Cybersecurity and data breaches

By sector

Sector is the SEC's industry description of the company. Each count opens that sector's quotes below.

528 paragraphs · Services-Prepackaged Software show all sectors

Our strategy to digitize Autodesk involves increasing our use of cloud- and web-based technologies and applications to leverage customer data to improve our offerings for the benefit of our customers. To accomplish this strategy, we must collect and otherwise process customer data, which may include personal data and personal information of users from different jurisdictions globally. We also collect and otherwise process personal data and personal information of our employees and contractors. As a result, numerous federal, state, and global laws and regulations relating to privacy, data protection, cybersecurity, and the collection, use, security, and other processing of personal data, personal information, and other data and information, apply to our data and information processing activities. The scope of these laws and regulations is rapidly

Read in the 10-K filed Mar 3, 2026 ↗

The application and interpretation of such requirements are constantly evolving and are subject to change, creating a complex compliance environment. In some cases, these requirements may be either unclear in their interpretation and application, or they may have inconsistent or conflicting requirements with each other. Further, there has been a substantial increase in legislative activity and regulatory focus on data privacy and security in the United States and elsewhere, including in relation to cybersecurity incidents. In addition, some such requirements place restrictions on our ability to process Personal Information across our business or across country borders.

Read in the 10-K filed Feb 19, 2026 ↗

•in the case of foreign acquisitions, challenges with integrating operations across different cultures and languages and addressing the particular economic, currency, political, cybersecurity, regulatory and market risks associated with certain countries;

Read in the 10-K filed Mar 2, 2026 ↗

Certain jurisdictions impose regulatory obligations focused on cybersecurity resilience, system availability, and incident response. For example, in the European Union, the Network and Information Security Directive (EU) 2022/2555 (“NIS2”), and in the United Kingdom, the Network and Information Systems Regulations 2018, establish requirements related to risk management, security incident reporting, and business continuity for certain entities. Failure to comply with these frameworks may result in significant administrative fines, enforcement actions, and operational restrictions.

Read in the 10-K filed Feb 18, 2026 ↗

Our cyber safety and financial wellness businesses compete with a broad range of companies, including established security software vendors, operating system and platform providers, companies who specialize in a niche segment of the cyber safety market and which are expanding their portfolios into competing cyber safety products, traditional banks and credit unions, licensed and non-bank digital financial service providers, specialty finance companies, digital wealth management and brokerage platforms, embedded finance providers, financial marketplaces, and other technology companies. Many of these competitors have longer operating histories, greater brand recognition, larger customer bases, and significantly greater financial, technical, and marketing resources than we do. They may be able to offer more competitive pricing or terms, bundle products more effectively, introduce new, enhanced, broader or more specialized offerings more quickly (including for free), or respond more rapidly to technological and consumer trends. We expect our competition to continue to increase, as there are generally no substantial barriers to entry into the markets we serve.

Read in the 10-K filed May 21, 2026 ↗

Issues in the development and deployment of AI, including generative AI and emerging AI-enabled cyber threats, could expose us to regulatory, privacy, IP, cybersecurity, operational and reputational risks.

Read in the 10-K filed May 21, 2026 ↗

In addition to datacenters we own or operate, we rely on third-party providers, including colocation facilities, leased datacenters, and cloud infrastructure providers, to support portions of our operations. If any of these providers fail to meet our requirements, or experience service interruptions, operational failures, capacity constraints, physical damage, cybersecurity incidents, or other disruptions, our ability to provide services, maintain system performance, or meet customer expectations could be negatively impacted.

Read in the 10-K filed Jul 29, 2026 ↗

•We are subject to business, financial and reputational risks related to cybersecurity incidents and data breaches.

Read in the 10-K filed Jun 22, 2026 ↗

•efforts by hackers or sophisticated groups, such as criminal organizations, state-sponsored organizations or nation-states, to launch coordinated cyberattacks on internally built infrastructure or on third-party cloud-computing platform providers, including malicious code, ransomware, destructive malware, supply chain attacks and distributed denial-of-service attacks;

Read in the 10-K filed Feb 24, 2026 ↗

In the normal course of business, we experience, and have experienced, cyberattacks and other security incidents, which have in the past and may in the future cause harm to our business. For example, in 2022, one such incident resulted in threat actors obtaining employee credentials and accessing customer data, and required us to notify affected customers and regulators and take steps to remediate the incident. While to date the security events we have experienced have not had a material financial impact, we may experience significant and material future incidents. Any security incident can result in loss, corruption, unavailability, or other unauthorized processing of confidential information or sensitive personal information. Any such event, or the perception that it has occurred, may also result in damage to our reputation, erosion of customer trust, loss of customers, litigation, regulatory investigation, fines, penalties, and other consequences and liabilities that could adversely affect our business, results of operation and financial condition. Laws and regulations require us to maintain security measures, and we may have contractual or other legal obligations to notify customers, government agencies, impacted individuals or other relevant stakeholders of security breaches or other incidents, which disclosures are costly and may cause widespread negative publicity and resulting harm, among other adverse consequences. Further, the detection, prevention, and remediation of known and potential security incidents, including determining whether an incident is notifiable or reportable, may not be straightforward and result in additional direct or indirect costs to respond or alleviate the consequences of the actual or perceived incident, such as additional infrastructure capacity spending to mitigate system degradation or reallocation of resources from development activities. We maintain errors, omissions and cyber liability insurance policies covering certain security and privacy damages, but such insurance may not be sufficient to cover the potentially significant losses resulting from a security breach or other incident, may be denied with respect to a particular claim, or may not remain available in the future on acceptable terms or at all.

Read in the 10-K filed Feb 24, 2026 ↗

We are subject to increasing legal, regulatory, and contractual obligations relating to privacy, data protection and cybersecurity that affect how we process personal data in the jurisdictions where we and our customers operate. Our obligations change frequently due to new or modified laws and regulations, as well as court rulings interpreting or invalidating them. These evolving obligations involve significant compliance costs and operational challenges, and increasingly expose us to enforcement actions and other proceedings or actions, sanctions, and litigation, as well as regulatory and public scrutiny of our practices relating to personal information. We expect the increasing breadth and depth, and changing nature of, these obligations to continue to require significant resources, including to review our technology, systems and processes against changing requirements. They may also limit our ability to use personal data for new products, including those relying on AI-related technologies.

Read in the 10-K filed Feb 24, 2026 ↗

In the United States, for example, the California Consumer Privacy Act (as amended by the California Privacy Rights Act of 2020, the “CCPA”) provides our customers, employees, and other individuals certain rights related to their personal information. The federal government has also proposed, and numerous other states are considering or have proposed and/or enacted, laws and regulations addressing privacy and cybersecurity. Internationally, the regulatory landscape is increasingly complex and fragmented and compliance increasingly financially burdensome. For example, in the European Union (“EU”), the General Data Protection Regulation (“GDPR”) imposes significant requirements regarding the processing of personal information, including related to transparency, individuals’ privacy rights, compliance contracting, data minimization, data breach notification, data retention, security, and international data transfers. Other international privacy and data protection laws also impose strict requirements, such as related to marketing communications and deployment of cookies. Together, this patchwork of global requirements presents significant compliance challenges, and subjects us to possible fines, sanctions, litigation, and other adverse consequences. For example, under the GDPR, regulators may impose temporary or definitive bans on data transfers or other processing, require deletion, and impose significant fines, potentially ranging up to 4% of our worldwide revenue.

Read in the 10-K filed Feb 24, 2026 ↗

As we expand our data product offerings into new jurisdictions, we are required to assess, monitor, and comply with additional laws and regulations related to our collection and processing of data, which may include new registration, consent, and notification obligations. In addition to our own processing of personal data, our customers expect that our solutions can be used to enable their compliance with applicable data protection, data privacy, and cybersecurity laws and regulations.

Read in the 10-K filed Mar 20, 2026 ↗

The workforce reduction and reorganization may disrupt our operations and adversely affect employee morale and productivity. The departure of employees, including experienced personnel, may result in the loss of institutional knowledge and expertise, and remaining employees may experience increased workloads, which could lead to increased error rates, reduced innovation and attrition of key talent. Our ability to successfully operate with a reduced workforce is expected to depend in part on the effectiveness, reliability and adoption of our proactive intelligence and AI tools. These technologies may not perform as expected, may require more time or expense to implement effectively, may introduce operational or cybersecurity risks, or may fail to enhance productivity and maintain operational efficiency as expected. These actions could increase the risk of operational disruptions, service interruptions, control failures or other significant events, particularly during transition periods, as responsibilities are reassigned and processes are adjusted. We expect to continue to invest in employees we wish to retain and attract, including through increased compensation. In addition, evolving regulatory requirements and public scrutiny relating to AI technologies could increase compliance costs or limit our ability to deploy such tools as intended.

Read in the 10-K filed Feb 26, 2026 ↗