Cybersecurity and data breaches

By sector

Sector is the SEC's industry description of the company. Each count opens that sector's quotes below.

378 paragraphs · Retail-Eating Places show all sectors

Media or other reports of existing or perceived security vulnerabilities in our systems or those of our third-party business partners or service providers can also adversely impact our brand and reputation and negatively impact our business. Additionally, the techniques and sophistication used to conduct cyber-attacks and compromise information technology systems, as well as the sources and targets of these attacks, change frequently and are often not recognized until such attacks are launched or have been in place for a period of time. The rapid evolution and increased adoption of artificial intelligence technologies amplifies these concerns. We continue to make significant investments in technology, third-party services and employees to develop and implement systems and processes that are designed to anticipate cyber-attacks and to prevent or minimize breaches of our information technology systems or data loss, but these security measures cannot provide assurance that we will be successful in preventing such breaches or data loss.

Read in the 10-K filed Feb 5, 2025 ↗

For example, Europe’s General Data Protection Regulation (“GDPR”) and the U.K. General Data Protection Regulation (which implements the GDPR into U.K. law), impose stringent data protection requirements and provide for significant penalties for noncompliance. Additionally, the California Consumer Privacy Act (“CCPA”) requires, among other things, covered companies to provide specified disclosures to California consumers and allows them to exercise certain rights in connection with their personal information, such as the right to opt-out of certain sales of personal information and to request deletion of personal information (subject to certain exceptions). The CCPA also provides for civil penalties for violations as well as a private right of action for data breaches that may increase data breach litigation. Further, the California Privacy Rights Act, which became effective in January 2023, significantly modified the CCPA to include additional compliance obligations. Since the CCPA was first passed, 19 other states have enacted similar data privacy legislation, eight of which are in effect as of the end of 2024. In addition, a number of other states have passed or are considering additional privacy laws, including laws on health data and biometric data that are in effect, or are expected to take effect in the near future. These state privacy laws will require us to incur additional costs and expenses in our efforts to comply.

Read in the 10-K filed Feb 5, 2025 ↗

Restaurant dining generally is dependent upon consumer discretionary spending, which may be affected by general economic conditions that are beyond our control. Increasing or prolonged high inflation, international, domestic and regional economic conditions, consumer income levels, financial market volatility, a slow or stagnant pace of economic growth, mass layoffs, rising energy costs, rising interest rates, social unrest, military conflicts and governmental, political and budget concerns or divisions may have a negative effect on consumer confidence and discretionary spending. Persistent inflation and concern about a prolonged economic downturn may lead consumers to decrease their discretionary spending. A significant decrease in guest traffic or average transaction size would negatively impact our financial performance. The actual or perceived threat of a pandemic or communicable disease, terrorist attack, mass shooting, heightened security requirements, including cybersecurity, or a failure to protect information systems for critical infrastructure, such as the electrical grid and telecommunications systems, could harm our operations, the economy or consumer confidence generally. Any of the above factors or other unfavorable changes in business and economic conditions affecting our guests could increase our costs, reduce traffic in our restaurants or limit our ability to increase pricing, any of which could lower our profit margins and have a material adverse effect on our sales, financial condition and results of operations. These factors also could cause us to, among other things, reduce the number and frequency of new restaurant openings, close restaurants or delay remodeling of our existing restaurant locations. Further, poor economic conditions may force nearby businesses to shut down, which could reduce traffic to our restaurants or cause our restaurant locations to be less attractive.

Read in the 10-K filed Feb 5, 2025 ↗

investments and other expenditures to comply with new legal requirements, investigate security incidents, remedy cybersecurity issues, recuperate lost data, prevent future compromises and adapt systems and practices to react to the changing threat environment.

Read in the 10-K filed Jul 18, 2025 ↗

There is no assurance that the security measures we take to reduce the risk of such incidents and protect our systems will be sufficient or that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.

Read in the 10-K filed Feb 19, 2025 ↗