What disappeared

•increased risk to our cybersecurity program as a result of an increase in cyberattacks during the pandemic and increased remote working arrangements (for further information, see “— Risk Factors Affecting Safety and Security Risks”);

Read in the earlier 10-K, filed Feb 20, 2025 ↗

Threats to network and data security are increasingly diverse and sophisticated. Security breaches, computer malware and computer hacking attacks have been a prevalent concern in our businesses. Despite our efforts and processes to prevent these, our computer servers and computer systems may be vulnerable to cybersecurity risks, including denial-of-service attacks, physical or electronic break-ins, employee theft or misuse and similar disruptions from unauthorized tampering with our computer servers and computer systems. The preventive actions we take to reduce the risk of cyber incidents and protect our information technology and networks may be insufficient to repel a major cyber-attack in the future. To the extent that any disruption or security breach results in a loss or damage to our network, in unauthorized disclosure of confidential information or in a loss of our digital assets, it could cause significant damage to our reputation, lead to claims against us and ultimately have a material adverse effect on our business, financial condition and results of operations. Additionally, we may be required to incur significant costs to protect against damage caused by these disruptions or security breaches in the future.

Read in the earlier 10-K, filed Feb 27, 2025 ↗

To the extent that digital asset exchanges or other trading venues are involved in fraud or experience security failures or other operational issues, a reduction in digital asset prices could occur. Digital asset market prices depend, directly or indirectly, on the prices set on exchanges and other trading venues, which are new and, in most cases, largely unregulated as compared to established, regulated exchanges for securities, derivatives and other currencies. For example, during the past three years, a number of bitcoin exchanges have been closed due to fraud, business failure or security breaches. In many of these instances, the customers of the closed bitcoin exchanges were not compensated or made whole for the partial or complete losses of their account balances in such bitcoin exchanges. While smaller exchanges are less likely to have the infrastructure and capitalization that provide larger exchanges with additional stability, larger exchanges may be more likely to be appealing targets for hackers and “malware” (i.e., software used or programmed by attackers to disrupt computer operation, gather sensitive information, or gain access to private computer systems) and may be more likely to be targets of regulatory enforcement action.

Read in the earlier 10-K, filed Feb 27, 2025 ↗

In response to these events, the digital asset markets, including the market for bitcoin specifically, have experienced price volatility and several other entities in the digital asset industry have been, and may continue to be, negatively affected, further undermining confidence in the digital asset market and in bitcoin. These events have also negatively impacted the liquidity of the digital asset market as certain entities affiliated with FTX engaged in significant trading activity. If the liquidity of the digital asset market continues to be negatively impacted by these events, digital asset prices, including the price of bitcoin, may continue to experience significant volatility and confidence in the digital asset markets may be further undermined. A perceived lack of stability in the digital asset exchange market and the closure or temporary shutdown of digital asset exchanges due to business failure, hackers or malware, government-mandated regulation, or fraud, may reduce confidence at least in part in digital asset networks and result in greater volatility in bitcoin’s value. Because the value of bitcoin is derived from the continued willingness of market participants to exchange government-issued currency that is designated as legal tender in its country of issuance through government decree, regulation, or law (“fiat” currency) for bitcoin, should the marketplace for bitcoin be jeopardized or disappear entirely, permanent and total loss of the value of bitcoin may result.

Read in the earlier 10-K, filed Feb 27, 2025 ↗

and cold storage, are reasonably designed to safeguard our bitcoin and other digital assets from theft, loss, destruction or other issues relating to hackers and technological attack. Nevertheless, the security procedures cannot guarantee the prevention of any loss due to a security breach, software defect or act of God that may be borne by us. In addition, Coinbase’s limited liability under its services agreement with us may limit our ability to recover losses relating to our bitcoin. If such digital assets are lost, stolen or destroyed under circumstances rendering a third party liable to us, it is possible that the responsible third party may not have the financial resources or insurance sufficient to satisfy any or all of our claims against the third party, or have the ability to retrieve, restore or replace the lost, stolen or destroyed digital assets due to governing network protocols and the strength of the cryptographic systems associated with such digital assets. To the extent that we are unable to recover on any of our claims against any such third party, such loss could have a material adverse effect on our business, financial condition and results of operations.

Read in the earlier 10-K, filed Feb 27, 2025 ↗

•currency and regulatory risks associated with foreign countries and potential additional cybersecurity and compliance risks resulting from entry into new markets;

Read in the earlier 10-K, filed Mar 5, 2025 ↗

•compliance with complex and evolving governmental laws and regulations, including employment, tax, anti-corruption, import/export, customs, anti-boycott, sanctions and embargoes, antitrust, cybersecurity, sustainability and industry-specific laws and regulations, including rules related to compliance by our third-party resellers;

Read in the earlier 10-K, filed Mar 5, 2025 ↗

until after some of our customers are affected. Additionally, our Falcon platform may falsely indicate a cyberattack or threat that does not actually exist, which may lessen customers’ trust in our solutions.

Read in the earlier 10-K, filed Mar 10, 2025 ↗

We experience cyber attacks and other attempts to gain unauthorized access on a regular basis to (i) our products and services (together, our “solutions”) and (ii) the servers, data centers, networks, systems, and cloud-based services operated or enabled by us, or by third parties upon which we rely, on or through which our and third-party data are stored, processed, or can be

Read in the earlier 10-K, filed Sep 3, 2025 ↗

Global privacy and data protection-related laws and regulations, including cybersecurity laws, are evolving, extensive, and complex. Compliance with these laws and regulations is difficult and costly. In addition, evolving legal requirements restricting

Read in the earlier 10-K, filed Sep 3, 2025 ↗

•A cyberattack or other information security incident could significantly disrupt our operations.

Read in the earlier 10-K, filed Feb 12, 2025 ↗

services for us. Any failure of these third parties’ prevention, detection or control systems related to regulatory compliance, compliance with our internal policies, data security and/or cybersecurity or any incident involving the theft, misappropriation, loss or other unauthorized disclosure of, or access to, members’, customers’ or other constituents’ sensitive information could require us to expend significant resources to remediate any damage, interrupt our operations and adversely affect our brand and reputation and also expose us to whistleblower, class action and other litigation, other proceedings, prohibitions on marketing or active or passive enrollment of members, corrective actions, fines, sanctions and/or penalties, any of which could adversely affect our businesses, operating results, cash flows and/or financial condition.

Read in the earlier 10-K, filed Feb 12, 2025 ↗

We will need to continue to improve our operational and financial infrastructure, including the development of appropriate controls, in order to manage our business effectively and accurately report our results of operations. Similarly, our failure to implement and maintain effective cybersecurity systems and measures with respect to our platform as we grow could result in, among other things, breaches, security incidents, theft or fraud, service disruptions, loss of user confidence in our platform, legal claims, regulatory investigations, and damage to our reputation or brand, any of which could adversely affect our business, financial condition, and results of operations.

Read in the earlier 10-K, filed Feb 14, 2025 ↗

governance program, which include adding security layers around data, improving access controls, hiring additional personnel with cybersecurity experience, and using outside expertise to identify and repel threats. We cannot assure you that all potential causes of these incidents have been identified and remediated or will not lead to recurrence or other incidents.

Read in the earlier 10-K, filed Feb 14, 2025 ↗

We rely upon a broad network of warehouses and distribution facilities to store, sort, package and distribute our products. In the US, we distribute products primarily through self-managed warehouses and DCs in Moreno Valley, California, and in Mooresville, Indiana, which feature a complex warehouse management system that enables us to efficiently pack products for direct shipment to our customers and consumers. We expect our recent domestic warehouse and DC expansion to create long-term capacity for the domestic growth of the UGG and HOKA brands. We could face a significant disruption in our domestic warehouse and DC operations if our warehouse management system does not perform as anticipated or ceases to function for an extended period of time, which could occur due to damage to the facility, failure of software or equipment, cyber-security incidents, power outages or similar problems. In addition, if our domestic warehouse and DC operations and scaling efforts are impeded or delayed for any reason, it could result in shipment delays or the inability to deliver product at all, which would result in lost sales, strain our relationships with customers and consumers, and cause harm to our reputation, any of which could have a material adverse effect on our business.

Read in the earlier 10-K, filed May 23, 2025 ↗

Natural disasters or other catastrophic events, including the effects of climate change or a pandemic, may damage or disrupt our operations, international markets, and the global economy. Our operations are subject to interruption from extreme weather events, power shortages, pandemics, terrorism, political instability, telecommunications failures, cyber-attacks, war, and other events beyond our control. Although we maintain disaster recovery plans, such events could disrupt our operations, including through the inability of talent to work, loss of life, and adverse effects on supply chains, power, infrastructure and the integrity of IT systems, any of which could materially increase our costs and expenses, decrease sales, and disrupt our business continuity. We could incur significant capital expenditures and other costs to improve the climate-related resiliency of our infrastructure and otherwise prepare for, respond to, and mitigate the effects of climate change, including compliance with evolving, and at times inconsistent, laws and regulations. We could also experience increased costs for energy,

Read in the earlier 10-K, filed May 23, 2025 ↗

The frequency, intensity, and sophistication of cyber and data security incidents have significantly increased in recent years. Like other businesses, we have experienced, and are continually at risk of, attacks and incidents. Our risk and exposure to these matters remains heightened because of, among other things, the evolving nature of these threats, the current global economic and political environment, our prominent size and scale, the advances in computer capabilities and AI, and the interconnectivity and interdependence of third parties to our systems. We

Read in the earlier 10-K, filed May 23, 2025 ↗

Although we take the security of our IT systems seriously, there can be no assurance the measures we employ will prevent unauthorized access to our systems and information. Because the techniques used to obtain unauthorized access to IT systems are constantly evolving, we may be unable to anticipate these techniques or implement adequate protective measures in response. Cyber-attacks or data incidents could remain undetected for some period, which could result in significant harm to our systems, as well as unauthorized access to the information stored on and transmitted by our systems. A cyber-attack or other data security incident could result in significant disruption of our business such that:

Read in the earlier 10-K, filed May 23, 2025 ↗

If any of these events were to occur, it could have a material adverse effect on our financial condition and results of operations and result in harm to our reputation. In addition, a cyber-attack or other data incident could put us at a competitive disadvantage, result in the deterioration of our customers’ confidence in our brands, cause our suppliers to reconsider their relationship with us or impose onerous contractual provisions, and subject us to litigation, liability, fines, and penalties. We could be subject to regulatory or other actions pursuant to domestic and international privacy laws, which could result in costly investigations and litigation, civil or criminal penalties, operational changes, and negative publicity that could adversely affect our reputation, as well as our results of operations and financial condition.

Read in the earlier 10-K, filed May 23, 2025 ↗

Generative AI in our products and services may be difficult to deploy successfully due to operational issues inherent to the nature of such technologies. For example, AI algorithms use machine learning and predictive analytics which may be insufficient or of poor quality and reflect inherent biases and could lead to flawed, biased, and inaccurate results. In addition, generative AI may create content that appears correct but is factually inaccurate or flawed, or contains copyrighted or other protected material, and if our customers or others use this flawed content to their detriment, we may be exposed to brand or reputational harm, competitive harm, and/or legal liability. For example, deficient or inaccurate recommendations, summaries, or analyses that generative AI features assist in producing could lead to customer rejection, or skepticism of our products, affect our reputation or brand, and negatively affect our financial results. Further, unauthorized use or misuse of generative AI by our employees or others may result in disclosure of confidential company and customer data, reputational harm, privacy law violations and legal liability. Generative AI is also the subject of a quickly evolving legal and regulatory environment, and new or enhanced governmental or regulatory scrutiny, litigation, ethical concerns, or other complications related to our use of generative AI could cause us to divert resources towards compliance and adversely affect our business, reputation, or financial results. Our use of generative AI may also lead to novel and urgent cybersecurity risks, including the misuse of personal data, which may adversely affect our operations and reputation.

Read in the earlier 10-K, filed Mar 27, 2025 ↗

Our continued success depends on our systems, applications, and software continuing to operate and meet the changing needs of our customers and users and financial services partners. We rely on our technology and engineering staff and vendors to successfully implement changes to and maintain our systems and services efficiently and securely. Like all information systems and technology, our platform may contain or develop material errors, failures, vulnerabilities or bugs, particularly when new features or capabilities are released, and may be subject to computer viruses or malicious code, break-ins, phishing impersonation attacks, attempts to overload our servers with denial-of-service or other attacks, ransomware and similar incidents or disruptions from unauthorized use of our computer systems, as well as unintentional incidents causing data leakage, any of which could lead to interruptions, delays or shutdown of our platform.

Read in the earlier 10-K, filed Mar 27, 2025 ↗

Operating our business and products involves the collection, storage, use and transmission of large volumes of sensitive, proprietary and confidential information, including financial and personal information, pertaining to our current, prospective and past users, as well as our staff, contractors, and business partners. The security measures we take to protect this information may be breached as a result of computer malware, viruses, social engineering, ransomware attacks, account takeover attacks, hacking and cyberattacks, including by state-sponsored and other sophisticated organizations. Such incidents have become more prevalent in recent years. Our security measures could also be compromised by our personnel, theft, or errors, or be insufficient to prevent exploitation of security vulnerabilities in software or systems on which we rely. Such incidents may in the future result in unauthorized, unlawful or inappropriate use, destruction or disclosure of, access to, or inability to access the sensitive, proprietary, and confidential information that we handle. These incidents may remain undetected for extended periods.

Read in the earlier 10-K, filed Mar 27, 2025 ↗

A security breach or other security incident, or the perception that one has occurred, could result in a loss of confidence by both our users and financial services partners and damage our reputation and brand, reduce demand for our products, disrupt normal business operations, require us to expend significant capital and resources to investigate and remedy the incident and prevent a recurrence, and subject us to litigation, regulatory enforcement action, fines, penalties, and other liability, which could adversely affect our business, financial condition and results of operations. Even if we take steps that we believe are adequate to protect us from cyber threats, hacking against our competitors or other companies in our industry could create the perception among our users and financial services partners that our digital platform is not safe to use. Security incidents could also damage our IT systems and our ability to make the financial reports and other public disclosures required of public companies. These risks are likely to continue to increase as we continue to grow, process, store and transmit an increasingly larger and larger volume of data.

Read in the earlier 10-K, filed Mar 27, 2025 ↗

Most of the jurisdictions in which we operate have established their data privacy and security legal frameworks. Failure to comply with these laws can result in regulatory fines or penalties. The California borrower Privacy Act (“CCPA”) created new data privacy rights for California-resident users that will be expanded when the CPRA, which was approved in November 2020, goes into effect. In addition, Virginia recently passed the borrower Data Protection Act, which will go into effect at the same time as CPRA and many other states are considering enacting privacy laws. These laws, as well as any associated regulations, may increase our operating costs and potential liability (particularly in the event of a data breach), delay or impede the development of new products, and have a material adverse effect on our business, including how we use information about individuals, our financial condition and the results of our operations or prospects.

Read in the earlier 10-K, filed Mar 27, 2025 ↗

If the Company’s data and network infrastructure were to fail, or if the Company were to suffer an interruption or degradation of services or other infrastructure environments, it could lose important manufacturing and technical data, which could harm its business. The Company’s facilities, as well as the facilities of third parties that maintain or have access to the Company’s data or network infrastructure, are vulnerable to damage or interruption from earthquakes, hurricanes, floods, fires, cyber security attacks, terrorist attacks, power losses, telecommunications failures and similar events. If the Company’s or any third-party provider’s systems or service abilities are hindered by any of the events discussed above, the Company’s ability to operate may be impaired and its business could be adversely affected. A decision to close facilities without adequate notice, or other unanticipated problems, could adversely impact the Company’s operations. The Company’s infrastructure also could be subject to break-ins, cyber-attacks, sabotage, intentional acts of vandalism and other misconduct, from a spectrum of actors ranging in sophistication from threats common to most industries to more advanced and persistent, highly organized adversaries. Any security breach, including personal data breaches, or incident, including cybersecurity incidents, that the Company experiences could result in unauthorized access to, misuse of or unauthorized acquisition of its internal sensitive corporate data, such as financial data, intellectual property, or data related to contracts with commercial or government customers or partners. Such unauthorized access, misuse, acquisition, or modification of sensitive data may result in data loss, corruption or alteration, interruptions in the Company’s operations or damage to the Company’s computer hardware or systems or those of its employees and customers. Moreover, negative publicity arising from these types of disruptions could damage the Company’s reputation.

Read in the earlier 10-K, filed Mar 27, 2025 ↗

Threats from malicious persons and groups, new vulnerabilities and advanced new attacks against information systems create a risk of cybersecurity incidents. These incidents can include but are not limited to, gaining unauthorized access to digital systems for purposes of misappropriating assets or sensitive information, corrupting data, or causing operational disruption. Because the techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently and may not immediately produce signs of intrusion, the Company may be unable to anticipate these incidents or techniques, timely discover them or implement adequate preventative measures.

Read in the earlier 10-K, filed Mar 27, 2025 ↗

Over the past several years, cyber-attacks have become more prevalent and much harder to detect and defend against. The Company’s network and storage applications may be vulnerable to cyber-attack, malicious intrusion, malfeasance, loss of data privacy or other significant disruption and may be subject to unauthorized access by hackers, employees, consultants or other service providers. In addition, hardware, software or applications the Company develops or procures from third parties may contain defects in design or manufacture or other problems that could unexpectedly compromise information security. Unauthorized parties may also attempt to gain access to the Company’s systems or facilities through fraud, trickery or other forms of deceiving the Company’s employees, contractors and temporary staff. As cyber threats continue to evolve, the Company may be required to expend significant additional resources to continue to modify or enhance its protective measures or to investigate and remediate any cybersecurity vulnerabilities. The Company does not currently have a cyber liability insurance policy and even if a policy is purchased, the Company cannot be certain that its coverage will be adequate for liabilities incurred or that insurance will continue to be available to it on economically reasonable terms, or at all.

Read in the earlier 10-K, filed Mar 27, 2025 ↗

Computer malware, viruses, ransomware, hacking, phishing attacks and similar disruptions could result in security and privacy breaches and interruptions and delays in services and operations, which could harm our business.

Read in the earlier 10-K, filed Mar 27, 2025 ↗

Computer malware, viruses, physical or electronic break-ins and similar disruptions could lead to interruptions and delays in our services and operations and loss, misuse or theft of data. Computer malware, viruses, ransomware, hacking, phishing, and other attacks against online networks have become more prevalent and may occur on our systems in the future. We have implemented security measures, such as multi-factor authentication and security incident and event management tools. But any attempts by cyber attackers to disrupt our services or systems, if successful, could harm our business, introduce liability to data subjects, resulting in the misappropriation of funds, and be expensive to remedy and damage our reputation or brand. Insurance may not be sufficient to cover significant expenses and losses related to cyber-attacks. As cyber-attacks evolve, the cost of measures designed to prevent such attacks continues to increase, and we may not be able to cause the implementation or enforcement of such preventions with respect to our third-party vendors. Though it is difficult to determine what, if any, harm may directly result from any specific interruption or attack, any failure to maintain performance, reliability, security and availability of systems and technical infrastructure may, in addition to other losses, harm our reputation, brand and ability to attract customers.

Read in the earlier 10-K, filed Mar 27, 2025 ↗

Service disruptions, outages and other performance problems can be caused by a variety of factors, including infrastructure changes, cyber-security threats, third-party service providers, human or software errors and capacity constraints. If our services are unavailable when users attempt to access them, they may seek other services, which could reduce demand for our solutions from target customers.

Read in the earlier 10-K, filed Mar 27, 2025 ↗

Generative AI tools producing content which can be indistinguishable from that generated by humans is a relatively novel development, with benefits, risks, and liabilities still unknown. Recent decisions of governmental entities and courts (such as the U.S. Copyright Office, U.S. Patent and Trademark Office, and U.S. Court of Appeals for the Federal Circuit) interpret U.S. copyright and patent law as limited to protecting works and inventions created by human authors and inventors, respectively. We are therefore unlikely to be able to obtain U.S. copyright or patent protection for works or inventions wholly created by a generative AI tool, and our ability to obtain U.S. copyright and patent protection for source code, text, images, inventions or other materials, which are developed with some use of generative AI tools may be limited, if available at all. Likewise, the availability of such IP protections in other countries is unclear. As a result, we could have no remedy if third parties reused those same materials, or similar materials, also generated by AI tools. In addition, we may have little or no insight into the third-party content and materials used to train third party generative AI tools, or the extent of the original works which remain in the outputs. As a result, we may face claims from third parties claiming infringement of their intellectual property rights, or mandatory compliance with open-source software or other license terms, with respect to software, or other materials or content we believed to be available for use, and not subject to license terms or other third-party proprietary rights. We could also be subject to claims from the providers of the generative AI tools, if we use any of the generated materials in a manner inconsistent with their terms of use. Any of these claims could result in legal proceedings and could require us to purchase a costly license, comply with the requirement of open source software license terms, or limit or cease using the implicated software, or other materials or content unless and until we can re-engineer such software, materials, or content to avoid infringement or change the use of, or remove, the implicated third party materials, which could reduce or eliminate the value of our technologies and services. Any use of generative AI tools to develop source code may also present additional security risks because the generated source code may have been modelled from publicly available code, or otherwise not subject to all of our standard internal controls, which may make it easier for hackers and other third parties to determine how to breach our website and systems that rely on the code. Any of these risks could be difficult to eliminate or manage, and, if not addressed, could have a material adverse effect on our business, results of operations, financial condition, and future prospects.

Read in the earlier 10-K, filed Mar 27, 2025 ↗

Military conflicts (such as the conflicts between Russia and Ukraine and in the Middle East) can adversely affect our business and financial statements. For example, consequences of the conflict between Russia and Ukraine have included sanctions, embargoes, regional instability, geopolitical shifts and adverse impacts on energy supplies and prices, and such conflict or other conflicts may cause similar adverse effects in the future. In addition to suspending sales prohibited by sanctions, the Company has suspended the shipment of products to Russia with the exception of products for the purposes of diagnosing and treating patients and producing vaccines and therapeutics. Military conflicts also heighten other risks disclosed in this Annual Report, any of which can adversely affect our business and financial statements. Such risks include, but are not limited to, adverse effects on macroeconomic conditions, including increased inflation, constraints on the availability of commodities, supply chain disruption and decreased business spending; disruptions to our or our business partners’ global technology infrastructure, including through cyber-attack or cyber-intrusion; adverse changes in international trade policies and relations; claims, litigation and regulatory enforcement; potential retaliatory actions by governments against companies, such as nationalization of foreign businesses; adverse impacts on our ability to implement and execute our business strategy; terrorist activities; our exposure to foreign currency fluctuations; reputational risk; and constraints, volatility, or disruption in the capital markets.

Read in the earlier 10-K, filed Feb 20, 2025 ↗

supply chain constraints on our future supply chain and procurement process cannot be reasonably estimated at this time and it could have a material adverse impact on our business and financial condition. In addition, the ongoing military conflict between Russia and Ukraine, as well as the conflict in the Middle East and other potential global conflicts, could lead to market disruptions, including significant volatility in commodity prices, credit and capital markets, an increase in cyber security incidents as well as supply chain disruptions.

Read in the earlier 10-K, filed Feb 25, 2025 ↗

•the inability to successfully combine the operations of the Company and Physicians Realty Trust, including the integration of employees, customer records and maintaining cybersecurity protections, in a manner that permits us to achieve the cost savings anticipated from the Merger, which would result in the anticipated benefits of the Merger not being realized in the time frame currently anticipated or at all;

Read in the earlier 10-K, filed Feb 4, 2025 ↗

investments and other expenditures to comply with new legal requirements, investigate security incidents, remedy cybersecurity issues, recuperate lost data, prevent future compromises and adapt systems and practices to react to the changing threat environment.

Read in the earlier 10-K, filed Jul 18, 2025 ↗

favorable to us or at all. Additionally, any cyber liability insurance may not cover us for all types of losses or harms and may not be sufficient to protect us against the amount of all losses.

Read in the earlier 10-K, filed Feb 13, 2025 ↗

Regulatory scrutiny of privacy, data protection, and the collection, use, sharing, retention and deletion of personal data is increasing globally. We are subject to a number of privacy, data protection, and cybersecurity laws and regulations in the countries in which we operate and these laws and regulations will likely continue to evolve over time, both through regulatory and legislative action and judicial decisions. In addition, compliance with these laws may restrict our ability to provide services to our customers that they may find to be valuable. For example, the General Data Protection Regulation (the “GDPR”) applies to personal data collected in the context of all of our activities conducted from an establishment in the European Union, related to products and services offered to individuals in the European Union or related to the monitoring of individuals’ behavior in Europe, imposes a range of

Read in the earlier 10-K, filed Feb 27, 2025 ↗

In the United States, numerous states have adopted generally applicable and comprehensive consumer privacy laws, with the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”) extending more broadly to personal data about any type of California resident (including employees and individuals acting in a professional capacity at other companies as well). These new and developing state laws provide new privacy rights for residents of these states and impose corresponding obligations on organizations doing business in these states. Not only do these laws require that we make disclosures about our data collection, use and sharing practices, but they also require that we provide new rights to individuals, such as the right to access, delete and correct personal data. Complying with new and developing laws has required, and will continue to require, us to incur substantial costs and expenses. In addition, a number of other U.S. states are continuing to propose laws and regulations imposing obligations regarding the handling of personal data. Compliance with the GDPR, the new U.S. state laws, and other current and future applicable U.S. and international privacy, data protection, cybersecurity, AI, and other data-related laws can be costly and time-consuming. For example, the European Union’s comprehensive Artificial Intelligence Act (“EU AI Act”), which lays out the parameters for AI systems where non-compliance can result in fines up to 35 million euros or 7% of global turnover, came into force in August 2024. AI regulation is also expanding in the United States. For example, the California AI Transparency Act, which codifies detailed AI-related disclosure requirements, will come into force in January 2026, and the Colorado AI Act will come into force in February 2026. Implementing and complying with these varying data, privacy, and AI-related requirements in different jurisdictions could cause us to incur substantial costs and/or require us to change our business practices in a manner adverse to our business and violations of these laws can result in significant penalties.

Read in the earlier 10-K, filed Feb 27, 2025 ↗

predicted. In the event of a significant cybersecurity incident or attack, the Companies’ business strategy, results of operations or financial condition could be materially affected.

Read in the earlier 10-K, filed Feb 20, 2025 ↗

The war in Ukraine has led to market disruptions, including significant volatility in commodity prices, credit and capital markets, an increase in cybersecurity incidents as well as supply chain disruptions.

Read in the earlier 10-K, filed Feb 12, 2025 ↗

•compliance with evolving cybersecurity laws including reporting requirements; and

Read in the earlier 10-K, filed Feb 12, 2025 ↗

Although we have taken steps to abide by applicable privacy and cybersecurity laws, and strive to protect the security of our IT Systems and Confidential Information, the compliance and security measures put in place by the Company and its vendors cannot guarantee perfect compliance or provide absolute security, and the Company and its vendors’ IT Systems may be vulnerable to numerous and evolving cybersecurity threats and risks that threaten the confidentiality, integrity and availability of our IT Systems and Confidential Information, including through social engineering/phishing, malware (including ransomware), distributed denial-of-service attempts, data theft, account takeovers, social engineering/phishing, technological

Read in the earlier 10-K, filed Feb 21, 2025 ↗

The success of third-party services on the Exodus Platform is affected by a number of factors, many of which are beyond our control, such as our ability to successfully integrate services into the Exodus Platform using third-party APIs, technological changes and developments, user preferences and technical support provided by the third party. Interruptions or delays in our cloud or internal infrastructure or third-party services and cybersecurity incidents such as attacks on our information systems by malicious actors could also affect our third-party services.

Read in the earlier 10-K, filed Mar 6, 2025 ↗

Despite our efforts to protect against cybersecurity risks, the cybersecurity threat landscape is rapidly evolving and has become increasingly sophisticated, and we may not be successful in preventing or mitigating cybersecurity threats that could have a material adverse effect on us. If any of the foregoing events were to materialize, they could result in technical disruptions or errors, the loss of sensitive information, and unauthorized access to our internal systems, networks and data. Moreover, a delay in or failure to detect a cybersecurity incident, or the full extent of an incident, could exacerbate its effects. We may also be required to expend significant resources to investigate and remediate vulnerabilities or other identified risks, costs which may not fully be covered by insurance coverage or indemnified by other means.

Read in the earlier 10-K, filed Mar 6, 2025 ↗

Over the past several years, a number of digital asset trading platforms have been closed or faced issues due to fraud, failure, security breaches or governmental regulations. Particularly for operators outside of the United States, digital asset trading platforms are not regulated in ways similar to national securities exchanges and other highly regulated trading environments or, if subject to regulation in a relevant jurisdiction, may not be in compliance. As a result, capital requirements, clearing infrastructure and technical and operational security requirements may vary. The nature of the digital assets held at trading platforms makes them appealing targets for hackers and a number of digital asset trading platforms have been victims of cybercrimes. It is possible that the customers of such digital asset trading platforms may not be compensated or made whole for the partial or complete losses of their account balances in such trading platforms.

Read in the earlier 10-K, filed Mar 6, 2025 ↗

Digital asset platforms are relatively new, and many are unlicensed, may be subject to regulation in a relevant jurisdiction but may not be in compliance, are unregulated, or may operate without supervision by any governmental authorities, and do not provide the public with significant information regarding their management team, corporate practices, cybersecurity, and regulatory compliance. To the extent that unanticipated operational or trading problems or other failures, such as security or technical failures, arise on trading platforms or the Exodus Platform, customers, users and the general public may lose confidence or interest in digital asset platforms, including the Exodus Platform, which could have an adverse impact on our business and our customers’ perception of us, including decreased use of our platform and loss of customer demand for our products and services.

Read in the earlier 10-K, filed Mar 6, 2025 ↗

Certain supported digital assets enable holders to earn rewards by participating in decentralized governance, bookkeeping and transaction confirmation activities on their underlying blockchain networks, such as through staking activities, including staking through validation, delegating and baking. Staking allows users to “stake” supported digital assets held in their Exodus wallets by participating in blockchain validation through a third-party API Provider, Everstake. Everstake currently provides and is expected to continue to provide such services for certain supported crypto assets to our users in order to enable them to earn rewards based on crypto assets held in their Exodus wallets. Everstake’s network may further require customer assets to be transferred into smart contracts on the underlying blockchain networks not under Everstake’s or anyone’s control. If Everstake or smart contracts fail to operate as expected, suffer cybersecurity attacks, experience security issues or encounter other problems, our users’ assets may be irretrievably lost. In addition, certain blockchain networks dictate requirements for

Read in the earlier 10-K, filed Mar 6, 2025 ↗

Our API Providers and the third parties with whom they contract may be subject to financial, legal, regulatory, and labor issues, cybersecurity incidents, disruptions, interruptions, and other misconduct of which we are not aware. Should any of the foregoing materialize and lead to disruptions or issues in third party operations, risks to our users may include loss of information stored with or provided to the API Provider, along with loss of access to the digital assets or fiat currency used in any pending transaction with the API Provider. In such instances, because we do not control the operations of any of our API Providers or third parties with which they contract, we will be unable to intervene and can make no assurances as to the outcome of any issue or dispute between the user and API Provider. In these scenarios, users may blame or become dissatisfied with the Exodus Platform as a result of these negative experiences, which could adversely affect our ability to access or sell our digital services and subject us to legal or regulatory scrutiny, reputational harm and significant financial losses.

Read in the earlier 10-K, filed Mar 6, 2025 ↗

•A cyber incident could result in information theft, data corruption, operational disruption and/or financial loss.

Read in the earlier 10-K, filed Feb 26, 2025 ↗

We are subject to cybersecurity risks. A cyber incident could occur and result in information theft, data corruption, operational disruption and/or financial loss.

Read in the earlier 10-K, filed Feb 26, 2025 ↗

Cyber-security risks also may be derived from fraud or malice on the part of our employees or third-party service providers, or may result from human error, software bugs, server malfunctions, software or hardware failures or other technological failures. Our and our vendors' use of mobile and cloud technologies may increase our risk for such threats. Our protective systems and procedures and those of third parties to which we are connected, such as cloud computing providers, may not be effective against these threats. In addition, failure by our clients or third-party service providers to notify us of system failures or security breaches in a timely manner could lead to unauthorized access to our systems and data, resulting in adverse effects on our business, operating results or financial condition.

Read in the earlier 10-K, filed Oct 22, 2025 ↗

While we have dedicated resources responsible for maintaining appropriate levels of cybersecurity, and implemented systems and processes intended to help identify cyberattacks and protect and remediate our network infrastructure, we may not be able to anticipate, prevent or detect all such attacks. As these threats continually evolve, we are required to devote additional resources and investment to modify or enhance our systems and processes, including patch and vulnerability management, which we may not be able to do in a timely or complete manner, or without adversely impacting our business, financial condition or results of operations.

Read in the earlier 10-K, filed Oct 22, 2025 ↗

users of its applications. Additionally, it uses third-party service providers and subprocessors to help deliver services to merchants and their buyers. These service providers and subprocessors may store or access personal data and/or other confidential information. The foregoing factors increase the risk of data incidents and the amount of potential exposure in the event of a data breach.

Read in the earlier 10-K, filed Jul 21, 2025 ↗

Our security processes and initiatives may be unable to detect or prevent a breach or disruption in the future. Additionally, the rapid ongoing evolution and increased adoption of emerging technologies such as artificial intelligence and machine learning may make it more difficult to anticipate and implement protective measures to recognize, detect, and prevent the occurrence of any of the cyber events described above.

Read in the earlier 10-K, filed Jul 21, 2025 ↗

Over the last several years, there has been an increase in the frequency of cyber-attacks by terrorists, hackers, international activist organizations, foreign governments and individuals. These and other unauthorized parties may attempt to gain access to our network systems or facilities, or those of third parties with whom we do business, including directly through our network infrastructure or through fraud, trickery, or other forms of deception against our employees, contractors and temporary staff. Additionally, our information and information technology systems and those of our vendors and service providers may be increasingly vulnerable to data security breaches, damage and/or interruption due to viruses, ransomware, unauthorized physical access, theft of access devices, human error, malfeasance, faulty password management or other malfunctions and disruptions. Further, hardware, software, or applications we develop or procure from third parties may contain defects in design or manufacture or other problems that could unexpectedly compromise information and/or security.

Read in the earlier 10-K, filed Feb 27, 2025 ↗

As a source of critical infrastructure, the energy industry is at heightened threat of cyber-attacks, which are becoming increasingly more difficult to anticipate and prevent due to their rapidly evolving nature. We cannot anticipate, detect, or implement fully preventive measures against all cybersecurity threats because the techniques used are increasingly sophisticated and constantly evolving and in some cases, assisted by artificial intelligence.

Read in the earlier 10-K, filed Feb 27, 2025 ↗

Our generation, transmission and distribution infrastructure, as well as the transmission facilities of third parties with whom we are interconnected, may be increasingly vulnerable to such attacks as a result of the rapidly evolving and increasingly sophisticated means by which attempts to defeat security measures and gain access to our information technology systems may be made. As our transmission facilities are interconnected with those of third parties, the operation of our facilities could be adversely affected by cyber-attacks or other unexpected or uncontrollable events occurring on the systems of such third parties.

Read in the earlier 10-K, filed Feb 27, 2025 ↗

Any actual or perceived cyber-attack, data security breach, damage, interruption and/or defect could: (i) disable our generation, transmission and/or distribution services for a significant period of time; (ii) delay development and construction of new facilities or capital improvement projects; (iii) adversely affect our customer operations; (iv) expose us to increased risk of lawsuits; (v) expose us to increased risk of regulatory penalties; (vi) expose us to increased risk of loss of potential or existing customers; (vii) expose us to increased risk of damage relating to loss of proprietary information; (viii) corrupt data; and/or (ix) result in unauthorized access to the information stored in our data centers and on our networks and those of our vendors and service providers, including company proprietary information, supplier information, employee data and personal customer data, causing the information to be publicly disclosed, lost or stolen or result in incidents that could result in economic loss and liability and harmful effects on the environment and human health, including loss of life.

Read in the earlier 10-K, filed Feb 27, 2025 ↗

As cyber threats continually evolve and become more difficult to detect and successfully defend against, there can be no assurance that we can implement or maintain adequate preventive measures, accurately assess the likelihood of a cyber-incident or quantify potential liabilities or losses. Also, we may not discover any data security breach and loss of information for a significant period of time after the data security breach occurs, particularly when the breach has occurred on the systems of our vendors and service providers.

Read in the earlier 10-K, filed Feb 27, 2025 ↗

vulnerable to human error as well as malicious insider threats. Finally, the systems we rely on, which include hardware and software manufactured, developed or operated by third-party vendors and service providers, have in the past been subject to, and may in the future be subject to, cyber attacks or security incidents due to employee error or malfeasance, software bugs, hardware malfunctions or other security vulnerabilities.

Read in the earlier 10-K, filed Feb 13, 2025 ↗

Fifth Third relies on its systems and certain third-party service providers and certain failures (including those related to cybersecurity or weather events exacerbated by climate change) could materially adversely affect operations.

Read in the earlier 10-K, filed Feb 24, 2025 ↗

Fifth Third’s necessary dependence upon automated systems to record and process its transaction volume poses the risk that technical system flaws or employee errors, tampering or manipulation of those systems could result in losses and may be difficult to detect. Fifth Third may also be subject to disruptions of its operating systems arising from events that are beyond its control (for example, cyber-attacks, equipment failure, or electrical or telecommunications outages).

Read in the earlier 10-K, filed Feb 24, 2025 ↗

As cybersecurity threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities. The inability to implement, maintain and upgrade adequate safeguards could have a material adverse effect on our business.

Read in the earlier 10-K, filed Feb 20, 2025 ↗

costly, require ongoing monitoring and updating and may not be successful in preventing these events from occurring. In addition, the Company’s recovery and business continuity plans may not be adequate to address any cybersecurity incidents that occur, and the Company may not have adequate insurance coverage to compensate it for any losses that may occur.

Read in the earlier 10-K, filed Aug 6, 2025 ↗

The network security market is expected to continue to evolve rapidly. Moreover, many of our end-customers operate in markets characterized by rapidly changing technologies and business plans, which require them to add numerous network access points and adapt increasingly complex networks, incorporating a variety of hardware, software applications, operating systems and networking protocols. In addition, computer hackers and others who try to attack networks employ increasingly

Read in the earlier 10-K, filed Feb 21, 2025 ↗

including our policies and controls, will be effective in promptly or effectively detecting, containing or remediating cybersecurity attacks, which may result in material harm to our systems, information or business.

Read in the earlier 10-K, filed Feb 3, 2025 ↗

We face competition from a broad range of companies, including software vendors focusing on cyber safety solutions such as Bitdefender, Kaspersky, McAfee and Trend Micro, operating system providers such as Apple, Google and Microsoft, and companies such as Nord, Life360, LastPass and others that currently specialize in one or a few particular segments of the market and many of which are expanding their product portfolios into different segments. We also face growing competition from other technology companies, as well as from companies in the identity threat protection space such as credit bureaus. Further, many of our competitors are increasingly developing and incorporating into their products data protection software and other competing cyber safety products, such as antivirus protection or VPN, often free of charge, that compete with our offerings. Our competitive position could be adversely affected by the functionality incorporated into these products rendering our existing solutions obsolete and therefore causing us to fail to meet customer expectations.

Read in the earlier 10-K, filed May 15, 2025 ↗

Specifically, in addition to competing with cyber safety vendors directly for sales to end-users of our solutions, we compete with them for the opportunity to have our solutions bundled with the offerings of our strategic partners, such as computer hardware OEMs, internet service providers, operating systems and telecom service providers. Our competitors could gain market share from us if any of these strategic partners replace our solutions with those of our competitors or with their own solutions or promote our competitors’ solutions or their own solutions more frequently or more favorably than our solutions. In addition, software vendors who have bundled our solutions with theirs may choose to bundle their solutions with their own or other vendors’ solutions or may limit our access to standard interfaces and inhibit our ability to develop solutions for their platform. Further product development by these vendors could cause our solutions to become redundant, which could significantly impact our sales and operating results.

Read in the earlier 10-K, filed May 15, 2025 ↗

•Increased cybersecurity requirements, vulnerabilities, threats, and more sophisticated and targeted computer crimes pose a risk to

Read in the earlier 10-K, filed Feb 6, 2025 ↗

Disruptions in deliveries, capacity constraints, production disruptions up-or down-stream, price increases, cyber- related attacks, or

Read in the earlier 10-K, filed Feb 6, 2025 ↗

Information Statement, including cybersecurity, regulatory, and reputational risks

Read in the earlier 10-K, filed Feb 6, 2025 ↗

Increased cybersecurity requirements, vulnerabilities, threats, and more sophisticated and targeted computer crimes pose a risk

Read in the earlier 10-K, filed Feb 6, 2025 ↗

In some jurisdictions, we are expected to design our products to include appropriate cybersecurity protections, and regulatory authorities

Read in the earlier 10-K, filed Feb 6, 2025 ↗

Increased global cybersecurity vulnerabilities, threats, computer viruses, and more sophisticated and targeted cyber-related attacks, such

Read in the earlier 10-K, filed Feb 6, 2025 ↗

as ransomware, as well as cybersecurity failures resulting from human error and technological errors, pose a risk to our security. They also

Read in the earlier 10-K, filed Feb 6, 2025 ↗

digitized, the risks in this area continue to grow. A significant cyber-related attack, such as an attack on power grids or power plants, could

Read in the earlier 10-K, filed Feb 6, 2025 ↗

systems. We have also observed an increase in third-party cyber incidents and ransomware attacks on our suppliers, service providers and

Read in the earlier 10-K, filed Feb 6, 2025 ↗

cybersecurity requirements. The increasing degree of interconnectedness and shared liability between us and our partners, suppliers, and

Read in the earlier 10-K, filed Feb 6, 2025 ↗

that our various cybersecurity measures - including employee training, monitoring and testing, performing security reviews and requiring

Read in the earlier 10-K, filed Feb 6, 2025 ↗

contingency plans - will be sufficient to prevent, detect, and limit the impact of cyber-related attacks, and we remain vulnerable to known or

Read in the earlier 10-K, filed Feb 6, 2025 ↗

unknown threats. For example, we outsource certain cybersecurity functions and will continue to look for opportunities to utilize managed

Read in the earlier 10-K, filed Feb 6, 2025 ↗

security service providers. In addition, we collaborate with GE Aerospace on certain cybersecurity functions and will continue to do so

Read in the earlier 10-K, filed Feb 6, 2025 ↗

during a transition period following our Spin-Off. These arrangements will increase our overall cyber risk given the degree of our

Read in the earlier 10-K, filed Feb 6, 2025 ↗

future may also increase our exposure to cybersecurity incidents and failures. An unknown vulnerability or compromise could potentially

Read in the earlier 10-K, filed Feb 6, 2025 ↗

a material cyber incident impacting a supplier were to result in its prolonged inability to manufacture and/or ship such components, this

Read in the earlier 10-K, filed Feb 6, 2025 ↗

vulnerability emerging within such software could expose our customers to increased cyber risk. If we were to experience a significant

Read in the earlier 10-K, filed Feb 6, 2025 ↗

cybersecurity incident impacting our information systems or data, the costs associated with the investigation, remediation, and potential

Read in the earlier 10-K, filed Feb 6, 2025 ↗

which we operate have adopted unique data privacy and cybersecurity legal frameworks with which we must comply. Violations of

Read in the earlier 10-K, filed Feb 6, 2025 ↗

implementation of AI in our offerings and internal systems) could subject us to regulatory action and legal liability, including under specific legislation regulating AI, as well as new applications of existing data protection, cybersecurity, privacy, intellectual property, and other laws.

Read in the earlier 10-K, filed Feb 5, 2025 ↗

Despite our implementation of various security measures, our IT systems and operations could be subject to damage or interruption from computer viruses, natural disasters, unauthorized physical or electronic access, power outages, telecommunications failure, computer system or network failures, wire transfer failure, employee error/malfeasance, cyber-attacks, security breaches, and other similar disruptions. For example, the CrowdStrike outage that occurred in July 2024 negatively impacted our operations and financial results in the third quarter of 2024. In addition, the IT systems of businesses that we have acquired or may acquire could present issues that we were not

Read in the earlier 10-K, filed Feb 21, 2025 ↗

aims and goals, which may include espionage, monetary gain, disruption, and destruction. Similarly, there may be increased activities by organized or coordinating groups of cyber criminals who seek to attack larger organizations’ data or systems for their own aims and goals, which can include financial gain. Because the techniques threat actors use to obtain unauthorized access, disable or degrade service, or sabotage systems, including use of stolen passwords, social engineering, phishing, smishing, vishing, identity spoofing (including through the use of emerging technologies such as deep fakes), ransomware or other disruptive and destructive malware, supply chain compromises, insider threats, and man-in-the-middle and denial of service attacks, change frequently and may not immediately produce signs of anomalous activity or compromise, we may be unable to anticipate or detect these techniques or implement adequate preventative measures.

Read in the earlier 10-K, filed Mar 21, 2025 ↗

Cyber risk exposure exists through stand-alone cyber policies as well as cyber coverage endorsements on some property,

Read in the earlier 10-K, filed Feb 21, 2025 ↗

As a leading technology firm, we are exposed to attacks from criminals, nation state actors, malicious insiders, and activist hackers (collectively, “malicious parties”) who have at times been able to circumvent or bypass our cyber security measures. Although some of these attacks have caused disruptions or exposure of information, so far, these attacks have not resulted in material negative impacts to HPE, nor have any of HPE’s consumers, customers, or employees informed HPE that these attacks resulted in material harm to them. While we investigate and remediate incidents, there can be no assurance that we will do so comprehensively or that the threat actor will not identify alternative means of intrusion or opportunities to otherwise utilize the information it accessed to adversely affect our business or results of operations. It is also possible that incidents may embolden other malicious actors to perpetrate future attacks that may result in material misappropriation, system disruptions or shutdowns, malicious alteration, or destruction of our confidential or personal information or that of third parties. Further, there has been an increase in the frequency and sophistication of such attacks, and we expect these activities to continue to increase, including malicious actors potentially leveraging AI to develop malicious code or sophisticated phishing attempts. Malicious parties may also be able to otherwise develop and deploy viruses, worms, ransomware, and other malicious software programs that attack our products or otherwise exploit any security vulnerabilities of our products, including within our cloud-based environments and offerings, such that we may be unable to anticipate such malicious parties’ techniques, implement adequate preventative measures, or remediate any intrusion on a timely or effective basis even if our security measures are appropriate, reasonable, and comply with applicable legal requirements. Further, cyberattacks or incidents have in the past gone, and could in the future go, undetected in our environments for a period of time, and we may discover additional impacts of earlier incidents that we believe were remediated. For example, as previously disclosed in our Form 8-K filed with the Securities and Exchange Commission on January 24, 2024, we learned in December 2023 that, beginning in May 2023, a nation-state-

Read in the earlier 10-K, filed Dec 19, 2024 ↗

The Company has no manufacturing operations in Russia, Ukraine, or the Middle East, yet it has experienced inflated fuel costs and supply chain shortages and delays due to the impact of the military conflicts on the global economy. If these conflicts or others arise or escalate further, the Company could, among other things, face additional supply chain disruptions, rising prices for oil and other commodities, volatility in capital markets and foreign exchange rates, rising interest rates, or heightened cybersecurity risks, any of which may adversely affect the Company’s business.

Read in the earlier 10-K, filed Dec 5, 2024 ↗

The Company may be adversely impacted if the Company is affected by cybersecurity attacks, security breaches, or other IT interruptions, involving its own systems or those with whom it does business. IT systems are an important part of the Company’s business operations. The Company also increasingly relies upon third-party service providers for a variety of business functions, including cloud-based services. Cyber incidents are occurring more frequently across U.S. industries and are being made by groups and individuals with a wide range of motives and expertise. In addition, high-profile data security incidents and IT interruptions at other companies, including companies with whom the Company does business, evidence an external environment that is becoming increasingly challenging. From time to time, the Company has experienced, and may experience in the future, breaches of security measures due to human error, malfeasance, insider threats, system errors or vulnerabilities or other irregularities, none of which have been material to date. In addition, from time to time the Company has experienced disruptions to its operations due to IT interruptions at third parties with whom it does business. To date, none of these have been material.

Read in the earlier 10-K, filed Dec 5, 2024 ↗

Although the Company has programs in place related to business continuity, disaster recovery, and information security initiatives to maintain the confidentiality, integrity, and availability of systems, business applications, and customer information, the Company may not be able to anticipate or implement effective preventive measures against all potential IT interruptions or cybersecurity threats, especially because, in connection with cybersecurity threats the techniques used change frequently and

Read in the earlier 10-K, filed Dec 5, 2024 ↗

because attacks can originate from a wide variety of sources, both domestic and foreign. Cybersecurity risk cannot be fully mitigated because of the rapidly evolving nature of the threats, targets, and consequences.

Read in the earlier 10-K, filed Dec 5, 2024 ↗

If the Company experiences a loss or significant disruption in its operations due to a cybersecurity event or other IT interruption, the Company may suffer reputational, competitive, and business harm and may be exposed to legal liability, which may adversely affect the Company’s results of operations.

Read in the earlier 10-K, filed Dec 5, 2024 ↗

Our business and operations would suffer in the event of computer system failures, cyber-attacks or a deficiency in our cyber-security.

Read in the earlier 10-K, filed Mar 25, 2025 ↗

targeted by threat actors seeking to undermine companies’ cybersecurity defensive

Read in the earlier 10-K, filed Feb 25, 2025 ↗

increased exposure to cybersecurity risks in foreign jurisdictions that may materially and adversely affect our business, financial condition and results of operations.

Read in the earlier 10-K, filed Mar 3, 2025 ↗

Bitcoin and other blockchain-based digital assets have been, and may in the future be, subject to security breaches, cyberattacks, or other malicious activities. A successful security breach or cyberattack on us or our custodians could result in a partial or total loss of our Bitcoin in a manner that may not be covered by insurance or indemnity provisions of the custody agreement with a custodian who holds our Bitcoin. Access to our Bitcoin could also be restricted by natural events (such as an earthquake or flood) or human actions (such as a terrorist attack). Such a loss could have a material adverse effect on our business, financial condition, and results of operations.

Read in the earlier 10-K, filed Mar 3, 2025 ↗

• maintain a risk management and compliance framework designed to detect illegal activity such as fraud, money laundering, tax evasion and ransomware scams and comply with anti-money laundering, counter-terrorist financing laws and regulations and anti-corruption laws globally; and

Read in the earlier 10-K, filed Feb 6, 2025 ↗

•Independent Security Attestation: We utilize both internal assessments and assessments by third parties, including external security assessors, consultants and auditors, to evaluate and test our cybersecurity program.

Read in the earlier 10-K, filed Feb 6, 2025 ↗

As information systems and the use of software and related applications by us, our business partners, suppliers, and customers become more cloud-based and connected to the “Internet of Things” (“IoT”), there has been an increase in global cybersecurity vulnerabilities and threats, including more sophisticated and targeted cyber-related attacks that pose a risk to the security of our information systems and networks and the security, confidentiality, availability and integrity of data and information. We process credit card payments electronically over secure networks and offer IoT products and services, such as our connected devices (e.g., IDEXX VetLab instruments). Any such attack or breach could compromise our networks and the information stored thereon could be accessed, publicly disclosed, lost, or stolen. While we have implemented network security and internal control measures, especially for the purpose of protecting our connected products and services from cyberattacks, and invested in our data and information technology infrastructure, these efforts have not always been successful in preventing, and there can be no assurance that these efforts (or any future investments or efforts) will prevent, a system disruption, attack, or security breach.

Read in the earlier 10-K, filed Feb 21, 2025 ↗

To address the risks to our information technology systems and the associated costs, we maintain an information security program that includes updating technology and information security policies and controls, cybersecurity insurance, cybersecurity governance and compliance, employee/consultant awareness training, table-top exercises, logging and monitoring

Read in the earlier 10-K, filed Feb 28, 2025 ↗

A disruption to our information technology systems could result in the loss of confidential business, customer, supplier or employee information, litigation or fines, and may require substantial investigations, repairs or replacements or impact our ability to summarize and report financial results in a timely manner, affecting our productivity or resulting in significant financial, legal and relational costs and potentially harming our reputation and adversely impacting our operations, customer service and results of operations. Additionally, the increasing use and evolution of technology, including cloud-based computing and AI, may lead to potential loss or unauthorized disclosure or use of personal data and proprietary information that was collected, used, stored, or transferred with respect to our business, and to dissemination or destruction of confidential information, unintentionally or otherwise, stored in our or in our third-party providers’ systems or through use of AI, which may significantly increase our business and information security costs, and expose us to reputational harm, penalties, or legal liability. As we complete integration of systems of prior acquired companies with IFF’s systems and prepare for the announced divestitures, we reduce our risk profile. Additionally, an information security or data breach could require us to devote significant management and financial resources to address the problems created, and, as a result of the private rights of action provided for under the European Union’s General Data Protection Regulation (the “GDPR”), the California Consumer Privacy Act (the “CCPA”) and other laws relating to data protection and privacy in other jurisdictions, in the event of such breaches, additional private litigation against us may result. These types of adverse impacts could also occur in the event the confidentiality, integrity or availability of company, customer, supplier or employee information are compromised due to a data loss by us or a trusted third party. We or the third parties with which we share information may not discover any such incidents and/or loss of information for a significant period of time after the incident occurs. In addition, our hybrid and remote work arrangements could introduce operational risk, including cybersecurity and IT systems management risks.

Read in the earlier 10-K, filed Feb 28, 2025 ↗

into our products, our information technology infrastructure and our products may in the future be, and have in the past been, impacted by cyber-attacks, employee error, malfeasance, or other disruptions.

Read in the earlier 10-K, filed Feb 12, 2025 ↗

As a developer of leading-edge manufacturing process nodes and widely utilized semiconductor processors and other products, we have been, and expect to continue to be, the subject of intense efforts by sophisticated cyber adversaries, including state-sponsored organizations, who seek to compromise our systems, disrupt our operations or those of users of our products, or steal trade secrets. As geopolitical or armed global conflicts escalate, attacks against us, our customers, or our strategic allies may similarly intensify. For example, from 2019 to 2021, we, along with other companies with meaningful operations in Israel, were targets of concerted cyberattacks. In the fourth quarter of 2020, our Habana Labs subsidiary's network was breached in connection with a suspected unsuccessful ransomware attack, resulting in unauthorized third-party access of certain confidential information.

Read in the earlier 10-K, filed Jan 31, 2025 ↗

We are also subject to risks associated with attacks on products, services, and components in our supply chain, such as the 2020 compromise of IT infrastructure management software provided by SolarWinds Corporation, and risks from vulnerabilities in using industry-wide software solutions and third-party components, such as the 2021 Log4Shell vulnerability and similar vulnerabilities that followed. The CrowdStrike outage that occurred in 2024 is another example of the risks we face from utilizing products and components that are widely adopted in supply chains. These providers can experience breaches of their systems and products, or provide inadequate updates or support, which can impact the security of our systems and our proprietary or confidential information. Since 2021, we have observed an increase in ransomware attacks in our supply chain.

Read in the earlier 10-K, filed Jan 31, 2025 ↗

our industry. Like other global companies, our systems are subject to recurring attempts by third parties to access information, manipulate data or disrupt operations. In this regard, we have experienced cyber threats and events from time to time, although none have materially affected us, including our results of operations or financial condition. Given the current cyber threat environment, the volume and intensity of cybersecurity attacks and attempted intrusions are expected to increase in the future. We work with a large number of third-party vendors, suppliers, platforms, software, applications, and technologies, each of which may be subject to a cybersecurity incident or information technology failure that impacts our business or operations. We may be required to spend significant resources to verify the implementation of cybersecurity controls by our vendors and suppliers. In addition, despite careful security and controls design, implementation, updating, monitoring and independent third-party verification, our information technology systems, together with those of our third-party providers or joint venture partners, have been and could again be compromised or disrupted due to factors such as employee error or malfeasance, cyber-attacks, including ransomware, malware, phishing attacks, advanced persistent threats, social engineering, credential stuffing or distributed denial-of-service attacks or data or security breaches by malicious actors such as common hackers, criminal groups or nation-state organizations or social activist (“hacktivist”) organizations, disruptions resulting from geopolitical events, natural disasters, failures or impairments of telecommunications networks or other catastrophic events. Such attacks are increasing in complexity, and the rapid evolution and increased adoption of AI technologies may intensify cybersecurity risks by making cyber-attacks more difficult to detect, contain, and mitigate. Furthermore, remote working and personal device use increases the risks of cyber incidents and the improper dissemination of personal or confidential information. Moreover, the hardware, software or applications we use may have inherent vulnerabilities or defects of design, manufacture or operations or could be inadvertently or intentionally implemented or used in a manner that could compromise information security. In addition, cybersecurity-related threats may remain undetected for an extended period of time.

Read in the earlier 10-K, filed Feb 21, 2025 ↗

breach could also result in operational or supply chain disruptions, data loss, corruption or manipulation, or information misappropriation including, but not limited to, interruption to systems availability, denial of access to and misuse of applications required by customers to conduct business, the acquisition, use or disclosure of data or inability to access data, the release of confidential information about our operations, and subject us to litigation and government enforcement actions. Further, in such event, access to applications required to plan operations, source materials, manufacture and ship finished goods and account for orders could be denied or misused. Theft of intellectual property or trade secrets, and loss or inappropriate disclosure of confidential company, employee, customer or vendor information, could also stem from such incidents. Moreover, any significant cybersecurity event could require us to devote significant management time and resources in response to such event, interfere with the pursuit of other important business strategies and initiatives, and cause us to incur additional expenditures, which could be material, including to investigate and remediate such event, recover lost data, prevent future compromises and adapt systems and practices in response to such events. There is no assurance that any remedial actions will meaningfully limit the success of future attempts to breach our information systems, particularly because malicious actors are increasingly sophisticated and utilize tools and techniques specifically designed to circumvent security measures, avoid detection and obfuscate forensic evidence, which means we may be unable to identify, investigate or remediate effectively or in a timely manner. Further, following completion of our business combination with DS Smith, we are subject to an increasing number of cybersecurity reporting obligations in different jurisdictions that vary in their scope and application, which may add complexities in providing complete and reliable information about cybersecurity incidents to customers, counterparties, and regulators, as well as the public. The recent completion of our business combination with DS Smith has resulted in increased scale and a broader global presence, which will impact our cybersecurity risk profile. As part of the integration of the newly acquired business, we are actively assessing and addressing these cybersecurity risks to ensure robust protection of our expanded operations and data assets. Additionally, while insurance coverage designed to address certain aspects of cyber risks may be in place, such insurance coverage may be insufficient to cover all losses or all types of claims that may arise in connection with such incidents.

Read in the earlier 10-K, filed Feb 21, 2025 ↗

This increasingly restrictive and evolving global regulatory environment related to data privacy and data protection may continue to require changes to our business practices, and give rise to significantly expanded compliance burdens, costs and enforcement risks. Moreover, many of these laws and regulations are subject to uncertain application, interpretation or enforcement standards that could result in claims, changes to business practices, data processing and security systems, penalties, increased operating costs or other impacts on our business. Additionally, regulatory bodies and others tasked with enforcing privacy and data protection laws have been actively engaging in enforcement investigations and actions. These laws often provide for civil penalties for violations, as well as private rights of action for data breaches that may increase data breach litigation. We use internal and external resources to monitor compliance with relevant legislation and continually evaluate and, where necessary, modify data processing practices and policies to comply with evolving privacy laws. Nevertheless, relevant regulatory authorities could determine that our data handling practices fail to address all the requirements of certain new laws, which could subject us to penalties and/or litigation. In addition, there is no assurance that our security controls over personal data, the training of employees and vendors on data privacy and data security, and policies, procedures and practices will prevent the improper handling of, disclosure of or access to personal data. Improper handling and disclosure of or access to personal data in violation of other data privacy and protection laws could cause reputational harm and loss of consumer confidence and subject us to government enforcement actions (including fines), or result in private litigation, which could result in loss of revenue, increased costs, liability for monetary damages, fines and/or criminal prosecution, all of which could negatively affect our business and operating results.

Read in the earlier 10-K, filed Feb 21, 2025 ↗

Moreover, effective internal controls are necessary to provide reliable and accurate financial reports, and the integration of businesses may create complexity in our financial systems and internal controls and make them more difficult to manage. Integration of businesses into our internal control system could cause us to fail to meet our financial reporting obligations. Moreover, any failure to integrate, or delay in integrating, IT systems of acquired businesses could create an increased risk of cybersecurity incidents. Following integration, an acquired business may not produce the expected margins or cash flows. Furthermore, we may finance these strategic transactions by incurring additional debt or issuing equity, which could increase leverage or impact our ability to access capital in the future.

Read in the earlier 10-K, filed Feb 21, 2025 ↗

Like many multinational corporations, we, and some third parties upon which we rely, have experienced cyber attacks on our computer systems and networks in the past and may experience them in the future, likely with more frequency and

Read in the earlier 10-K, filed Feb 13, 2025 ↗

•Regulations promulgated to address risks of fraud, malfeasance, adverse consequences stemming from cyber-attacks and/or cross-border data transfer, and to ensure the digital operational resilience of firms. In particular, the new EU Digital Operational Resilience Act harmonizes the requirements applying to Information and Communication Technology risk management, outsourcing and operational resilience in the financial sector.

Read in the earlier 10-K, filed Feb 25, 2025 ↗

example, our recent cybersecurity incident caused disruptions to our operations, adversely affecting our financial performance in early fiscal 2024. Further, the occurrence or reoccurrence of regional epidemics or a global pandemic, such as COVID-19, may adversely affect our operations, financial condition, and results of operations.

Read in the earlier 10-K, filed Nov 19, 2024 ↗

•the economic effects of an outbreak or escalation of war, hostilities, terrorism or other geopolitical instabilities, cyber attacks, climate change, natural disasters, severe weather conditions, health emergencies, the spread of infectious diseases, epidemics or pandemics or other extraordinary events beyond JPMorganChase’s control, and

Read in the earlier 10-K, filed Feb 14, 2025 ↗

JPMorganChase experiences numerous cyber attacks on its computer systems, software, networks and other technology assets on a daily basis from various actors, including groups acting on behalf of hostile countries, cyber-criminals, “hacktivists” (i.e., individuals or groups that use technology to promote a political agenda or social change) and others. These cyber attacks can take many forms, including attempts to introduce computer viruses or malicious code, which are commonly referred to as “malware,” into JPMorganChase’s systems. These attacks are often designed to:

Read in the earlier 10-K, filed Feb 14, 2025 ↗

A principal reason that JPMorganChase cannot provide absolute security against cyber attacks is that it may not always be possible to anticipate, detect or recognize threats to JPMorganChase’s systems, or to

Read in the earlier 10-K, filed Feb 14, 2025 ↗

The risk of a security breach due to a cyber attack could increase in the future due to factors such as:

Read in the earlier 10-K, filed Feb 14, 2025 ↗

The dynamic nature of the cyber threat landscape, including the pace of innovation and increased threat of novel attack methods, necessitates ongoing investment in, as well as enhancement and adaptation of, cybersecurity controls, including the adoption of enhanced security measures in certain jurisdictions. Failure to discover or address emerging threats, known vulnerabilities or shortcomings in cybersecurity controls, or to prioritize or complete enhancements to address them, in each case in a timely manner, may leave JPMorganChase vulnerable to cyber attacks, potentially resulting in data breaches, financial losses,

Read in the earlier 10-K, filed Feb 14, 2025 ↗

Aggressive actions by hostile governments or groups, including armed conflict or intensified cyber attacks, could expand in unpredictable ways by drawing in other countries or escalating into full-scale war with potentially catastrophic consequences, particularly if one or more of the combatants possess nuclear weapons. Depending on the scope of the conflict, the hostilities could result in:

Read in the earlier 10-K, filed Feb 14, 2025 ↗

A disruption at our manufacturing and distribution facilities could have a material adverse effect on our business, as could a disruption at the facilities of our bottlers, contract manufacturers or distributors. Disruptions could occur for many reasons, including fire, natural disasters, weather, water scarcity, manufacturing problems, disease, widespread illness, strikes, labor shortages, transportation or supply interruption, contractual dispute, government regulation, cybersecurity attacks or terrorism. Moreover, if demand increases beyond our production capabilities, we would need to expand our capabilities internally or acquire additional capacity. Alternative facilities with sufficient capacity or capabilities may not be available, may cost substantially more than existing facilities or may take a significant time to start production, each of which could negatively affect our business and financial performance.

Read in the earlier 10-K, filed Feb 25, 2025 ↗

The increase in remote work over the past several years has resulted in an expanded potential attack surface and heightened operational risks and may negatively impact our ability, and the ability of our third-party service providers (including their downstream service providers), to perform services efficiently, securely, and without interruptions. In addition to some of our workforce working remotely periodically or on a full-time basis, our third-party service providers (including their downstream service providers) may utilize personnel who work remotely. Increased levels of remote access create additional cybersecurity risk and opportunities for cybercriminals to exploit vulnerabilities. These fraudulent activities have resulted in increased fraud losses to us and the financial services industry generally. In addition to enhanced cybersecurity risk, employees and other personnel performing services for us who work remotely may experience disruptions to their home internet or phone connections, decreased efficiency due to delayed network speeds or other interruptions, and/or delays in the dissemination and exchange of information, any of which could negatively impact our operations. We have experienced, and may continue to experience, disruption related to remote work, which disruptions could adversely impact our business, and could result in legal liability, regulatory penalties, litigation expenses, remediation costs, or reputational harm.

Read in the earlier 10-K, filed Feb 21, 2025 ↗

Our investment vehicle investors, stockholders, regulators and other stakeholders are increasingly focused on cybersecurity risk management. In today’s current threat landscape, we are continuously facing various security threats on a regular basis, including ongoing cybersecurity threats to and attacks on our information technology infrastructure that are intended to gain access to our proprietary information, destroy data or disable, degrade or sabotage our systems. The risk of a security breach or disruption, particularly through accidental actions or omissions by trusted insiders, cyber-attacks or cyber intrusions, including by computer hackers, viruses, nation-state threat actors, and cyber terrorists, has increased as the number, intensity, and sophistication of attempted attacks and intrusions from around the world have increased. Although we take protective measures and endeavor to modify them as circumstances warrant, our computer systems, software and networks may be vulnerable to unauthorized access, theft, misuse, computer viruses or other malicious code, and other events that could have a security impact (including the deployment of harmful malware, ransomware, denial-of-service attacks, social engineering, and other means to affect service reliability and threaten the confidentiality, integrity, and availability of information). We may be exposed to more significant risk if these acts are taken by nation-state threat actors. Our employees have been and expect to continue to be the target of fraudulent calls and emails, and the subject of impersonations and fraudulent requests for money, such as attempts to redirect material payment amounts in a transaction to a fraudulent bank account, and other forms of activities. These same cybersecurity breaches, cyberattack and cyber intrusions could also be employed against our various stakeholders or other third parties, including attempts to impersonate KKR or its employees, which could cause similar security impacts to our stakeholders and other third parties and materially and adversely impact us or our investment vehicles. Cyber-criminals may attempt to redirect payments required to be paid at the closings of our investments to unauthorized accounts, which we or the services providers we retain, like administrators, paying agents and escrow agents, may not be able to detect or protect against. The costs related to cyber or other security threats or disruptions may not be fully insured or indemnified by others, including by our service providers.

Read in the earlier 10-K, filed Feb 28, 2025 ↗

Cybersecurity has become a top priority for regulators around the world. Rapidly developing and changing cybersecurity laws and regulations could further increase compliance costs and subject us to enforcement risks and reputational damage. Many jurisdictions in which we operate have laws and regulations relating to data privacy, cybersecurity and protection of personal information, including the U.K.’s Data Protection Act 2018, the European General Data Protection Regulation (“GDPR”) that became effective in May 2018, the E.U.’s regulations on digital operational resilience for the financial sector ("DORA"), which became effective in January 2023 and will begin to apply from January 2025 (which is designed to harmonize and strengthen digital operational resilience requirements for the EU's financial services sector and will require in-scope financial entities to comply with new requirements, including having a comprehensive governance and control framework for the management of information and communications technology risk), the Gramm-Leach-Bliley Act of 1999 as amended in June 2023 (and the applicable regulations thereunder) and the California Consumer Privacy Act (“CCPA”) that became effective in January 2020 and is amended by the California Privacy Rights Act (“CPRA”), which became operative in January 2023. The CPRA imposed additional obligations on companies covered by the legislation, including by expanding consumers’ rights with respect to certain sensitive personal information. The CPRA also creates a new state agency that is vested with authority to implement and enforce the CCPA and the CPRA. Global Atlantic is subject to the New York State Department of Financial Services (“NYSDFS”) cybersecurity regulation. In November 2023, the NYSDFS finalized amendments to its cybersecurity regulations which took effect in April 2024 (the “NYSDFS Cybersecurity Amendments”), which, among other things, imposes additional governance requirements, require the implementation of additional safeguards, impose various requirements on larger companies, require new and increased obligations related to written policies and procedures, heighten requirements around audits and risk assessments, and necessitate additional reporting requirements for cybersecurity incidents. More specifically, the NYSDFS Cybersecurity Amendments also require subject entities to (i)

Read in the earlier 10-K, filed Feb 28, 2025 ↗

establish and maintain a cybersecurity program designed to ensure the confidentiality, integrity and availability of their information systems; (ii) implement and maintain a written cybersecurity policy setting forth policies and procedures for the protection of their information systems and nonpublic information; and (iii) review and update any risk assessments at least annually, as well as whenever a change in the business or technology causes a material change to cybersecurity risk.

Read in the earlier 10-K, filed Feb 28, 2025 ↗

Furthermore, the SEC has underscored its focus on cybersecurity. In July 2023, the SEC adopted new cybersecurity disclosure rules, aimed at enhancing and standardizing disclosures made by public companies regarding cybersecurity risk management, strategy, governance and incident reporting. Some jurisdictions have also enacted laws requiring companies to notify individuals of data security breaches involving certain types of personal data. In February 2022, the SEC also proposed similar cybersecurity regulations for regulated investment advisers. If adopted in its proposed form, the proposed rule would require implementation of written cybersecurity policies and procedures to address cybersecurity risk in addition to requiring registered investment advisers to report significant cybersecurity incidents affecting the investment adviser or the investment vehicles it advises within 48 hours to the SEC and would impose a new recordkeeping policy and internal review requirements related to cybersecurity. If this proposal is adopted, it could increase our compliance costs and potential regulatory liability related to cybersecurity. The SEC has also proposed a similar cybersecurity rule for broker-dealers and other security market participants which would require subject entities to implement policies and procedures that are reasonably designed to address their cybersecurity risks and, at least annually, review and assess the design and effectiveness of their cybersecurity policies and procedures, including whether they reflect changes in cybersecurity risk over the time period covered by the review. Many regulators have indicated an intention to take more aggressive enforcement actions regarding cybersecurity matters, and private litigation resulting from such matters is increasing and resulting in progressively larger judgments and settlements.

Read in the earlier 10-K, filed Feb 28, 2025 ↗

We cannot assure you that our cybersecurity risk management efforts and our investment in information technology will prevent significant breakdowns, data leakages, breaches in our systems, or those of our third-party vendors and other contractors and consultants, or other cyber incidents that could have a material adverse effect upon our reputation, business, operations, or financial condition. The techniques used by cyber criminals change frequently, may not be recognized until launched, and can originate from a wide variety of sources, including outside groups such as external service providers, organized crime affiliates, terrorist organizations, hostile foreign governments or agencies, or cybersecurity researchers. Breaches in security could potentially jeopardize our, our employees’, our investment vehicle investors’, insurance policyholders’ or our counterparties’ confidential and other information processed and stored in, and transmitted through, our computer systems and networks, or otherwise cause interruptions or malfunctions in our, our employees’, our investment vehicle investors’, insurance policyholders’, our counterparties’ or third parties’ operations, which could result in significant losses, increased costs, disruption of our business, liability to our investment vehicle investors and other counterparties, regulatory intervention or reputational damage. Furthermore, if we experience a cybersecurity incident and fail to comply with the relevant notification laws and regulations, it could result in regulatory investigations and penalties, which could lead to negative publicity and may cause our investment vehicle investors and clients to lose confidence in the effectiveness of our security measures.

Read in the earlier 10-K, filed Feb 28, 2025 ↗

Our third-party service providers could also experience, and recently have experienced, any of the above cybersecurity threats, fraudulent activities or security breaches, and as a result, unauthorized individuals could improperly gain access to our confidential data through such third parties. Any interruption or deterioration in the performance of these third parties or cybersecurity incidents involving these third parties could impair the quality of our and our investment vehicles’ operations and could impact our reputation and materially and adversely affect us. We may also have insufficient recourse against such third parties and may have to expend significant resources to mitigate the impact of such an event, and to develop and implement protections to prevent future events of this nature from occurring.

Read in the earlier 10-K, filed Feb 28, 2025 ↗

Our ability to use data to gain insights into and manage our business may be limited in the future by regulatory scrutiny and legal developments. See also “—Risks Related to Our Business—Rapidly developing and changing global privacy and data laws and regulations could further increase compliance costs and subject us to enforcement risks and reputational damage” and “—Risks Related to Our Business—Cybersecurity failures and data security breaches may disrupt or have a material adverse impact on our businesses, operations and investments.”

Read in the earlier 10-K, filed Feb 28, 2025 ↗

Our employees (and, in certain cases, third-party service providers) have access to, and process, personal information of our investors, insurance policyholders, employees, contractors and other counterparties and third parties through a variety of media, including information technology systems. Our and our third-party service providers’ information systems and technology may not be able to adequately protect the information of our investors, employees, insurance policyholders, contractors and other counterparties and third parties, may not be suitable for new products and strategies and may be subject to security risks. We rely on various internal processes and controls to protect the confidentiality of client information that is accessible to, or in the possession of, us, our employees and certain vendors and third-party administrators. It is possible that an employee could, intentionally or unintentionally, disclose or misappropriate confidential client information or our data could be the subject of a cybersecurity attack. Our third-party administrators and their employees also have access to, and routinely process, personal information of our investors, employees, insurance policyholders, contractors and other counterparties and third parties, and we are also dependent on such third parties and their systems to protect such data. If we or one of our subsidiary’s employees, or one of our or a subsidiary’s third-party vendors or administrators’ employees, unintentionally share confidential client information or such information as a result of a cybersecurity attack or otherwise, we may be unable to control or mitigate this occurrence even if we offer remediation, such as credit monitoring, to the impacted parties. Misappropriation or intentional or unintentional inappropriate disclosure or misuse of client confidential information could occur even if individuals are properly trained and adequate internal controls and policies and procedures are maintained.

Read in the earlier 10-K, filed Feb 28, 2025 ↗

Pursuant to U.S. federal and state laws, various government agencies have established rules protecting the privacy and security of personal information. We and our portfolio companies may be required to comply with both U.S. federal and state laws and regulations related to privacy. For example, the CCPA provides for enhanced consumer protections for California residents, a private right of action for data breaches of certain personal information and statutory fines and damages for such data breaches or other CCPA violations, as well as a requirement of “reasonable” cybersecurity. The CCPA was expanded on January 1, 2023, when the CPRA amendments to the CCPA became operative. Additional U.S. states have passed their own comprehensive consumer privacy laws, some of which went into effect in 2023 and 2024, and other states are considering doing so, including Delaware, Iowa and Nebraska each of whom have new privacy laws taking effect in 2025. These state laws may expand our compliance obligations and impact our business or the businesses of our portfolio companies. Most states have enacted laws to which we are subject, and which vary significantly from jurisdiction to jurisdiction, to safeguard the privacy and security of personal information. Global Atlantic, in particular, processes sensitive personal information of its policyholders, which exposes Global Atlantic to heightened risk. Global Atlantic is subject to the NYSDFS cybersecurity regulation. The NYSDFS Cybersecurity Amendments significantly expand the regulation by the NYSDFS of data privacy matters. Global Atlantic is also subject to the California Consumer Privacy Act. At the U.S. federal level, we are subject to the Gramm-Leach-Bliley Act of 1999 as amended in June 2023, which imposes privacy requirements on financial institutions,

Read in the earlier 10-K, filed Feb 28, 2025 ↗

In May 2024, the SEC adopted cybersecurity regulations as an amendment to Regulation S-P designed to establish a federal “minimum standard” for covered institutions (as defined below) to adopt an incident response program to govern their response to any unauthorized access of customer information. The adopted rule requires compliance starting in December 2025 and applies to us as it includes broker-dealers, investment companies and registered investment advisers. The amendments require implementation of written policies and procedures to safeguard customer records and information by imposing notification requirements to affected individuals whose sensitive customer information was or is reasonably likely to have been accessed or used without authorization and other requirements, such as review of incident response programs and having policies and procedures regarding compliance by third-party service providers

Read in the earlier 10-K, filed Feb 28, 2025 ↗

In December 2024, the DOJ finalized a rule with phased-in compliance for U.S. persons, including us, beginning in April 2025 which will impose data security requirements, such as meeting certain standards for cybersecurity, adopting cybersecurity policies, conducting cybersecurity audits and performing due diligence and recordkeeping requirements, on, and prohibit the transfer of, and access to, bulk sensitive personal data to foreign persons connected with certain countries of concern which currently include China, Cuba, Iran, North Korea, Russia and Venezuela.

Read in the earlier 10-K, filed Feb 28, 2025 ↗

The private equity industry has been and continues to be under intense regulatory and news media scrutiny with governmental officials and regulators focusing on the private equity industry's fees, the taxation of its investments, business practices, antitrust compliance and operations of its portfolio companies, conflicts of interest, and other issues. In particular, the SEC's areas of focus on private equity firms have included, among others, fiduciary duty and compliance programs, conflicts of interest, allocation of investment opportunities, the allocation of fees and expenses, including the acceleration of monitoring fees and the allocation of broken-deal and other expenses, valuation practices, the disclosure, use and compensation of operating partners or consultants as well as third-party compliance or similar service providers, outside investment and business activities of firm principals and employees, group purchasing arrangements, disclosure of affiliated service providers, disclosure of conflicts of interest and investment risks, adherence to notice, consent and other contractual requirements, electronic communications, cybersecurity, data privacy and protection, the use of purchased data, valuation, retail investors, foreign bribery and corruption, and policies covering custody, auditing, handling of material nonpublic information, insider trading, business continuity and transition planning, conflicts of interest relating to liquidity, such as certain adviser-led fund

Read in the earlier 10-K, filed Feb 28, 2025 ↗

Additionally, our business could be adversely affected if we or our portfolio companies fail to comply with existing and potential new applicable regulations relating to artificial intelligence, including the EU AI Act, privacy, data, and information security. The potential impact to us of these regulations is in “—Risks Related to Our Business—Rapidly developing and changing global privacy and data laws and regulations could further increase compliance costs and subject us to enforcement risks and reputational damage” and "—Risks Related to Our Business—Cybersecurity failures and data security breaches may disrupt or have a material adverse impact on our businesses, operations and investments."

Read in the earlier 10-K, filed Feb 28, 2025 ↗

The valuations of our investments can be impacted by many other factors unrelated to market or economic conditions, including (i) geopolitical developments and other local and global events, (ii) natural disasters and catastrophes, including public health crises, (iii) data security breaches and cybersecurity failures, and (iv) material litigations, governmental sanctions, or the failure to comply with applicable law. The valuation of our investments may also be impacted by other factors that may or may not be foreseeable or in our control, for example: decreasing revenues, increasing costs, credit rating downgrades, difficulty in obtaining financing on attractive terms or at all, financial losses, contractual defaults, or insolvency. These and other risks that have impacted, and may continue to affect, the valuation of our investments are described in “—Risks Related to Our Business,” as most of these risks to our business also are risks to the valuation of our investments.

Read in the earlier 10-K, filed Feb 28, 2025 ↗

number of important business, financial, tax, accounting, sustainability, technological, cybersecurity, data privacy, regulatory and legal issues and macroeconomic trends in determining whether or not to proceed with an investment. Outside consultants, legal and tax advisors, accountants and investment banks, among others, are involved in the due diligence process in varying degrees depending on the type of investment. Nevertheless, when conducting due diligence and making an assessment regarding an investment, we rely on resources available to us, including information provided by the target of the investment and, in some circumstances, third-party investigations. The due diligence process may at times be subjective with respect to newly organized companies or carve-out transactions for which only limited information is available.

Read in the earlier 10-K, filed Feb 28, 2025 ↗

As previously disclosed, CNA sustained a sophisticated cybersecurity attack in March 2021 involving ransomware that caused a network disruption and impacted certain of its systems. CNA’s investigation into the incident revealed that an unauthorized third party copied some personal information relating to certain current and former employees, contract workers and their dependents and certain other persons, including some policyholders. Although CNA currently has no indication that the impacted data has been misused, or that CNA or its policyholder data was specifically targeted by the unauthorized third party, it may be subject to subsequent investigations, claims or actions in addition to other costs, fines, penalties, or other obligations related to impacted data, whether or not such data is misused. In addition, the misuse, or perceived misuse, of sensitive or confidential information regarding its business or policyholders could cause harm to CNA’s reputation and result in the loss of business with existing or potential customers, which could adversely impact its business, results of operations and financial condition.

Read in the earlier 10-K, filed Feb 11, 2025 ↗

The global outbreak of the COVID-19 pandemic and measures to mitigate the spread of COVID-19 caused unprecedented disruptions to the global and U.S. economies and impacted global demand for oil and petrochemical products. Future pandemics or other outbreaks of contagious diseases could result in similar or worse impacts and significant business and operational disruptions, including business closures, supply chain disruptions, travel restrictions, stay-at-home orders and limitations on the availability of workforces. Although Boardwalk Pipelines’ operations are considered essential critical infrastructure under current Cybersecurity and Infrastructure Security Agency guidelines, if significant portions of Boardwalk Pipelines’ workforce are unable to work effectively, including because of illness or quarantines or from the impacts of any potential future pandemics or other outbreaks of contagious diseases, its business could be materially adversely affected. Boardwalk Pipelines may also be unable to perform fully on its contracts, and its costs may increase as a result of any potential future pandemics or other outbreaks of contagious diseases. These cost increases may not be fully recoverable. It is possible that future pandemics or other outbreaks of contagious diseases could cause disruption in Boardwalk Pipelines’ customers’ businesses, cause delays, or limit the ability of its customers to perform, including in making timely payments to it. Future pandemics or other outbreaks of contagious diseases could impact capital markets, which may impact Boardwalk Pipelines’ customers’ financial position. Future pandemics or other outbreaks of contagious diseases may also have the effect of exacerbating several of the other risk factors contained herein.

Read in the earlier 10-K, filed Feb 11, 2025 ↗

The Company depends on third parties to provide supplies and services critical to the Company’s business. Although the Company has a significant proprietary network of ground and air transport capabilities, certain of the Company’s businesses are heavily reliant on third-party ground and air travel for transport of clinical trial and diagnostic testing supplies and specimens, research products, and people. A significant disruption to these travel systems, or the Company’s access to them, could have a material adverse effect on the Company’s business. The Company is also reliant on an extensive network of third-party suppliers and vendors of certain services and products, including for certain animal populations. Disruptions to the continued supply, or increases in costs, of these services, products, or animal populations may arise from export/import restrictions or embargoes, political or economic instability, pressure from animal rights activists, adverse weather, natural disasters, public health crises, transportation disruptions, cybersecurity incidents, or other causes, as well as from termination of relationships with suppliers or vendors for their failure to follow the Company’s performance standards and requirements. Disruption of supply and services has impacted and could continue to impact or have a material adverse effect on the Company’s business.

Read in the earlier 10-K, filed Feb 25, 2025 ↗

The Company’s operations and customer relationships depend, in part, on the continued performance of its information technology systems. An information technology or process failure could impede the processing of data, delivery of data and services, customer orders, and day-to-day management of the business, and could result in the corruption or loss of data. Despite security measures and other precautions the Company has taken, including the development of contingency and disaster recovery plans, its information technology systems are potentially vulnerable to physical break-ins, fire, natural disaster, power loss, telecommunications failures, cybersecurity incidents and similar disruptions, and there may not be adequate protections, mitigation, backups, and/or redundant facilities available in the event these threats are realized. In addition, the Company may experience system failures, or interruptions, including cybersecurity incidents, as it integrates the information technology systems of newly acquired businesses. Failures or interruption of the Company’s systems in one or more of its operations could result in interruptions of service, disrupt the Company’s ability to process laboratory requisitions, perform testing, provide test results or drug development data in a timely manner, and/or conduct timely billing operations. Such system failures could require the Company to transfer operations to an alternative provider of services, which could result in delays in the delivery of offerings to customers and other operations. Additionally, significant delays in the planned delivery of system enhancements or improvements, or inadequate performance of the systems once they are complete, could damage the Company's reputation and harm the business. Furthermore, failure of the Company’s information technology systems could adversely affect the Company’s business, profitability, financial condition, and reputation.

Read in the earlier 10-K, filed Feb 25, 2025 ↗

The Company has previously experienced and expects to continue to experience attempts by unauthorized parties to compromise the Company’s cybersecurity controls, like the 2018 ransomware attack. The Company has also experienced and expects to continue to experience similar attempts by threat actors to penetrate the systems of third-party suppliers and vendors to whom the Company has provided data, like the 2019 AMCA data breach. These attempts, if successful, could result in the misappropriation or compromise of personal information or proprietary or confidential information stored within the Company's systems or within the systems of third parties, create system disruptions or cause shutdowns. Threat actors have a variety of attack methods, including without limitation, by developing and deploying viruses, worms, and other malicious software programs that attack the Company’s systems, the systems of third-parties, or otherwise exploit any security vulnerabilities. In addition, the increased use of AI by threat actors is enhancing the scale sophistication and effectiveness of their cyberattacks. Outside parties may also attempt to fraudulently induce employees to take actions, including the release of confidential or sensitive information or to make fraudulent payments through illegal electronic spamming, phishing, spear phishing, and other tactics.

Read in the earlier 10-K, filed Feb 25, 2025 ↗

The Company has implemented a formal cybersecurity program; however, because the techniques used by threat actors to obtain unauthorized access, disable or degrade service, or sabotage systems continue to evolve (and often are not recognized until launched against a target), the Company may be unable to anticipate and/or implement appropriate controls needed to

Read in the earlier 10-K, filed Feb 25, 2025 ↗

protect against these evolving threats. In addition, as cyber threats continue to evolve including the use of AI by threat actors to compromise systems, the Company may be required to expend additional resources to continue to enhance the Company’s cybersecurity measures or to investigate and remediate any cybersecurity vulnerabilities. The Company’s remediation efforts may not be sufficient and could result in interruptions, delays, cessation of service, loss of data integrity, loss of confidentiality, and/or loss of data. This could also impact the cost and availability of cyber insurance to the Company. Cybersecurity incidents affecting the Company’s or third parties' security measures and the unauthorized dissemination of personal, proprietary or confidential information about the Company or its customers or other third parties could expose customers’ private information. Such incidents could expose customers to the risk of financial or medical identity theft or expose the Company or other third parties to a risk of loss or misuse of this information, result in litigation and potential liability for the Company, damage the Company’s brand and reputation, or otherwise harm the Company’s business. Any of these incidents could have a material adverse effect on the Company’s business, regulatory compliance, financial condition, reputation, and/or results of operations.

Read in the earlier 10-K, filed Feb 25, 2025 ↗

In addition, the Company faces increased cybersecurity risks due to the number of employees that continue to work remotely, which remains at levels higher than prior to the COVID-19 pandemic as a result of changes in the workplace and to management and employee expectations. Increased levels of remote access create additional opportunities for cybercriminals to exploit vulnerabilities, and employees may be more susceptible to phishing and social engineering attempts. In addition, technological resources may become strained due to the number of remote users.

Read in the earlier 10-K, filed Feb 25, 2025 ↗

Any cybersecurity incidents affecting the information technology systems of third parties that provide services to the Company could have a material adverse effect on the Company's operations.

Read in the earlier 10-K, filed Feb 25, 2025 ↗

In addition, third parties to whom the Company outsources certain services or functions may process personal data, or other confidential information of the Company. A cybersecurity incident affecting these third parties, like the AMCA Incident, could also harm the Company's business, results of operations and reputation.

Read in the earlier 10-K, filed Feb 25, 2025 ↗

restrictions, tariffs, embargoes, product authenticity, cybersecurity regulation, and environmental standards (e.g.,

Read in the earlier 10-K, filed Feb 14, 2025 ↗

related systems. We face the risk of a security breach, whether through cyber-attack on our IT infrastructure, insider

Read in the earlier 10-K, filed Feb 14, 2025 ↗

particularly through cyber-attack or cyber intrusion, including by computer hackers, foreign governments and cyber

Read in the earlier 10-K, filed Feb 14, 2025 ↗

implemented various measures to manage the risk of a security breach or disruption. See “Item 1C. Cybersecurity"

Read in the earlier 10-K, filed Feb 14, 2025 ↗

in this Report for further discussion of our risk management and strategy related to cybersecurity threats.

Read in the earlier 10-K, filed Feb 14, 2025 ↗

Our efforts and measures have not been entirely effective in the case of every cyber security incident, but no

Read in the earlier 10-K, filed Feb 14, 2025 ↗

systems and facilities remain potentially vulnerable because attempted security breaches, particularly cyber-

Read in the earlier 10-K, filed Feb 14, 2025 ↗

attacks and cyber intrusions, or disruptions will occur in the future, and because the techniques used in such

Read in the earlier 10-K, filed Feb 14, 2025 ↗

preventative measures and future cyber security incidents may have a material negative impact on us. A security

Read in the earlier 10-K, filed Feb 14, 2025 ↗

subcontractors or other third parties to minimize the impact of cyber threats, other security threats or business

Read in the earlier 10-K, filed Feb 14, 2025 ↗

disruptions. These third parties may have varying levels of cybersecurity expertise and safeguards. Our commercial

Read in the earlier 10-K, filed Feb 14, 2025 ↗

personal and proprietary information. However, we remain at risk of a data breach due to the intentional or

Read in the earlier 10-K, filed Feb 14, 2025 ↗

processes, which may not be as sophisticated as ours, or a cyber-attack on a third party’s information network and

Read in the earlier 10-K, filed Feb 14, 2025 ↗

systems, command, control, computers, communications, cyber, ISR, homeland security applications and aircraft

Read in the earlier 10-K, filed Feb 14, 2025 ↗

cybersecurity exposures, the amount of our insurance coverage may not be adequate to cover all claims or liabilities,

Read in the earlier 10-K, filed Feb 14, 2025 ↗

Similarly, in November 2022, hackers exploited weaknesses in the security architecture of the FTX Trading digital asset exchange and reportedly stole over $400 million in digital assets from customers. A successful security breach or cyberattack could result in:

Read in the earlier 10-K, filed Sep 26, 2025 ↗

In addition, the increased use of employee-owned devices for communications as well as work-from-home arrangements present additional operational risks to our technology systems, including increased risks of cyber-attacks. Further, like other companies in the retail industry, we have in the past experienced, and we expect to continue to experience, cyber-attacks, including phishing, and other attempts to breach, or gain unauthorized access to, our systems. To date, these attacks have not had a material impact on our operations, but they may have a material impact in the future.

Read in the earlier 10-K, filed Mar 27, 2025 ↗

•Our bitcoin lending arrangements expose us to risks of borrower default, operational failures and cybersecurity threats;

Read in the earlier 10-K, filed Mar 3, 2025 ↗

Our bitcoin lending arrangements expose us to risks of borrower default, operational failures and cybersecurity threats.

Read in the earlier 10-K, filed Mar 3, 2025 ↗

–complexities of compliance with employment laws, various proposed and enacted data privacy laws, and cybersecurity rules in numerous jurisdictions.

Read in the earlier 10-K, filed Feb 14, 2025 ↗

any future incident, and the cost and operational expense of implementing, maintaining and enhancing protective measures to guard against increasingly complex and sophisticated cyber threats could increase significantly. Moreover, as cyberattacks increase in frequency and magnitude around the world, we may be unable to obtain cybersecurity insurance in the amounts and on terms we view as appropriate and favorable for our operations.

Read in the earlier 10-K, filed Feb 5, 2025 ↗

Furthermore, our information technology systems, and the systems of our customers, vendors, suppliers, and other third-party service providers, are subject to cyber-attacks or other security incidents including computer viruses or other malicious codes, phishing attacks, unauthorized access attempts, cyber extortion, business email compromise, deepfake or social engineering schemes, denial of service attacks, hacking, ransomware, or other cyberattacks attempting to exploit vulnerabilities. Cybercriminals have increasingly demonstrated advanced capabilities, such as use of zero-day vulnerabilities, and rapid integration of new technology such as generative artificial intelligence. Continued geographical turmoil, including the ongoing conflicts between Russia and Ukraine, the war in the Middle East, and rising tensions between China and Taiwan, has heightened the risk of cyberattack. Such incidents could result in unauthorized access to information including customer, consumer or other company

Read in the earlier 10-K, filed Jan 23, 2025 ↗

We are dependent on information technology and our systems and infrastructure face certain risks, including cybersecurity risks and data leakage risks.

Read in the earlier 10-K, filed Feb 21, 2025 ↗

including the risk of legal claims or proceedings, investigations or enforcement actions by U.S., state, or foreign regulators; liabilities or penalties under applicable laws and regulations, including privacy laws and regulations in the U.S. and other jurisdictions; interference with the Company’s operations; the incurrence of remediation costs; loss of intellectual property protection; the loss of customer, supplier, or employee relationships; and damage to the Company’s reputation, any of which could have a material adverse effect the Company’s business. Although the Company maintains insurance coverage for various cybersecurity and business continuity risks, there can be no guarantee that all costs, damages, expenses or losses incurred will be fully insured nor reimbursed through insurance recoveries.

Read in the earlier 10-K, filed Feb 5, 2025 ↗

Privacy, cyber security, and data protection are becoming increasingly significant issues. To address these issues, the Standing Committee of the National People’s Congress promulgated the Cyber Security Law of the People’s Republic of China (the “Cyber Security Law”), which took effect on June 1, 2017. The Cyber Security Law sets forth various requirements relating to the collection, use, storage, disclosure and security of data, among other things. On June 10, 2021, the National People’s Congress passed the Data Security Law of the People’s Republic of China (the “Data Security Law”), which became effective on September 1, 2021. The Data Security Law is the first comprehensive data security legislation in China, which becomes a key supplement to the Cyber Security Law and aims to regulate a wide range of issues in relation to the collection, storage, processing, use, provision, transaction and publication of any kind of data. Various Chinese agencies are expected to issue additional regulations in the future to define these requirements more precisely. For example, the Personal Information Protection Law (“PIPL”), took effect on November 1, 2021. PIPL is aimed at protecting and controlling the use and transfer of personal data in China. There is significant uncertainty in how regulators will interpret and enforce the law, and it contains provisions that allow substantial government oversight and include fines for failure to obtain required approval from China’s cyber and data protection regulators for cross-border transfers of personal data.

Read in the earlier 10-K, filed Mar 3, 2025 ↗

Effective May 25, 2018, the European Union (“EU”) implemented the General Data Protection Regulation (“GDPR”), a broad data protection framework that expands the scope of EU data protection law to non-European Union entities that process, or control the processing of, the personal data of EU subjects. The GDPR allows for the imposition of fines and corrective action on entities that improperly use, disclose or secure the personal data of EU subjects, including through a data security breach. In addition, an increasing number of states in the U.S. have enacted laws containing similar requirements to the GDPR for businesses collecting or processing personal data. For example, the State of California enacted the California Consumer Privacy Act of 2018 (“CCPA”), which was significantly amended by the California Privacy Rights Act, and sets forth comprehensive privacy and security obligations regarding the collection and processing of personal data of eligible California residents. Other states have, or are expected to, enact similar or more expansive legislation regarding the collection and processing of personal data. These regulatory requirements may increase our costs of compliance. Any failure to fully comply with the Cyber Security Law, the Data Security Law, PIPL, GDPR, CCPA, and other applicable laws and regulations could lead to significant fines and regulatory corrective actions, along with reputational damage or third-party lawsuits, which could adversely affect our business and results of operations. In addition, data security breaches experienced by us could result in the loss of trade secrets or other intellectual property, public disclosure of sensitive commercial data, and the exposure of personal data (including sensitive personal data) of our employees, customers, suppliers and others. Such incidents could subject us to significant monetary damages, regulatory enforcement actions and/or criminal prosecution, and cause us to lose customers and their related revenue in the future.

Read in the earlier 10-K, filed Mar 3, 2025 ↗

The development and use of GenAI and other AI technologies (collectively, AI Technologies), along with an uncertain regulatory landscape, pose risks that could harm our reputation, expose us to liability or otherwise adversely affect our business. The integration of AI Technologies into our and our vendors’ systems (potentially without the vendor disclosing such use to us) subjects us to the risk that the providers of AI Technologies may not meet existing or rapidly evolving regulatory or industry standards with respect to privacy and data protection. Further, bad actors around the world use increasingly sophisticated methods, including the use of AI technologies, to engage in illegal activities involving the theft and misuse of personal information, confidential information and intellectual property. These factors may lead to breaches of security or privacy, reduced levels of service or experience, loss of intellectual property or exposure of confidential or proprietary information. Sophisticated cyber-attacks, including those using AI, could exacerbate these risks. Additionally, GenAI’s potential for producing false or misleading outputs, reflecting biases or generating content that may not be subject to IP protection or that infringes proprietary rights of others, poses additional risks to our business. Regulatory changes or reinterpretations could introduce new compliance risks, including potential government enforcement actions or civil lawsuits. Our competitors’ faster or more effective adoption of AI could also disadvantage us.

Read in the earlier 10-K, filed Feb 21, 2025 ↗

We are subject to numerous political, economic, legal, tax, operational, franchise and other risks that are inherent in operating in many countries, including risks of possible nationalization, expropriation, price controls, capital controls, exchange controls, increased taxes and levies, cybersecurity, data transfer and outsourcing restrictions, regulatory scrutiny regarding the use of new technologies, prohibitions on certain

Read in the earlier 10-K, filed Feb 21, 2025 ↗

While we attempt to mitigate cybersecurity risks by employing a number of proactive measures, including mandatory quarterly ongoing employee training and awareness, technical security controls, enhanced data protection, and maintenance of backup and protective systems, our systems remain potentially vulnerable to cybersecurity threats, any of which could have a material adverse effect on our business. We believe our mitigation measures reduce, but cannot eliminate, the risk of a cybersecurity incident. Despite any precautions we may take, a cybersecurity incident could harm our reputation and

Read in the earlier 10-K, filed Feb 7, 2025 ↗

Our business and operations would be adversely impacted in the event of a failure or interruption of our information technology infrastructure or as a result of a cybersecurity attack.

Read in the earlier 10-K, filed Mar 28, 2025 ↗

Our role in the global marketplace positions us at greater risk for a cyberattack.

Read in the earlier 10-K, filed Feb 21, 2025 ↗

Our systems and operations are vulnerable to damage, misappropriation or disruption from security breaches. Some of these threats include attacks from foreign governments, hacktivists, insiders and criminal organizations. Foreign governments may seek to obtain a foothold in U.S. critical infrastructure, hacktivists may seek to deploy denial of service attacks to bring attention to their cause, insiders may pose a risk of human error or malicious activity and criminal organizations may seek to profit by gaining control of company systems or accounts or from stolen data via ransomware or other means, such as social engineering, including deepfake scams, compromised business email or other methods. Our hybrid work model and our global footprint elevate cybersecurity and operational risks, particularly in geographies with adversary nation-states and/or unreliable law enforcement. Given our position in the global securities industry, we may be more likely than other companies to be a direct target, or an indirect casualty, of such events.

Read in the earlier 10-K, filed Feb 21, 2025 ↗

While we continue to employ and invest resources to monitor our systems and protect our infrastructure, these measures may prove insufficient due to the continuously evolving nature of threat activity. Any system issue, whether as a result of an intentional breach, collateral damage from a cybersecurity incident involving our supply chain vendors, a negligent or malicious act by an insider, or the use of AI by bad actors, including the use of such tools to engage in social engineering or similar activities, or due to a cybersecurity breach of a customer that results in a loss of our data or

Read in the earlier 10-K, filed Feb 21, 2025 ↗

compromises our systems or those of our other customers utilizing the same products, could damage our reputation and result in: a loss of customers; disrupted customer relationships; the loss of our intellectual property or sensitive data; lower trading volumes or values, significant liabilities, litigation or regulatory fines; or otherwise have a negative impact on our business, our products and services, financial condition and operating results. There can be no assurance we will be able to identify and mitigate every incident involving cybersecurity attacks, breaches or incidents. A system breach may go undetected for an extended period of time.

Read in the earlier 10-K, filed Feb 21, 2025 ↗

Expanded cybersecurity regulations, and increased cybersecurity infrastructure and compliance costs, may adversely impact our results of operations.

Read in the earlier 10-K, filed Feb 21, 2025 ↗

As cybersecurity threats continue to increase in frequency and sophistication, and as the domestic and international regulatory and compliance structure related to information, cybersecurity, data privacy, resiliency and data usage becomes increasingly complex and exacting, we may be required to devote significant additional resources to strengthen our cybersecurity capabilities, and to identify and remediate any security vulnerabilities. Compliance with laws and regulations concerning cybersecurity, data privacy, resiliency and data usage could result in significant expense, and any failure to comply could result in proceedings against us by regulatory authorities or other third parties. Costs for bolstering cybersecurity capabilities, and increased cybersecurity and data privacy compliance costs, could adversely impact our business, financial condition and operating results. Additionally, our clients increasingly demand rigorous contractual, certification and audit provisions regarding cybersecurity, data protection and data usage, which may also increase our overall compliance burden and costs in meeting such obligations.

Read in the earlier 10-K, filed Feb 21, 2025 ↗

We have made, and are continuing to make, significant investments in AI including generative AI, to, among other things, develop new products or features for our existing products, including our anti-financial crime, equity trading, investor relations, sustainability and investment analytics solutions, and to enhance and refine our internal business operations. As AI is a new and evolving technology in the early stages of commercial use, there are significant risks involved in the development and deployment of AI, and there can be no assurance that the use of AI will enhance our products or services or augment our business or operating results. Market acceptance of AI technologies is uncertain, and we may be unsuccessful in our product development efforts. Moreover, our AI-related product initiatives and offerings, or use in our internal business operations, may give rise to risks related to harmful content, accuracy, bias, discrimination, intellectual property infringement, the ability to obtain intellectual property protection, misappropriation or leakage of intellectual property, defamation, data privacy, and cybersecurity, among others. In addition, these risks include the possibility of the introduction of new or enhanced laws or regulations or novel enforcement of existing laws to uses of AI, for which compliance may be costly and burdensome or involve changes to our business practices or products, litigation or other legal liability, or additional oversight, audits or enforcement under existing laws or regulations. The use of AI may also give rise to ethical concerns or negative public perceptions, which may cause brand or reputational harm. Additionally, our competitors may be developing their own AI products and technologies, which may be superior in features or functionality, or cost, to our offerings. Any of these factors could adversely affect our business, reputation, or operating results.

Read in the earlier 10-K, filed Feb 21, 2025 ↗

Our access to cloud service provider infrastructure could be limited by a number of events, including technical or infrastructure failures, natural disasters or cybersecurity attacks. As we continue to grow our SaaS businesses, our dependency on the continuing operation and availability of these cloud service providers increases. If our cloud services from third party providers are unavailable to us for any reason, or there are cloud service disruptions or a delay or inability to access our exchanges, platforms or certain of our cloud products or features, such unavailability or delays may adversely affect our clients, which could significantly impact our reputation, operations, business, and financial results.

Read in the earlier 10-K, filed Feb 21, 2025 ↗

Our business operates certain systems that may be considered “critical infrastructure” under certain regulations and licenses or sells certain systems or services to customers that are used by customers in their role as providers of critical infrastructure or to fulfill certain core business requirements or process certain sensitive data. New cybersecurity, privacy, data sovereignty, and resiliency regulations may impact the requirements and cost of delivery for impacted systems and services and, in the event of an incident, increase the cost and complexity of our response and the potential financial and reputation impact from fines or private litigation. These regulations may also impact customer decision making and conditions on contracting for our services.

Read in the earlier 10-K, filed Feb 21, 2025 ↗

Moreover, as we integrate AI into our operations, there may be increased cybersecurity and privacy risks, including the risk of unauthorized or misuse of AI tools, and threat actors may leverage AI to engage in automated, targeted and coordinated attacks against our systems.

Read in the earlier 10-K, filed Jul 17, 2025 ↗

Cyber threats, both on premises and in the cloud, are complex, continuous and evolving and include, but are not limited to: malicious software, destructive malware, ransomware, targeting by more advanced and persistent

Read in the earlier 10-K, filed Jan 30, 2025 ↗

These outcomes could damage our reputation, harm our business, and lead to significant liabilities. Additionally, a cybersecurity incident or loss of personal information has in the past and could in the future result in remediation costs, disruption of internal operations, increased cybersecurity protection costs, significant fines, and/or lost revenues.

Read in the earlier 10-K, filed Jun 9, 2025 ↗

In the U.S., there are numerous federal, state and local data privacy and security laws and regulations governing the collection, sharing, use, retention, disclosure, security, storage, transfer and other processing of personal information. At the federal level, we are subject to, among other laws and regulations, the rules and regulations promulgated under the authority of the Federal Trade Commission and the Gramm-Leach-Bliley Act. Moreover, the U.S. Congress has considered, and may in the future consider, various proposals for more comprehensive data privacy and security legislation, to which we may be subject if enacted. At the state level, we are subject to laws and regulations such as the CCPA. Numerous other states also have enacted, or are in the process of enacting or considering, comprehensive state-level data privacy and security laws and regulations that share similarities with the CCPA. Moreover, laws in all 50 U.S. states require businesses to provide notice under certain circumstances to consumers whose personal information has been disclosed as a result of a data breach.

Read in the earlier 10-K, filed Feb 24, 2025 ↗

technologies or compromise information security. System resilience and/or redundancy, and the Company’s disaster recovery and business continuity planning, may not be sufficient to address all potential cyber events or other disruptions.

Read in the earlier 10-K, filed Aug 6, 2025 ↗

The oil and gas industry is increasingly dependent on information technology (IT) and industrial control systems (ICS) to conduct certain exploration, development and production activities. Occidental relies on digital and industrial control systems, related infrastructure, technologies and networks to run its businesses and to control and manage its oil and gas, chemical, marketing and pipeline operations. Use of the internet, cloud services, mobile communication systems and other public networks exposes Occidental’s businesses to the risk of cyber attacks, which have escalated in recent years and which include, but are not limited to:

Read in the earlier 10-K, filed Feb 18, 2025 ↗

In addition, Occidental has exposure to cybersecurity risks where its data and proprietary information are collected, hosted, and/or processed by third-party cloud and service providers. Occidental’s risks may be exacerbated by a delay or failure to detect a cybersecurity incident or understand the full extent of such incident notwithstanding its risk management processes and controls. Occidental faces risks associated with new and ever-increasing phishing technologies and hidden malware as well as risks associated with electronic data proliferation and technology digitization. Occidental also faces increased risk with the growing sophistication of generative artificial intelligence capabilities, which may improve or expand the existing capabilities of cybercriminals described above in a manner Occidental cannot predict at this time.

Read in the earlier 10-K, filed Feb 18, 2025 ↗

Information and industrial control technology system failures, network disruptions and breaches of data security could disrupt Occidental’s operations by causing delays, impeding processing of transactions and reporting financial results, or leading to the unintentional disclosure of Company, partner, customer or employee information that could damage its reputation. A cyber attack on Occidental’s information or industrial control systems and related infrastructure, or those of its business associates, suppliers, contractors, joint venture partners or third-party service providers, could negatively impact Occidental’s operations in a variety of ways, including, but not limited to:

Read in the earlier 10-K, filed Feb 18, 2025 ↗

If in the future Occidental’s cybersecurity measures are compromised or prove insufficient, the potential consequences to Occidental’s businesses and the communities in which it operates could be significant. Occidental could suffer interruptions in its ability to manage its operations and damage to its reputation. As cyber attacks continue to evolve in magnitude and sophistication, Occidental may be required to expend additional resources in order to continue to enhance its cybersecurity measures and to investigate and remediate any digital and operational systems, related infrastructure, technologies and network security vulnerabilities, which would increase its costs. Occidental also may incur large expenditures to investigate or remediate, to recover data, to repair or replace networks or information systems or to protect against similar future events. Disruption to Occidental’s operations, damage to its reputation, and a system failure or data security breach, or a series of such failures or breaches, could materially adversely affect its businesses, financial condition, results of operations or cash flows.

Read in the earlier 10-K, filed Feb 18, 2025 ↗

The Utility maintains cyber liability insurance that covers certain losses and damages caused by cyber incidents, but adequate insurance may not continue to be available at rates the Utility believes are reasonable, or the costs of responding to and recovering from a cyber incident may not be covered by insurance or recoverable through rates.

Read in the earlier 10-K, filed Feb 13, 2025 ↗

subject to failure, disruption or unavailability, and increased vulnerability to cyberattacks and other cyber incidents.

Read in the earlier 10-K, filed Feb 4, 2025 ↗

Many different regulatory bodies govern our company. We are required to comply with securities laws; insurance regulations; employee benefit plan regulations; financial services regulations; U.S. and international tax regulations; environmental, social and governance (“ESG”) requirements; and cybersecurity and privacy regulations. Complying with the various regulations can increase our cost of doing business, limit our available capital or impact how we do business. We could also face potential fines or reputational risk if we do not comply. In addition, changes in tax laws can reduce sales of certain tax-advantaged products or increase our operating expenses. Changes in accounting standards may adversely impact reported results of operations and financial condition. Litigation and tax audits can increase costs and create adverse publicity.

Read in the earlier 10-K, filed Feb 19, 2025 ↗

Our safeguards may not, however, be effective in mitigating the impact of service disruptions or other failures of these information technology networks and systems. Failure to timely respond and mitigate security incidents, could result in wide-ranging business interruptions. Such security incidents could place us at a competitive disadvantage; result in financial impacts, a loss of revenue, assets, including our intellectual property, personal or other sensitive data; result in litigation and regulatory action including significant fines or penalties; impact our operations; cause damage to our reputation and that of our brands; and result in significant remediation and other costs. See Item 1C. Cybersecurity for a description of our cybersecurity risk management and strategy and governance.

Read in the earlier 10-K, filed Feb 6, 2025 ↗

liability insurance policy to address many of these risks, such policy may not be sufficient to prevent a cybersecurity incident or attack from resulting in a material adverse effect on our business, reputation, financial condition, or operating results.

Read in the earlier 10-K, filed Feb 6, 2025 ↗

Following the onset of the COVID-19 pandemic, many employees transitioned to a remote or hybrid work environment, which has increased risks associated with our information technology systems and networks. These increased risks include cyber-attacks, computer viruses, disruptions, or shutdowns that could result in a failure to protect our information technology systems and data integrity.

Read in the earlier 10-K, filed Feb 21, 2025 ↗

and damage to our reputation. Threats to our systems and operations continue to emerge as new ways to compromise components of our systems or networks are developed. Additionally, cybersecurity risks also threaten our supply chains, including aspects that are not under our control, such as the incorporation of opensource software in systems or software that we use, that despite our efforts do not meet our current security standards.

Read in the earlier 10-K, filed Feb 13, 2025 ↗

•Cybersecurity incidents and other disruptions could compromise our information and expose us to liability, which would cause our business and reputation to suffer.

Read in the earlier 10-K, filed Feb 21, 2025 ↗

Cybersecurity incidents and other disruptions could compromise our information and expose us to liability, which would cause our business and reputation to suffer.

Read in the earlier 10-K, filed Feb 21, 2025 ↗

Instability in geopolitical matters could have a material adverse effect on our results of operations and financial condition. The macroeconomic environment in the United States is susceptible to global events and volatility in financial markets. For example, trade negotiations between the United States and other nations remain uncertain and could adversely impact economic and market conditions for our and our clients and counterparties. Global political and military conflicts, including the ongoing conflicts in the Ukraine and the Middle East, present destabilizing forces, including higher and more volatile commodity and food prices, which may cause international and domestic economic deterioration. Financial markets may be adversely affected by the current or anticipated impact of military conflicts, including the conflicts in the Ukraine and the Middle East, terrorism or other geopolitical events (including China-Taiwan and U.S.-China relations), which could cause higher inflation. Any of the above consequences could have significant negative effects on the U.S. economy, and, as a result, our operations and earnings. We could also experience more numerous and aggressive cyber-attacks launched by or under the sponsorship of one or more of the adversaries in such a conflict.

Read in the earlier 10-K, filed Feb 21, 2025 ↗

development or marketing of certain products or services, or increase the costs of offering them to customers. For more information concerning our legal and regulatory obligations with respect to privacy and cybersecurity, please see the “Privacy and Cybersecurity” discussion within Item 1. “Business” and the “Technology Risks” discussion within in Item 1. “Risk Factors.”

Read in the earlier 10-K, filed Feb 21, 2025 ↗

If our third-party digital asset-focused custodian experiences a security breach or cyber-attack and unauthorized parties obtain access to our Bitcoin, we may lose some or all of our Bitcoin and our financial condition and results of operations could be materially adversely affected.

Read in the earlier 10-K, filed Feb 28, 2025 ↗

Our business and financial performance may be adversely affected by cyber-attacks on information technology (IT) infrastructure and products, as well as changes in cybersecurity regulations. Our business may be impacted by disruptions to our own or third-party IT infrastructure, and the products and services that we provide our customers are also at risk of being adversely affected by cyber-attacks. Like other companies, we regularly experience cyber-based attacks. Cybersecurity threats are continuously evolving and may have an impact on our customers, suppliers, subcontractors, and other third parties with whom we do business routinely, both on premises and in the cloud, attempting to gain unauthorized access to our confidential, proprietary, or otherwise protected information, classified information, or personal data or other information relating to our employees, customers, and other third parties, or to disrupt our systems or the systems of third parties. Cybersecurity threats also include attacks targeting the security, confidentiality, integrity, and/or availability of the hardware, software, and information installed, stored, or transmitted in our products, including after the purchase of those products and when they are

Read in the earlier 10-K, filed Feb 3, 2025 ↗

Until we can generate a sufficient amount of revenue to finance our capital needs, which we may never achieve, we expect to finance our cash needs primarily through public or private equity financings or conventional debt financings. We cannot be certain that additional funding will be available on acceptable terms, or at all. If we are not able to secure additional funding when needed to support our business growth and to respond to business challenges, track and comply with applicable laws and regulations, develop new technology and services or enhance our existing offering, improve our operating infrastructure, enhance our information security systems to combat changing cyber threats and expand personnel to support our business, we may have to delay or reduce the scope of future growth initiatives. Moreover, any additional equity financing that we obtain may dilute the ownership held by our existing shareholders. The economic dilution to our shareholders will be significant if our stock price does not materially increase, or if the effective price of any sale is below the price paid by a particular shareholder. Any debt financing could involve substantial restrictions on activities and creditors could seek additional pledges of some or all of our assets. If we fail to obtain additional funding as needed, we may be forced to cease or scale back operations, and our results, financial conditions and stock price would be adversely affected.

Read in the earlier 10-K, filed Mar 14, 2025 ↗

In addition, the new EU-wide General Data Protection Regulation, or GDPR, became applicable on May 25, 2018, replacing the data protection laws of each EU member state. The GDPR implemented more stringent operational requirements for processors and controllers of personal data, including, for example, expanded disclosures about what and how personal information is to be used, limitations on retention of information, increased requirements to erase an individual’s information upon request, mandatory data breach notification requirements and higher standards for data controllers to demonstrate that they have obtained valid consent from individuals to process their personal data (or reliance on another appropriate legal basis) for certain data processing activities. It also significantly increased penalties for noncompliance, including where the Company may act as a data processor.

Read in the earlier 10-K, filed Mar 14, 2025 ↗

Although we continue to review and improve our policies and procedures with respect to data protection and privacy to ensure compliance with applicable laws, rules and regulations, if our privacy or data security measures fail to comply with applicable current or future laws and regulations, we may be subject to fines, litigation, regulatory investigations, enforcement notices requiring us to change the way we use personal data or our marketing practices, or other liabilities, such as compensation claims by individuals affected by a personal data breach, as well as negative publicity and a potential loss of business. Compliance with data protection and privacy laws and regulations will become more complex, time intensive and costly as we grow, particularly when we begin to rely on the movement of data across national boundaries.

Read in the earlier 10-K, filed Mar 14, 2025 ↗

SharpLink has established policies and processes for assessing, identifying and managing material cybersecurity risks, and have integrated these processes into our overall risk-management processes. We have also established policies and processes for managing and responding to material cybersecurity incidents.

Read in the earlier 10-K, filed Mar 14, 2025 ↗

We routinely assess material cybersecurity risks, including potential unauthorized occurrences on, or conducted through, our information systems that may compromise the confidentiality, integrity or availability of those systems or information maintained in them. We devote appropriate resources and designate members of our management, including our Chief Executive Officer and Chief Financial Officer, to manage the risk assessment and mitigation process.

Read in the earlier 10-K, filed Mar 14, 2025 ↗

Employees are provided specific guidance to mitigate the risk of a cybersecurity attack. This guidance includes safeguards over confidential data, being aware of suspicious emails, choosing and changing passwords, protection of Company issued and use of personal devices, managing large data transfers and use of VPNs when outside the office. Employees are directed to immediately contact either the Chief Financial Officer and Vice President of Affiliate Marketing if they encounter any suspicious activity.

Read in the earlier 10-K, filed Mar 14, 2025 ↗

We also require appropriate third-party service providers to certify that they can implement and maintain appropriate security measures, consistent with all applicable laws, in connection with their work for us, and to promptly report any suspected breach of their security measures that may affect our company. We oversee and identify risks from cybersecurity threats associated with our use of service providers through an onboarding vendor risk management program, including an inherent risk assessment.

Read in the earlier 10-K, filed Mar 14, 2025 ↗

One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing our strategic risk exposure, and our executive officers are responsible for day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk-oversight function as a whole, as well as through the Audit Committee.

Read in the earlier 10-K, filed Mar 14, 2025 ↗

Our Chief Financial Officer and Vice President of Affiliate Marketing are responsible for assessing and managing material risks from cybersecurity threats, as well as managing, responding to and reporting material cyber incidents if any occur. They will provide periodic briefings, as required, to the Audit Committee and to the Board of Directors about our cybersecurity risks and activities, including cybersecurity incidents and responses, cybersecurity systems testing, third-party activities and related topics. In addition, our policies for managing and responding to cybersecurity incidents include procedures for appropriate escalations to our Audit Committee Chair.

Read in the earlier 10-K, filed Mar 14, 2025 ↗

Although we have designed our cybersecurity program and governance procedures above to mitigate cybersecurity risks, we face unknown cybersecurity risks, threats and attacks. To date, these risks, threats or attacks have not had a material impact on our operations, business strategy or financial results, but we cannot provide assurance that they will not have a material impact in the future. See the section entitled “Risk Factors” included elsewhere in this Annual Report for further information. We continuously work to enhance our cybersecurity risk management program.

Read in the earlier 10-K, filed Mar 14, 2025 ↗

•data privacy and cybersecurity risks unique to the conduct of business in China; and

Read in the earlier 10-K, filed Nov 20, 2024 ↗

As a retailer that is dependent upon consumer discretionary spending, our results of operations are sensitive to changes in or uncertainty about macroeconomic conditions. A continued economic downturn or recession, or slowing or stalled recovery therefrom, may have a material adverse effect on our business, financial condition, or results of operations. Our customers may have less money for discretionary purchases and may stop or reduce their purchases of our products or switch to our or our competitors’ lower-priced products as a result of various factors, including job loss, inflation, changes in prevailing interest rates, higher taxes, reduced access to credit, changes in federal economic policy, a global health pandemic, international trade disputes, or geopolitical instability. For example, reductions and continuing volatility in China may be caused by, among other things: changes in consumer spending behaviors, including those caused by a decrease in consumer confidence in general macroeconomic conditions, a decrease in consumer discretionary spending, increasing competition in the market, lower-priced competitor product offerings, negative economic impacts related to the rising geopolitical tensions between China and Taiwan, economic policies or sanctions, heightened data and cybersecurity risks associated with conduct of business in China, and food-safety related matters. We may also experience a reduction or increased volatility in demand for our products in connection with a global health pandemic. Decreases in customer traffic and/or average value per transaction without a corresponding decrease in costs would put downward pressure on margins and could have a material negative impact on our financial results. There is also a risk that if negative economic conditions or uncertainty persist for a long period of time or worsen, consumers may make long-lasting changes to their discretionary purchasing behavior, including less frequent discretionary purchases on a more permanent basis or enduring changes in behavior that precipitate a more general downturn in the restaurant industry. These and other macroeconomic factors could have an adverse effect on our sales, profitability, or development plans, which could harm our results of operations and financial condition.

Read in the earlier 10-K, filed Nov 20, 2024 ↗

In the United States, the California Consumer Privacy Act (“CCPA”) requires, among other things, covered companies to provide new disclosures to California consumers and allows such consumers to exercise certain rights in connection with their personal information, such as the right to opt-out of certain sales of personal information. The CCPA also provides for civil penalties for violations as well as a private right of action for data breaches that may increase data breach litigation. Further, the California Privacy Rights Act, which became effective in January 2023, significantly modified the CCPA to include additional compliance obligations. Since the CCPA was first passed, 19 other states have enacted similar data privacy legislation, eight of which are in effect as of the end of 2024. In addition, a number of other states have passed or are considering additional privacy laws, including laws on health data and biometric data that are in effect, or are expected to take effect in the near future. These state privacy laws will require us to incur additional costs and expenses in our efforts to comply.

Read in the earlier 10-K, filed Nov 20, 2024 ↗

Many of our information technology systems (whether cloud-based or hosted in proprietary servers), including those used for our point-of-sale, web and mobile platforms, online and mobile payment systems, delivery services, rewards programs, and administrative functions, contain personal, financial, or other information that is entrusted to us by our customers, business partners, and employees. Many of our information technology systems also contain Starbucks proprietary and other confidential information related to our business, such as business plans and product development initiatives and designs, and confidential information about third parties, such as licensees and business partners. Similar to many other retail companies and because of the prominence of our brand, we have in the past experienced, and we expect to continue to experience, cyber-attacks, including phishing, and other attempts to breach, or gain unauthorized access to, our systems and databases. To date, these attacks have not had a material impact on our operations, but we cannot provide assurance that they will not have an impact in the future. Our third-party providers’ and business partners’ information technology systems and databases are likewise subject to such risks. The number and frequency of these attempts varies from year to year and increases as the scale and scope of our technology footprint and digital operations increases. In addition, to conduct our business, we provide customer and employee data, as well as Starbucks proprietary information and other confidential information important to our business, to third parties, including licensees and business partners. Individuals performing work for Starbucks and such third parties also may access

Read in the earlier 10-K, filed Nov 20, 2024 ↗

some of this data, including on personally-owned digital devices. To the extent we, a third party, or such an individual were to experience a breach of our or their information technology systems that results in the unauthorized access, theft, use, destruction or other compromises of customers’ or employees’ data or confidential information of the Company stored in or transmitted through such systems, including through cyber-attacks or other external or internal methods, it could result in a material loss of revenues from the potential adverse impact to our reputation and brand, a decrease in our ability to retain customers or attract new ones, the imposition of potentially significant costs (including loss of data or payment for recovery of data) and liabilities, loss of business, loss of business partners and licensees, and the disruption to our supply chain, business, and plans. Unauthorized access, theft, use, destruction, or other compromises are becoming increasingly sophisticated and may occur through a variety of methods, including attacks using malicious code, vulnerabilities in software, hardware, or other infrastructure (including systems used by our supply chain), system misconfigurations, phishing, deepfakes, ransomware, malware, or social engineering. The rapid evolution and increased adoption of artificial intelligence technologies may intensify our cybersecurity risks. Our logging capabilities, or the logging capabilities of third parties, are not always complete or sufficiently granular, affecting our ability to fully understand the scope of security breaches.

Read in the earlier 10-K, filed Nov 20, 2024 ↗

Such security breaches also could result in a violation of applicable U.S. and international privacy, cyber, and other laws or trigger data breach notification laws, including new disclosure rules promulgated by the SEC, and subject us to private consumer, business partner or licensee, or securities litigation and governmental investigations and proceedings, any of which could result in our exposure to material civil or criminal liability. These risks also exist in acquired businesses, joint ventures, or companies we invest in or partner with that use separate information systems or that have not yet been fully integrated into our information systems.

Read in the earlier 10-K, filed Nov 20, 2024 ↗

Significant capital investments and other expenditures could also be required to investigate security incidents, remedy cybersecurity problems, recuperate lost data, prevent future compromises, and adapt systems and practices to react to the changing threat environment. These include costs associated with notifying affected individuals and other agencies, additional security technologies, trainings, personnel, experts, and credit monitoring services for those whose data has been breached. These costs, which could be material, could adversely impact our results of operations in the period in which they are incurred, including by interfering with the pursuit of other important business strategies and initiatives, and may not meaningfully limit the success of future attempts to breach our information technology systems.

Read in the earlier 10-K, filed Nov 20, 2024 ↗

Media or other reports of existing or perceived security vulnerabilities in our systems, or those of our third-party business partners or service providers, can also adversely impact our brand and reputation and materially impact our business. Additionally, the techniques and sophistication used to conduct cyber-attacks and compromise information technology systems, as well as the sources and targets of these attacks, change frequently and are often not recognized until such attacks are launched or have been in place for a period of time. The rapid evolution and increased adoption of artificial intelligence technologies by attackers amplifies these concerns. We continue to make significant investments in technology, third-party services, and personnel to develop and implement systems and processes that are designed to anticipate cyber-attacks and to prevent or minimize breaches of our information technology systems or data loss, but these security measures cannot provide assurance that we will be successful in preventing such breaches or data loss.

Read in the earlier 10-K, filed Nov 20, 2024 ↗

services, errors or improper use by our employees or third-party service providers, or a breach in the security of these systems or platforms, including through cyber-attacks such as those that result in the blockage of our or our third-party business partners’ or service providers’ systems and platforms and those discussed in more detail in this risk factors section. If our incident response, disaster recovery, and business continuity plans do not resolve these issues in an effective and timely manner, they could result in an interruption in our operations and could cause material negative impacts to our product availability and sales, the efficiency of our operations, and our financial results. In addition, remediation of any problems with our systems and related customer support could result in significant, unplanned expenses.

Read in the earlier 10-K, filed Nov 20, 2024 ↗

Given the increasing complexity and sophistication of techniques used by bad actors to obtain unauthorized access to or disable information technology systems, and the fact that cyber-attacks are being made by groups and individuals with a wide range of expertise and motives, it is increasingly difficult to anticipate and defend against cyber-attacks, and a cyberattack could occur and persist for an extended period of time before being detected. Moreover, the extent of a particular cyber incident and the steps that we may need to take to investigate the incident may not be immediately clear, and it may take a significant amount of time before such investigation can be finalized and completed and reliable information about the incident is known. During the pendency of any such investigation, we may not know the extent of the harm or how best to remediate it, and we may be required to disclose incidents before their full extent is known.

Read in the earlier 10-K, filed Nov 20, 2024 ↗

Unauthorized access to or modification of, or actions disabling our ability to obtain authorized access to, our customers’ data, other external data, personal data, or our own data, as a result of a cyber incident, attack or exploitation of a security vulnerability, or loss of

Read in the earlier 10-K, filed Jan 22, 2025 ↗

Public health crises may negatively impact our workforce and operations, as well as those of our strategic partners, customers, suppliers and logistics providers. Impacts of public health crises may include, without limitation, closures of our manufacturing facilities; under-absorbed overhead; increased logistics, component and other costs; decreased demand for our products; and manufacturing challenges. Employee infections or government restrictions to contain the spread of infectious disease, like travel restrictions, quarantines, business shutdowns, or trade controls, could harm employees’ productivity and hinder operations in Flash Ventures’ factories or our other worksites and our business and results of operations as a whole. Further, global pandemics and other public health crises may cause financial market instability, credit issues, and increased cybersecurity and data privacy risks as more employees work remotely. The degree to which any public health crises ultimately impact our business will depend on many factors beyond our control, which are highly uncertain and cannot be predicted at this time.

Read in the earlier 10-K, filed Aug 21, 2025 ↗

•consolidating and integrating corporate, IT, cybersecurity, finance and administrative infrastructures;

Read in the earlier 10-K, filed Dec 19, 2024 ↗

•Security and data breaches, cyberattacks and other cybersecurity incidents involving Solventum’s information technology systems and infrastructure could disrupt or interfere with Solventum’s operations.

Read in the earlier 10-K, filed Feb 28, 2025 ↗

•Data Privacy and Cybersecurity Laws - Because Solventum is a business with a significant global footprint, compliance with evolving regulations and standards in data privacy and cybersecurity may result in increased costs, compliance challenges and the threat of increased regulatory enforcement activity. Solventum’s business relies on the secure electronic transmission, storage and hosting of sensitive information, including personal information, protected health information, financial information, intellectual property and other sensitive information related to our customers

Read in the earlier 10-K, filed Feb 28, 2025 ↗

We face evolving cybersecurity and technology resiliency risks associated with the energy grid, pipelines, storage and other infrastructure as well as the collection of personal, sensitive and confidential information.

Read in the earlier 10-K, filed Feb 25, 2025 ↗

In particular, we, like other financial services firms, will continue to face increasing cyber-threats,

Read in the earlier 10-K, filed Feb 13, 2025 ↗

•We could suffer a loss of revenue and increased costs, exposure to significant liability including legal and regulatory consequences, reputational harm and other serious negative consequences in the event of cyber-attacks, ransomware or other cyber security breaches or incidents that disrupt our operations, cause widespread outages, and/or result in unauthorized access to, or the loss, corruption, unavailability or dissemination of proprietary or confidential information of our customers or about us or other third parties.

Read in the earlier 10-K, filed Aug 1, 2025 ↗

We could suffer a loss of revenue and increased costs, exposure to significant liability including legal and regulatory consequences, reputational harm and other serious negative consequences in the event of cyber-attacks, ransomware or other cyber security breaches or incidents that disrupt our operations, cause widespread outages, and/or result in unauthorized access to, or the loss, corruption, unavailability or dissemination of proprietary or confidential information of our customers or about us or other third parties.

Read in the earlier 10-K, filed Aug 1, 2025 ↗

Despite the measures we and our vendors put in place designed to protect our computer equipment, data and systems, our customers, suppliers, employees or other third parties have been and may continue to be vulnerable to phishing and other forms of social engineering attacks, employee or contractor error, hacking, cyberattacks, ransomware and other malware, malfeasance, system error or other irregularities or incidents, including from attacks or breaches and incidents at third party vendors we utilize. In addition, the measures we and our vendors take may not be sufficient for all eventualities. Threat actors are increasingly using tools and techniques that circumvent controls, evade detection, and remove forensic evidence, which means that we and others may be unable to anticipate, detect, deflect, contain or recover from cyberattacks in a timely or effective manner. As AI capabilities improve and are increasingly adopted, we may be subject to cyberattacks created and/or augmented with AI. For example, attacks could be crafted with an AI tool to attack information systems by creating more effective phishing emails or social engineering or by exploiting vulnerabilities in electronic security programs utilizing false image or voice recognition, or could result from us or our customers, vendors or business partners incorporating the output of AI tools, such as malicious code from an AI-generated source code. Our network and storage applications, as well as those of our customers, business partners, and third-party providers, have been and may in the future be subject to unauthorized access by hackers or breached due to operator error, malfeasance or other system disruptions. Additionally, there have been and may continue to be significant supply chain attacks, and we cannot guarantee that our or our suppliers’ or other vendors’ systems, networks, or other components or infrastructure have not been compromised or do not contain exploitable defects, bugs or vulnerabilities. We anticipate that these threats will continue to grow in scope and complexity over time due to the development and deployment of increasingly advanced tools and techniques.

Read in the earlier 10-K, filed Aug 1, 2025 ↗

There can be no assurance that our cybersecurity management program and processes, including our policies, controls or procedures, will be implemented consistently, complied with or effective in protecting our systems and information.

Read in the earlier 10-K, filed Aug 1, 2025 ↗

The swift pace of technological change has led to a nonuniform and complex set of cybersecurity and data privacy laws, regulations, and standards. Meanwhile, the recent proliferation and rapid evolution of AI

Read in the earlier 10-K, filed Apr 23, 2025 ↗

provider training, organizational investments, incident response plans, tabletop exercises, technical defenses and defensive product software designs. The cost and operational consequences of implementing, maintaining and enhancing these measures could increase significantly to overcome increasingly intense, complex, and sophisticated cybersecurity threats.

Read in the earlier 10-K, filed Feb 18, 2025 ↗

The U.S. government may demand contract terms that are less favorable than standard arrangements with private sector customers and may have statutory, contractual or other legal rights to terminate contracts with the Company. For example, the U.S. government may have contract clauses that permit it to terminate any of the Company’s government contracts and subcontracts at its convenience, and procurement regulations permit termination for default based on the Company’s performance. In addition, changes in U.S. government budgetary priorities could lead to changes in the procurement environment, affecting availability of government contracting or funding opportunities. Changes in government procurement policy, priorities, regulations, technology initiatives and requirements, and/or contract award criteria may negatively impact the Company’s potential for growth in the government sector. Changes in government cybersecurity and system requirements could negatively impact the Company’s eligibility for the award of future contracts, negatively impacting the Company’s business and reputation.

Read in the earlier 10-K, filed Feb 18, 2025 ↗

Our risk management processes and procedures seek to appropriately balance risk and return and mitigate risks. We have established processes and procedures intended to identify, measure, monitor and control the types of risk to which we are subject, including credit risk, market risk, liquidity risk, operational risk, compliance risk, legal risk, strategic risk, and reputational risk. Credit risk is the risk of loss that arises when an obligor fails to meet the terms of an obligation. We are exposed to both consumer credit risk, from our customer loans, and institutional credit risk, principally from our partners. Market risk refers to the risk that a change in the level of one or more market prices, rates, indices, correlations or other market factors will result in losses for a position or portfolio. Liquidity risk is the risk that financial condition or overall safety and soundness are adversely affected by an inability, or perceived inability, to meet obligations and support business growth. Operational risk is the risk of loss arising from inadequate or failed processes, people or systems, external events (e.g., natural disasters and cybersecurity incidents), reputational matters and includes those risks as they relate directly to us as well as to third parties with whom we contract or otherwise do business. Compliance risk is the risk of non-compliance with applicable laws, rules, regulations, other supervisory guidance, and internal policies, and also includes any of those risks as they relate directly to us and our subsidiaries, as well as to third parties with whom we contract or otherwise do business. Legal risk is the risk of potential disputes, litigation, defective agreements or unprotected or infringed rights that can disrupt or otherwise negatively affect operations or condition of the organization. Strategic risk is the risk from changes in the business environment, improper implementation of decisions or inadequate responsiveness to changes in the business environment. Reputational risk is the risk arising from negative perception on the part of stakeholders, including customers, counterparties, shareholders, investors, rating agencies, regulators and employees that can adversely affect the Company’s ability to maintain existing talent and customers and establish new business relationships with continued access to sources of funding. See “Our Business—Credit Risk Management” and “Risks—Risk Management” for additional information on the types of risks affecting our business.

Read in the earlier 10-K, filed Feb 7, 2025 ↗

•breaches, failures or other disruptions of our or our vendors’ or customers’ information technology systems or products, including by cyber-attack, data leakage, unauthorized access or theft;

Read in the earlier 10-K, filed Feb 12, 2025 ↗

We, our business partners or our third-party vendors could experience a material failure or breach of a key information technology system, network, process or site: We rely extensively on information technology (IT) systems to conduct business. In addition, we rely on networks and services, including internet sites, cloud and software-as-a-service solutions, data hosting and processing facilities and tools and other hardware, software (including open-source software) and technical applications and platforms, some of which are managed, hosted, provided and/or used by third parties or their vendors, to assist in conducting our business. Furthermore, numerous and evolving cybersecurity threats have posed, and will continue to pose, risks to the security of our IT systems, networks and product offerings, as well as the confidentiality, availability and integrity of our data. Emerging technologies such as generative artificial intelligence (AI) may be used by malicious actors to create more targeted

Read in the earlier 10-K, filed Feb 12, 2025 ↗

When cybersecurity or other technology related incidents occur, we follow our incident response protocols and address them in accordance with applicable governmental regulations and other legal requirements. Our response to these incidents and our investments to protect our product offerings and information technology infrastructure and data may not shield us from significant losses and potential liability or prevent any future interruption or breach of our systems. Moreover, given the increasing complexity and sophistication of the techniques used by threat actors to obtain unauthorized access or disable or degrade systems, a cyberattack could occur and persist for an extended period of time before being detected, and we may not anticipate these acts or mitigate them adequately or timely, which may compound damages before the incident is discovered or remediated. The extent of a particular cyber incident and the steps that we may need to take to investigate the incident may not be immediately clear, and it may take a significant amount of time before such investigation can be completed and full and reliable information about the incident is known. New regulations may require us to disclose information about a material cybersecurity incident before it has been resolved or fully investigated. Additionally, as threats continue to evolve and increase, and as the regulatory environment and customer requirements related to information security, data collection and use, and privacy become increasingly rigorous, we may be required to devote significant additional resources to modify and enhance our security controls and to identify and remediate any security vulnerabilities, which could adversely impact our net income. In addition, a significant number of our employees working remotely has exposed us, and may continue to expose us, to greater risks related to cybersecurity and cyber-liability.

Read in the earlier 10-K, filed Feb 12, 2025 ↗

Interruption of manufacturing operations could adversely affect our business: We and our suppliers have manufacturing and supply sites all over the world. However, the manufacturing of certain of our product lines is concentrated in one or more plants or geographic regions. We have principal manufacturing and distribution facilities in the United States in Arizona, California, Florida, Illinois, Indiana, Michigan, Minnesota, New Jersey, Puerto Rico, Tennessee, Texas, Utah, Virginia and Washington, and outside the United States in China, France, Germany, Ireland, Mexico, the Netherlands, Poland, Switzerland and Turkey. Damage to our facilities, to our suppliers’ or service providers’ facilities, or to our central distribution centers as a result of natural disasters, fires, explosions or otherwise, as well as issues in our manufacturing arising from a failure to follow specific internal protocols and procedures, compliance concerns relating to the quality systems regulation, equipment breakdown or malfunction, IT system failures or cybersecurity incidents, environmental hazard incidents or changes to environmental regulations or other factors, could adversely affect the availability of our products. In the event of an interruption in manufacturing, we may be unable to move quickly to alternate means of producing and distributing affected products to meet customer demand. In the event of a significant interruption, we may experience lengthy delays in resuming production or distribution of affected products due to the need for regulatory approvals, and we may experience loss of market share, additional expense and harm to our reputation.

Read in the earlier 10-K, filed Feb 12, 2025 ↗

Our insurance program may not be adequate to cover future losses: We maintain third-party insurance to cover our exposure to certain property and casualty losses and are self-insured for claims and expenses related to other property and casualty losses, including product liability, intellectual property infringement and enforcement, environmental, and cybersecurity and data privacy losses. We manage a portion of our exposure to self-insured losses through a wholly-owned captive insurance company. Insurance coverage limits provided by third-party insurers and/or our captive insurance company may not be sufficient to fully cover certain losses we may experience.

Read in the earlier 10-K, filed Feb 12, 2025 ↗

Our use of AI and other emerging technologies could adversely impact our business and financial results: We have begun to deploy AI and other emerging technologies in various facets of our operations and we continue to explore further use cases. The rapid advancement of these technologies presents opportunities for us in research, manufacturing, commercialization, and other business endeavors, but also entails risks, including that AI-generated content, analyses, or recommendations we utilize could be deficient, that our competitors may more quickly or effectively adopt AI capabilities, or that our use of AI or other emerging technologies increases regulatory, cybersecurity and other significant risks. In addition, any disruption or failure in the AI functionality we incorporate into our business activities, products or services could adversely impact our business or result in delays or errors in our product offerings. The legal and regulatory landscape surrounding AI technologies is rapidly evolving and uncertain, including in the areas of intellectual property, cybersecurity and privacy and data protection. Compliance with new or changing laws, regulations or industry standards relating to AI may impose significant costs on us and limit our ability to effectively develop, deploy or use AI technologies. Furthermore, if we are unable to effectively manage the use of AI technologies by our employees and service providers, our confidential information, intellectual property and reputation could be put at risk. Failure to appropriately respond to this evolving landscape may result in reputational, competitive and business harm as well as litigation and regulatory action and fines, penalties and expenses related thereto.

Read in the earlier 10-K, filed Feb 12, 2025 ↗

We are subject to privacy, data protection and data security regulations and laws globally, and could face substantial penalties if we fail to comply with such regulations and laws: We are subject to a variety of laws and regulations globally regarding privacy, data protection, and data security, including those related to the collection, storage, handling, use, disclosure, transfer and security of personally identifiable healthcare information. For example, in the United States, privacy and security regulations under the Health Insurance Portability and Accountability Act of 1996, including the expanded requirements under the Health Information Technology for Economic and Clinical Health Act of 2009, establish comprehensive standards with respect to the use and disclosure of protected health information (PHI), by covered entities, in addition to setting standards to protect the confidentiality, integrity and security of PHI. Regulators are also imposing new data privacy and security requirements, including new and greater monetary fines for privacy violations. For example, the European Union’s General Data Protection Regulation (GDPR) established rules regarding the handling of personal data. Non-compliance with the GDPR may result in monetary penalties of up to 4% of total company revenue. Various U.S. states and other governmental authorities around the world have imposed or are considering similar types of laws and regulations, data breach reporting and penalties for non-compliance and increasing security requirements. These laws and regulations are broad in scope and are subject to evolving interpretation and enforcement and we have in the past been, and in the future could be, required to incur substantial costs to monitor compliance or to alter our practices. As new privacy-related laws and regulations are implemented, the time and resources needed for us to comply with such laws and regulations, as well as our potential liability for non-compliance and reporting obligations in the case of data breaches, have increased and may further increase.

Read in the earlier 10-K, filed Feb 12, 2025 ↗

Potential consequences of a future material cybersecurity incident include: business disruption; disruption to systems; theft, destruction, loss, corruption, misappropriation or unauthorized release of sensitive and/or confidential information or

Read in the earlier 10-K, filed Aug 22, 2025 ↗

–cybersecurity, data protection and privacy, such as to comply with, or fines and penalties related to, General Data Protection Regulation in the European Union and the California Consumer Privacy Act;

Read in the earlier 10-K, filed Apr 2, 2025 ↗

types, including phishing and other attempts to breach or gain unauthorized access to our systems. As artificial intelligence becomes increasingly integrated into business systems, concerns about data exposure and privacy risks are intensifying. Additionally, artificial intelligence is being used to carry out advanced social engineering attacks, increasing potential for harm. To date, these attacks have not had a material impact on our operations, but we cannot provide assurance that cyber-attacks will not have a material impact in the future.

Read in the earlier 10-K, filed Aug 14, 2025 ↗

U.S. and international regulators, investors, and other stakeholders are increasingly focused on ESG matters. New domestic and international laws and regulations relating to ESG matters, including human capital, climate change, and cybersecurity are under consideration or being adopted, which may include specific, target-driven disclosure requirements or obligations. We communicate certain sustainability-related initiatives, goals, and/or other matters in our annual Sustainability Report, on our website, in our filings with the SEC, and elsewhere. For example, in 2022, we established science-based targets for Scope 1, 2, and 3 greenhouse gas emissions, certain commitments on sourcing renewable energy, and the goal to engage 70% of our suppliers in setting their own science-based targets. Implementation of our goals and targets may require capital improvements. Our ability to achieve any stated commitment, goal, target, or objective is subject to many factors and conditions, some of which are outside of our control, including the pace of changes in technology and the cooperation and/or availability of suppliers that can meet our sustainability standards. If we fail to achieve, are perceived to have failed or been delayed in achieving, or improperly report our progress toward achieving our publicly stated goals and commitments or compliance with U.S. and international ESG laws and regulations, our business reputation and our financial condition, and results of operations may be negatively impacted.

Read in the earlier 10-K, filed Apr 25, 2025 ↗

implemented and will continue to implement a variety of measures to enhance further our cybersecurity protections. See “Part II, Item 7 - Management's Discussion and Analysis of Financial Condition and Results of Operations - Cybersecurity Incident” in our Annual Report on Form 10-K for the fiscal year ended March 31, 2023 for further discussion. Our software supply chain may also be subject to attacks, which may result in future security incidents and breaches.

Read in the earlier 10-K, filed May 20, 2025 ↗

We depend upon our IT systems to conduct virtually all of our business operations, ranging from our internal operations and research and development activities to our marketing and sales efforts and communications with our customers and business partners. We have in the past and will in the future be subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks (such as credential stuffing), personnel or service provider misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss or unavailability of data or other information technology assets, adware, telecommunications failures, earthquakes, fires, floods, natural disasters, and other similar threats.

Read in the earlier 10-K, filed Feb 26, 2025 ↗

our service providers face from these and other types of attacks. Because the techniques used to access, disrupt or sabotage devices, systems and networks change frequently and may not be recognized until launched against a target, we expect to be required to make further investments over time to protect data and infrastructure as cybersecurity threats develop, evolve and grow more complex over time. We may also be unable to anticipate these techniques, and we may not become aware in a timely manner of any security breach or incident, which could exacerbate any damage we experience.

Read in the earlier 10-K, filed Feb 26, 2025 ↗

We depend upon our employees and contractors to appropriately handle confidential and sensitive data, including customer data, and to deploy our IT resources in a safe and secure manner that does not expose our network systems to security breaches or incidents or the loss, alteration, unavailability, or other unauthorized processing of data. We have been and expect to be subject to cybersecurity threats and incidents, including denial-of-service attacks, employee errors or individual attempts to gain unauthorized access to information systems. We also continue to incorporate AI solutions and features into our platform, which may result in security incidents or otherwise increase cybersecurity risks. Further, AI technologies may be used in connection with certain cybersecurity attacks, resulting in heightened risks of security breaches and incidents. Any security incidents, including internal malfeasance or inadvertent disclosures by our employees or a third-party’s fraudulent inducement of our employees to disclose information, unauthorized access or usage, the introduction of viruses or other malicious code or any other breach or incident or disruption of our platform, systems, or networks or those of our service providers, could result in loss, corruption, unavailability, or other unauthorized processing of confidential information, and any such event, or the perception that it has occurred, may result in damage to our reputation, erosion of customer trust, loss of customers, litigation, regulatory investigations, fines, penalties and other liabilities. For example, in June and August 2022, we became aware that threat actors had conducted sophisticated social engineering campaigns against some of our employees after having obtained employee names and mobile phone numbers from unknown sources. The attack identified in August 2022, which involved smishing text messages that purported to be from our IT department, resulted in the threat actor obtaining some of our employees’ credentials and access to certain data of approximately 209 customers out of our total customer base of approximately 270,000 at that time. We notified and worked with our affected customers. We also notified appropriate regulators and addressed their questions about the incident. We also took steps to remediate the incident, including enhancing our security training, improving our two factor authentication requirements, implementing additional layers of control within our VPN, reducing access to certain internal applications and tools, running simulated phishing attempts to increase employee security awareness, and increasing the refresh frequency for access to certain internal applications. Industry reports indicate that the threat actors also attacked other technology, telecommunication and cryptocurrency companies.

Read in the earlier 10-K, filed Feb 26, 2025 ↗

Furthermore, we are required to comply with laws and regulations that require us to maintain security measures designed to protect personal information and we may have contractual and other legal obligations to notify customers, regulators, government agencies, impacted individuals or other relevant stakeholders of security breaches. Such disclosures are costly, and the disclosures or the failure to comply with such requirements could lead to adverse consequences. If we (or a third party upon whom we rely) experience a security incident or are perceived to have experienced a security incident, we may experience adverse consequences. Consequences associated with such security incidents may include: government enforcement actions and other actions or proceedings (for example, investigations, audits, and inspections), and related fines, penalties, required remedial actions, or other obligations and liabilities; additional reporting requirements and/or oversight; restrictions on processing or transferring data (including personal data); claims, demands, and litigation (including class claims); indemnification obligations; monetary fund diversions; interruptions in our operations (including availability of data); financial loss and other similar harms. Actual and perceived security incidents and attendant consequences could also lead to negative publicity and reputational harm, may cause our customers to lose confidence in the effectiveness of our security measures and require us to expend significant capital and other resources to respond to and/or mitigate the security incident. Accordingly, if our cybersecurity measures or those of our third-party service providers fail to protect against unauthorized access, attacks (which may include sophisticated cyberattacks), or if our employees or contractors compromise or mishandle data, then our reputation, customer trust, business, results of operations and financial condition could be adversely affected.

Read in the earlier 10-K, filed Feb 26, 2025 ↗

While we maintain errors, omissions and cyber liability insurance policies covering certain security and privacy damages, we cannot be certain that our existing insurance coverage will continue to be available on acceptable terms or will be

Read in the earlier 10-K, filed Feb 26, 2025 ↗

We and our customers are subject to numerous domestic (for example, the California Consumer Privacy Act (“CCPA”)) and foreign (for example, the General Data Protection Regulation (“GDPR”) in the European Union (“EU”)) privacy, data protection and cybersecurity laws and regulations that restrict the collection, use, disclosure and processing of personal information, including financial and health data. These laws and regulations are expanding globally, evolving, and being tested in courts, may result in increasing regulatory and public scrutiny of our practices relating to personal information and may increase our exposure to regulatory enforcement action, sanctions and litigation. The breadth and depth of changes in data protection obligations has required significant time and resources, including a review of our technology and systems against the requirements of the GDPR.

Read in the earlier 10-K, filed Feb 26, 2025 ↗

The CCPA (as amended by the California Privacy Rights Act of 2020) imposes obligations on businesses to which it applies. These obligations include, but are not limited to, providing specific disclosures in privacy notices and affording California residents (both consumers and employees) certain rights related to their personal information. The CCPA allows for statutory fines for noncompliance. Similar laws have been enacted in 18 other states with 13 laws currently in effect and the remainder becoming effective later in 2025 and 2026. Numerous other states, and the U.S. federal government, also have proposed general privacy legislation recently. Additionally, other states have proposed, and in certain cases enacted, other laws and regulations addressing privacy and cybersecurity, such as Washington’s My Health, My Data Act, which includes a private right of action. If we become subject to new privacy, data protection or cybersecurity laws, the risk of enforcement action against us could increase because we may become subject to additional obligations, and the number of individuals or entities that can initiate actions against us may increase, including individuals, via a private right of action, and state actors.

Read in the earlier 10-K, filed Feb 26, 2025 ↗

Outside the United States, an increasing number of laws, regulations, and industry standards apply to privacy, data protection and cybersecurity. For example, the GDPR, the United Kingdom’s General Data Protection Regulation and Data Protection Act 2018 (“UK GDPR”) and the Swiss Federal Act on Data Protection, impose strict requirements for processing the personal information of individuals protected by the legislation, whether their data is processed within or outside the European Economic Area (“EEA”), the United Kingdom (“UK”) and Switzerland, respectively (such jurisdictions, collectively, “Europe”). For example, the GDPR imposes significant requirements regarding the processing of individuals’ personal information, including in relation to transparency, lawfulness of processing, individuals’ privacy rights, compliant contracting, data minimization, data breach notification, data re-usage, data retention, security of processing and international data transfers. Under the GDPR and UK GDPR, government regulators may impose temporary or definitive bans on data processing or data transfers, require a company to delete data, as well as impose significant fines, potentially ranging up to 20 million Euros under the GDPR, 17.5 million GBP under the UK GDPR, or 4% of a company’s worldwide revenue, whichever is higher. Further, individuals may initiate compensation claims or litigation related to our processing of their personal information. Other privacy and data protection laws in Europe impose strict requirements around marketing communications and the deployment of cookies on users’ devices. As another example, Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados Pessoais, or “LGPD”) (Law No. 13,709/2018) may apply to our operations. The LGPD broadly regulates processing of personal information of individuals in Brazil and imposes compliance obligations and penalties comparable to those of the GDPR. Additionally, we expect an increase in the regulation of the use of AI and ML in products and services. For example, in Europe, the Artificial Intelligence Act (“AI Act”), once effective, will impose onerous obligations related to the development, placing on the market and use of AI-related systems. In the United States, numerous states have established study commissions that could lead to regulation of AI, and certain states have enacted legislation regulating aspects of AI. Other countries also are contemplating laws regulating AI and ML. We may have to change our business practices to comply with obligations under these or other new and evolving regimes.

Read in the earlier 10-K, filed Feb 26, 2025 ↗

Evolving laws, regulations, and other actual and asserted obligations relating to privacy, data protection, and cybersecurity, as well as any new or evolving obligations relating to the use of AI and ML technologies, could reduce demand for our platform, increase our costs, impair our ability to grow our business, or restrict our ability to store and process data or, in some cases, impact our ability to offer our service in some locations and may subject us to liability. Further, in view of new or modified federal, state or foreign laws and regulations, industry standards, contractual obligations and other actual and asserted obligations, or any changes in their interpretation, we may find it necessary or desirable to fundamentally change our business activities and practices or to expend significant resources to modify our practices and platform and otherwise adapt to these changes. We may be unable to make such changes and modifications in a commercially reasonable manner or at all, and our ability to develop new products and features could be limited.

Read in the earlier 10-K, filed Feb 26, 2025 ↗

Similarly, in May 2021, the Biden administration issued an Executive Order requiring federal agencies to implement additional information technology security measures, including, among other things, requiring agencies to adopt multifactor authentication and encryption for data at rest and in transit to the maximum extent consistent with federal records laws and other applicable laws. Due to this Executive Order, federal agencies may require us to modify our cybersecurity practices and policies, thereby increasing our compliance costs. If we are unable to meet the requirements of the Executive Order, our ability to work with the U.S. government, whether directly or indirectly, may be impaired and may result in a loss of revenue.

Read in the earlier 10-K, filed Feb 26, 2025 ↗

•We are also subject to central bank oversight in a growing number of countries, including Brazil, India, the UK and within the EU. In several jurisdictions, we have been designated as a “systemically important payment system.” Some countries with existing oversight frameworks are looking to further enhance their regulatory powers, while regulators in other jurisdictions are considering or adopting approaches based on these regulatory principles. For example, in October 2023, VisaNet was designated as a prominent payment system in Canada. These types of designations generally result in oversight of authorization, clearing and settlement activities, including policies, procedures and requirements related to governance, client and seller access to our payment systems, reporting, cybersecurity, processing infrastructure, capital and/or credit risk management. We could also be required to adopt policies and practices designed to mitigate settlement and liquidity risks, including increased requirements to maintain sufficient levels of capital and financial resources locally, as well as localized risk management or governance.

Read in the earlier 10-K, filed Nov 6, 2025 ↗

Our business relies on the processing of data across national borders. Legislators and regulators around the world are increasingly adopting or revising privacy, data protection, data management, data transfer, AI and cybersecurity laws and regulations. For example, our ongoing efforts to comply with complex U.S. and international privacy and data protection laws may increase the complexity of our compliance operations, entail substantial expenses, divert resources from other initiatives and projects, require us to modify our data processing practices, policies or services, and adversely impact our business. In addition, privacy laws in numerous jurisdictions, including but not limited to the U.S., China, India, Australia, New Zealand, Brazil, Kingdom of Saudi Arabia, Hong Kong and Japan, have established specific legal requirements for cross-border transfers of personal information and substantial compliance and audit obligations. Certain countries have also established specific legal requirements for data localization, such as where personal data must remain stored in the country. The global proliferation of new privacy and data protection laws may lead to inconsistent and conflicting requirements or legal interpretations, which create an uncertain regulatory environment. Noncompliance could also result in regulatory penalties and significant legal liability. Enforcement actions and investigations by regulatory authorities into companies related to data security incidents and privacy violations are generally increasing. In Europe, data protection authorities continue to apply and enforce the General Data Protection Regulation (GDPR), imposing record setting fines. As we develop integrated and personalized products and services and acquire new companies to meet the needs of a changing marketplace, we may expand our data profile through additional data types and sources, across multiple channels, and involving new partners. This potential expansion could amplify the impact of these various laws and regulations on our business. As a result, we are required to constantly monitor our privacy, data and cybersecurity practices and potentially change them when necessary or appropriate. We also may need to provide increased care in our data management, governance and quality practices, particularly as it relates to the use of data in products leveraging AI.

Read in the earlier 10-K, filed Nov 6, 2025 ↗

In particular, the adoption of agentic commerce, in which autonomous AI agents initiate and execute transactions on behalf of users, presents novel and complex regulatory, privacy and cybersecurity risks. Legal frameworks governing such autonomous agents remain nascent, with limited direct guidance specific to payments. The interplay between payments regulations, data privacy laws and evolving AI regulations may create uncertainty around compliance obligations and potential liability exposure as more participants (including sellers, fintechs, AI developers and enablers) enter the agentic commerce ecosystem. The market is still assessing how regulators may apply existing consumer protection and other laws in the context of AI. For example, as agentic commerce solutions scale, we may see increased instances of erroneous or disputed payments, increased chargebacks and reputational harm. Furthermore, reliance on agentic AI introduces challenges in monitoring cross-border, prohibited or high-risk transactions, where conflicting regulatory requirements may apply. The fragmented regulatory landscape for emerging technologies such as AI and inconsistent requirements across legal frameworks may amplify difficulties in identifying, preventing or mitigating risk with a single global approach, potentially increasing our compliance costs or stratifying our ability to leverage certain data or technologies for innovation. For instance, the EU has adopted a comprehensive AI Act that establishes harmonized rules across Europe, with key provisions for high-risk AI systems taking effect in August 2026. Meanwhile, several U.S. states, including California, Colorado and Utah, have adopted AI-specific frameworks or are considering applying existing consumer and data protection laws to regulate AI. Depending on how these different regulations are interpreted and enforced, they may limit the ability to develop and deploy AI systems or significantly increase associated compliance costs. Our development and implementation of governance frameworks aimed at complying with emerging laws and regulations applicable to our AI and machine learning systems may not be successful in mitigating all of these emerging risks.

Read in the earlier 10-K, filed Nov 6, 2025 ↗

Other countries have imposed or may in the future impose data localization obligations, cross-border data transfer restrictions, and other country specific privacy and security requirements which could be problematic to cloud software and data providers. For example, in 2021, China adopted the Personal Information Protection Law, which, together with the Cybersecurity Law and the Data Security Law, require companies that process personal data of China residents above certain thresholds to seek approval from the Cyberspace Administration of China (CAC) to transfer such data outside of China. In 2023, certain of our Veeva CRM customers in China were required to request such approval from the CAC and had their requests denied. Customers required to request approval may need to implement a CRM solution that does not require data to be transferred outside of China and customers not subject to the requirement may nonetheless choose to do so. While we offer the China CRM Suite, a CRM solution that does not require data to be transferred outside of China, some customers have chosen, and other customers may choose, other CRM providers, which may negatively impact our CRM business in China. Currently, approximately 2% of our total revenue is attributable to China. Additionally, as we expand our data product offerings into new jurisdictions, we are required to assess, monitor, and comply with additional laws and regulations related to our collection and processing of data, which may include new registration, consent, and notification obligations.

Read in the earlier 10-K, filed Mar 24, 2025 ↗

We use our own IT networks and related systems to access, store, transmit, and manage or support a variety of our business processes and information and face risks associated with cybersecurity incidents and other disruptions of our IT networks and related systems, including as a result of cybersecurity attacks or intrusions over the internet, malware or ransomware, computer phishing attempts and other forms of social engineering. We have experienced cybersecurity events such as viruses, phishing attempts and attacks on our IT systems, although none of these events have had a material impact on our business, operations or financial results to date. These and future cybersecurity incidents or other disruptions may be caused by individuals within our organization, individuals outside our organization with authorized access, or by unauthorized individuals from outside our organization. The risk of such incidents, particularly through cyber attacks or intrusions, including by computer hackers, foreign governments and cyber terrorists, has generally continued to increase due to the growing number, intensity, and sophistication of attempted attacks and intrusions worldwide. Although we make efforts to maintain the security and integrity of our IT

Read in the earlier 10-K, filed Feb 20, 2025 ↗

For example, the E.U. General Data Protection Regulation (“GDPR”) went into effect in 2018 and has imposed new obligations on us with respect to our processing of personal data and the cross-border transfer of such data, including higher standards of obtaining consent, more robust transparency requirements, data breach notification requirements, requirements for contractual language with our data processors, and stronger individual data rights. Different E.U. member states have interpreted the GDPR differently and many have imposed additional requirements, which add to the complexity of processing personal data in the E.U. The GDPR also imposes strict rules on the transfer of personal data to countries outside the E.U., including the U.S. and the U.K., and permits data protection authorities to impose large penalties for violations of the GDPR. Similarly, other jurisdictions have either introduced or enacted legislation or executive orders restricting cross-border data transfers. These regulations restrict the transfer of certain types of data (e.g., sensitive personal data) or restrict the transfer of data to certain jurisdictions. The rules related to cross border data transfers continue to evolve based on court decisions and regulator guidance, which presents certain practical challenges to compliance. Regulators also continue to focus enforcement efforts on behavioral advertising and other online tracking technologies commonly used by companies. Compliance with these evolving rules is challenging, as country specific guidance and rules are continually changing and limited alternatives currently exist in the market. Compliance with the these laws and regulations is a rigorous and time-intensive process that may increase our cost of doing business or require us to change our business practices, and despite those efforts, there is a risk that we may be subject to fines and penalties, litigation, and reputational harm in connection with any activities falling within the scope of the GDPR or other privacy laws or regulations.

Read in the earlier 10-K, filed Feb 13, 2025 ↗

We maintain and rely extensively on information technology systems and network infrastructures for the effective operation of our business. In the course of our business, we collect, store, and transmit confidential information (including personal information and intellectual property), and it is critical that we do so in a secure manner to maintain the confidentiality, integrity, and availability of such confidential information. A disruption, infiltration, or failure of our information technology systems or any of our data centers as a result of software or hardware malfunctions, computer viruses, cyber-attacks, employee theft or misuse, power disruptions, natural disasters, floods or accidents could cause breaches of data security and loss of critical data, which in turn could materially adversely affect our business and subject us to both private and governmental causes of action. While we have implemented security measures to minimize these risks to our data and information technology systems and have adopted a business continuity plan to deal with a disruption to our information technology systems, there can be no assurance that our efforts to protect our data and information systems will prevent breakdowns or breaches in our systems that could adversely affect our business. In addition, we maintain cyber liability insurance, however, this insurance may not be sufficient to cover the financial, legal, business or reputational losses that may result from an interruption or breach of our systems and those of critical third parties.

Read in the earlier 10-K, filed Feb 13, 2025 ↗

Cyber-attacks are increasing in their frequency, sophistication, and intensity, and are becoming increasingly difficult to detect. They are often carried out by well-resourced and skilled parties, including nation states, organized crime groups, “hacktivists” and employees or contractors acting carelessly or with malicious intent. Cyber-attacks include deployment of harmful malware and key loggers, ransomware, denial-of-service attacks, malicious websites, the use of social engineering, and other means to affect the confidentiality, integrity and availability of our technology systems and data. Cyber-attacks also include manufacturing, hardware or software supply chain attacks, which could cause a delay in the manufacturing of products or products produced for contract manufacturing or lead to a data privacy or security breach. Our business partners face similar risks and when they experience a security breach of their systems, our security can be adversely affected. Similar to other companies, we have experienced immaterial cybersecurity incidents, including temporary service interruptions of third-party suppliers. In addition, our increased use of cloud technologies heightens these third party and other operational risks, and any failure by cloud or other technology service providers to adequately safeguard their systems and prevent cyber-attacks could disrupt our operations and result in misappropriation, corruption, or loss of confidential or propriety information. A significant portion of our workforce continues to leverage hybrid work. Risk of cyber-attack is increased with employees working remotely. Remote work increases the risk we may be vulnerable to cybersecurity-related events such as phishing attacks and other security threats.

Read in the earlier 10-K, filed Feb 13, 2025 ↗

adversarial attacks, which could result in unauthorized access to or leakage of sensitive information. Geopolitical tensions or conflicts may also create heightened risk of cybersecurity incidents.

Read in the earlier 10-K, filed Aug 14, 2025 ↗

Challenges in implementing new systems can also affect our ability to realize projected cost savings or other benefits. Significant system failures could impede our ability to timely collect and report financial results in accordance with applicable laws and regulations. Our post-acquisition efforts to integrate Stericycle’s technology and systems may result in substantial costs and uncertainties. Systems that increase our utilization of, and dependency on, third-party cloud computing services, and digital platforms to accommodate work-from-home arrangements, also increase various technology risks, including potential exposure to cyber incidents, loss of data, fraud, internal control challenges and other disruptions as a consequence of more employees accessing Company systems and information remotely in the course of their ordinary work.

Read in the earlier 10-K, filed Feb 19, 2025 ↗

increase the risk and likelihood of cyber incidents. As such, we must commit substantial resources to continuously monitor and further develop our networks and infrastructure to prevent, detect, and address the risk of unauthorized access, misuse, computer viruses and other events. These protections and other systems designed to mitigate cybersecurity risks may not fully defend against an attack or future cybersecurity incident, which can be unpredictable in nature.

Read in the earlier 10-K, filed Feb 19, 2025 ↗

In terms of cybersecurity, pursuant to the SEC’s Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure we are required to make certain disclosures related to material cybersecurity incidents and the reasonably likely impact of such an incident on Form 8-K and are required to make certain other cybersecurity disclosures on Form 10-K. Determining whether a cybersecurity incident is notifiable or reportable may not be straightforward and any such mandatory disclosures could be costly and lead to negative publicity, loss of customer confidence in the effectiveness of our security measures, diversion of management’s attention and governmental investigations.

Read in the earlier 10-K, filed Mar 27, 2025 ↗

We rely on the well-known U.S. based third-party digital asset-focused custodian, NYDIG, to safeguard our bitcoin using cold storage. NYDIG receives and holds our custodied assets, which includes both our digital assets and any cash we may choose to custody with NYDIG. Only NYDIG holds the private keys to our wallet, and no one at the Company has access to our wallet’s private keys. If our third-party service provider experiences a security breach or cyber-attack and unauthorized parties obtain access to our bitcoin, we may lose some or all of our bitcoin and our financial condition and results of operations could be materially adversely affected. To date, we have not experienced a material cyber incident; however, we continue to encounter ongoing cyber-attacks and the occurrence of any such event in the future could subject us to liability to our customers, suppliers, business partners and others, or give rise to legal and/or regulatory action, which could damage our reputation or otherwise materially harm our business, operating results, and financial condition.

Read in the earlier 10-K, filed Mar 3, 2025 ↗

There is no assurance that the security measures we take to reduce the risk of such incidents and protect our systems will be sufficient or that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.

Read in the earlier 10-K, filed Feb 19, 2025 ↗