Cybersecurity and data breaches

By sector

Sector is the SEC's industry description of the company. Each count opens that sector's quotes below.

378 paragraphs · Paper Mills show all sectors

our industry. Like other global companies, our systems are subject to recurring attempts by third parties to access information, manipulate data or disrupt operations. In this regard, we have experienced cyber threats and events from time to time, although none have materially affected us, including our results of operations or financial condition. Given the current cyber threat environment, the volume and intensity of cybersecurity attacks and attempted intrusions are expected to increase in the future. We work with a large number of third-party vendors, suppliers, platforms, software, applications, and technologies, each of which may be subject to a cybersecurity incident or information technology failure that impacts our business or operations. We may be required to spend significant resources to verify the implementation of cybersecurity controls by our vendors and suppliers. In addition, despite careful security and controls design, implementation, updating, monitoring and independent third-party verification, our information technology systems, together with those of our third-party providers or joint venture partners, have been and could again be compromised or disrupted due to factors such as employee error or malfeasance, cyber-attacks, including ransomware, malware, phishing attacks, advanced persistent threats, social engineering, credential stuffing or distributed denial-of-service attacks or data or security breaches by malicious actors such as common hackers, criminal groups or nation-state organizations or social activist (“hacktivist”) organizations, disruptions resulting from geopolitical events, natural disasters, failures or impairments of telecommunications networks or other catastrophic events. Such attacks are increasing in complexity, and the rapid evolution and increased adoption of AI technologies may intensify cybersecurity risks by making cyber-attacks more difficult to detect, contain, and mitigate. Furthermore, remote working and personal device use increases the risks of cyber incidents and the improper dissemination of personal or confidential information. Moreover, the hardware, software or applications we use may have inherent vulnerabilities or defects of design, manufacture or operations or could be inadvertently or intentionally implemented or used in a manner that could compromise information security. In addition, cybersecurity-related threats may remain undetected for an extended period of time.

Read in the 10-K filed Feb 21, 2025 ↗

breach could also result in operational or supply chain disruptions, data loss, corruption or manipulation, or information misappropriation including, but not limited to, interruption to systems availability, denial of access to and misuse of applications required by customers to conduct business, the acquisition, use or disclosure of data or inability to access data, the release of confidential information about our operations, and subject us to litigation and government enforcement actions. Further, in such event, access to applications required to plan operations, source materials, manufacture and ship finished goods and account for orders could be denied or misused. Theft of intellectual property or trade secrets, and loss or inappropriate disclosure of confidential company, employee, customer or vendor information, could also stem from such incidents. Moreover, any significant cybersecurity event could require us to devote significant management time and resources in response to such event, interfere with the pursuit of other important business strategies and initiatives, and cause us to incur additional expenditures, which could be material, including to investigate and remediate such event, recover lost data, prevent future compromises and adapt systems and practices in response to such events. There is no assurance that any remedial actions will meaningfully limit the success of future attempts to breach our information systems, particularly because malicious actors are increasingly sophisticated and utilize tools and techniques specifically designed to circumvent security measures, avoid detection and obfuscate forensic evidence, which means we may be unable to identify, investigate or remediate effectively or in a timely manner. Further, following completion of our business combination with DS Smith, we are subject to an increasing number of cybersecurity reporting obligations in different jurisdictions that vary in their scope and application, which may add complexities in providing complete and reliable information about cybersecurity incidents to customers, counterparties, and regulators, as well as the public. The recent completion of our business combination with DS Smith has resulted in increased scale and a broader global presence, which will impact our cybersecurity risk profile. As part of the integration of the newly acquired business, we are actively assessing and addressing these cybersecurity risks to ensure robust protection of our expanded operations and data assets. Additionally, while insurance coverage designed to address certain aspects of cyber risks may be in place, such insurance coverage may be insufficient to cover all losses or all types of claims that may arise in connection with such incidents.

Read in the 10-K filed Feb 21, 2025 ↗

This increasingly restrictive and evolving global regulatory environment related to data privacy and data protection may continue to require changes to our business practices, and give rise to significantly expanded compliance burdens, costs and enforcement risks. Moreover, many of these laws and regulations are subject to uncertain application, interpretation or enforcement standards that could result in claims, changes to business practices, data processing and security systems, penalties, increased operating costs or other impacts on our business. Additionally, regulatory bodies and others tasked with enforcing privacy and data protection laws have been actively engaging in enforcement investigations and actions. These laws often provide for civil penalties for violations, as well as private rights of action for data breaches that may increase data breach litigation. We use internal and external resources to monitor compliance with relevant legislation and continually evaluate and, where necessary, modify data processing practices and policies to comply with evolving privacy laws. Nevertheless, relevant regulatory authorities could determine that our data handling practices fail to address all the requirements of certain new laws, which could subject us to penalties and/or litigation. In addition, there is no assurance that our security controls over personal data, the training of employees and vendors on data privacy and data security, and policies, procedures and practices will prevent the improper handling of, disclosure of or access to personal data. Improper handling and disclosure of or access to personal data in violation of other data privacy and protection laws could cause reputational harm and loss of consumer confidence and subject us to government enforcement actions (including fines), or result in private litigation, which could result in loss of revenue, increased costs, liability for monetary damages, fines and/or criminal prosecution, all of which could negatively affect our business and operating results.

Read in the 10-K filed Feb 21, 2025 ↗

Moreover, effective internal controls are necessary to provide reliable and accurate financial reports, and the integration of businesses may create complexity in our financial systems and internal controls and make them more difficult to manage. Integration of businesses into our internal control system could cause us to fail to meet our financial reporting obligations. Moreover, any failure to integrate, or delay in integrating, IT systems of acquired businesses could create an increased risk of cybersecurity incidents. Following integration, an acquired business may not produce the expected margins or cash flows. Furthermore, we may finance these strategic transactions by incurring additional debt or issuing equity, which could increase leverage or impact our ability to access capital in the future.

Read in the 10-K filed Feb 21, 2025 ↗