 7 |
| Surgical & Medical Instruments & Apparatus | 4 | 10 |
| Industrial Instruments For Measurement, Display, and Control | 2 | 5 |
| Orthopedic, Prosthetic & Surgical Appliances & Supplies | 2 | 5 |
| Services-Business Services, NEC | 6 | 16 |
| Pharmaceutical Preparations | 4 | 11 |
| Electric Services | 5 | 15 |
| Electric & Other Services Combined | 4 | 12 |
| State Commercial Banks | 2 | 6 |
| Air-Cond & Warm Air Heatg Equip & Comm & Indl Refrig Equip | 1 | 3 |
| Computer & office Equipment | 1 | 3 |
| Electronic Computers | 1 | 3 |
| Life Insurance | 1 | 3 |
| Measuring & Controlling Devices, NEC | 1 | 3 |
| Plastic Materials, Synth Resins & Nonvulcan Elastomers | 1 | 3 |
| Services-Commercial Physical & Biological Research | 1 | 3 |
| Soap, Detergents, Cleang Preparations, Perfumes, Cosmetics | 1 | 3 |
| Real Estate Investment Trusts | 8 | 27 |
| Crude Petroleum & Natural Gas | 2 | 7 |
| Fire, Marine & Casualty Insurance | 3 | 12 |
| Retail-Eating Places | 1 | 4 |
| Hospital & Medical Service Plans | 1 | 5 |
| Laboratory Analytical Instruments | 1 | 5 |
| Retail-Variety Stores | 1 | 5 |
528 paragraphs · Investment Advice show all sectors
On a corporate basis, various laws and regulations, and in some cases contractual obligations, require us to establish and maintain corporate policies and technical and operational measures designed to protect sensitive client, employee, contractor and vendor information, and to respond to cybersecurity incidents in certain ways and timeframes. We have established policies and implemented
Read in the 10-K filed Feb 19, 2026 ↗
In addition, cybersecurity is a priority for regulators in the U.S. and around the world. The SEC has adopted cybersecurity disclosure rules for public companies and has adopted amendments to Regulation S-P that require, among other things, written incident response programs, customer notification in certain circumstances and enhanced oversight of service providers. In June 2025, the SEC formally withdrew certain pending proposed rules relating to cybersecurity risk management for investment advisers and certain funds; however, regulators continue to focus on cybersecurity through examinations,
Read in the 10-K filed Feb 25, 2026 ↗
We use and plan to expand our use of artificial intelligence tools and technologies in the operation of our business. These uses come with potential risks, including, but not limited to, generation of inaccurate results, misuse or disclosures of confidential information, infringement of third-party intellectual property rights, potential cybersecurity vulnerabilities, reputational risk and regulatory burdens. In addition, artificial intelligence models may create outputs that are flawed, inaccurate, biased, or that infringe or misappropriate intellectual property of third parties. The models may also be subject to new or different modes of cyber attacks, including prompt injection attacks, and such attacks may be able to circumvent cybersecurity tools and processes that we or the providers of such tools have in place. To the extent we rely on such technologies, these risks could negatively impact our business. There is also a risk that artificial intelligence tools or applications may be misused by our employees and/or third parties engaged by us. For example, an employee may input confidential information, including material non-public information, trade secrets, or personal information, into artificial intelligence technologies in a manner that results in such information becoming part of a dataset that is accessible by third-party artificial intelligence applications and users, including our competitors. Further, we may not be able to control how any third-party artificial intelligence technologies that we use are developed or maintained, or how data we input is used or disclosed, even where we have contractual protections with respect to these matters. The misuse or misappropriation of our data could have an adverse impact on our reputation and could subject us to legal and regulatory investigations and/or actions.
Read in the 10-K filed Feb 25, 2026 ↗
Finally, governments and regulators in the U.S. and abroad have proposed, adopted or are considering laws, regulations and guidance governing the development, deployment and use of artificial intelligence systems, including requirements relating to transparency, accountability, data governance, risk management, human oversight, cybersecurity, intellectual property and recordkeeping. For example, the European Union has adopted the EU Artificial Intelligence Act, which applies on a phased basis that began in 2025 and a numbers of U.S. states have enacted general artificial intelligence laws. These and other developments could increase our compliance costs, restrict our use of artificial intelligence in our business and investment processes, require changes to our policies, procedures, controls and vendor arrangements, and expose us to investigations, enforcement actions, litigation, fines, penalties or reputational harm.
Read in the 10-K filed Feb 25, 2026 ↗
Cybersecurity, privacy and data protection have become top priorities for regulators in the United States and around the world. Many jurisdictions in which we operate have laws and regulations relating to privacy, data protection and cybersecurity, including the Gramm-Leach-Bliley Act (“GLBA”) (including recent amendments to Regulation S-P),
Read in the 10-K filed Feb 27, 2026 ↗
Current and anticipated regulatory developments include requirements related to AI, cybersecurity, and digital operational resilience, as well as evolving ESG disclosure standards and cross-border data transfer restrictions. Global divergence in these regulations could create conflicting obligations and increase compliance complexity. These changes may require significant investment of management time and resources, impact product design and distribution, and materially increase compliance costs or capital requirements. Failure to comply with these evolving requirements could result in enforcement actions, reputational harm, and restrictions on our ability to operate in certain jurisdictions.
Read in the 10-K filed Feb 24, 2026 ↗
•Regulations promulgated from time-to-time to mitigate cybersecurity and information, technology and communication (ICT) risks, including regulations that could require asset managers and certain types of investment funds to adopt and implement procedures that are reasonably designed to address cybersecurity and ICT risks and to promptly report significant cybersecurity and ICT-related incidents to relevant regulators or even publicly. New cybersecurity and ICT-related requirements may raise our compliance costs, while compelled disclosure of cybersecurity or ICT-related incidents could cause us reputational harm.
Read in the 10-K filed Feb 24, 2026 ↗
cyber incidents, and as a result, unauthorized individuals have gained access to our clients’, and could improperly gain access
Read in the 10-K filed Feb 27, 2026 ↗
to our, confidential data through such third parties. Any cybersecurity incidents involving these third parties could impair the
Read in the 10-K filed Feb 27, 2026 ↗
infrastructure has increased, so have the risks associated with system vulnerabilities, data loss, cybersecurity incidents,
Read in the 10-K filed Feb 27, 2026 ↗
intelligence. See also “—Risks Related to Regulatory Matters—Privacy, data protection, cybersecurity and artificial intelligence
Read in the 10-K filed Feb 27, 2026 ↗
We continuously face various security threats on a regular basis, including ongoing cybersecurity threats to, and attacks
Read in the 10-K filed Feb 27, 2026 ↗
a security impact (including the deployment of harmful malware, ransomware, denial-of-service attacks, social engineering,
Read in the 10-K filed Feb 27, 2026 ↗
agents and escrow agents, may not be able to detect or protect against. These same cybersecurity breaches, cyberattack and
Read in the 10-K filed Feb 27, 2026 ↗
cyber intrusions could also be employed against our various stakeholders or other third parties, including attempts to
Read in the 10-K filed Feb 27, 2026 ↗
companies, and other third parties and materially and adversely impact us. The costs related to cyber or other security
Read in the 10-K filed Feb 27, 2026 ↗
Our cybersecurity risk management efforts and our investment in information technology may not be successful in
Read in the 10-K filed Feb 27, 2026 ↗
preventing cyber incidents, which could have a material adverse effect upon our reputation, business, operations, or financial
Read in the 10-K filed Feb 27, 2026 ↗
condition. The techniques used by cyber criminals change frequently, may not be recognized until launched, and can
Read in the 10-K filed Feb 27, 2026 ↗
originate from a wide variety of sources. Furthermore, if we experience a cybersecurity incident and fail to comply with the
Read in the 10-K filed Feb 27, 2026 ↗
Privacy, data protection, cybersecurity and artificial intelligence laws may increase compliance costs
Read in the 10-K filed Feb 27, 2026 ↗
Data privacy, data protection and cybersecurity have become priorities for regulators around the world, and rapidly
Read in the 10-K filed Feb 27, 2026 ↗
York State Department of Financial Services (“NYSDFS”) cybersecurity regulation, which requires covered entities to maintain
Read in the 10-K filed Feb 27, 2026 ↗
cybersecurity programs, conduct risk assessments, and satisfy certain incident reporting and governance requirements. In
Read in the 10-K filed Feb 27, 2026 ↗
November 2023, the NYSDFS finalized amendments to its cybersecurity regulations that significantly expanded the NYSDFS’
Read in the 10-K filed Feb 27, 2026 ↗
Failure to comply with applicable data privacy, data protection, cybersecurity, or artificial intelligence laws or related
Read in the 10-K filed Feb 27, 2026 ↗
relating to data privacy and cybersecurity matters have increased in recent years, and any significant enforcement action,
Read in the 10-K filed Feb 27, 2026 ↗