high match confidence
Sentence-level differences:
- Reworded sentence: "To conduct its business, the Company relies extensively on IT and OT systems, many of which are managed, hosted, provided and/or used by third parties and their vendors."
- Reworded sentence: "If a new system does not function properly or is not adequately supported by third-party service providers and processes, it could adversely affect the Company’s business and operations, which, in turn, could adversely impact the Company’s results of operations and cash flows."
- Removed sentence: "A breach or other breakdown in the Company’s technology, including a cyber-attack, privacy breach, data breach or other incident involving the Company or any of the Company's third-party service providers or vendors, that results in unauthorized disclosure or significant unavailability of business, financial, personal or stakeholder information could adversely affect the Company’s financial condition and results of operations."
- Removed sentence: "In addition, if the Company’s service providers, suppliers or customers experience a breach or unauthorized disclosure or system failure, their businesses could be disrupted or otherwise negatively affected, which may result in a disruption in the Company’s supply chain or reduced customer orders or other business operations disruption, which would adversely affect the Company."
- Removed sentence: "These risks also may be present to the extent any of our partners, distributors, joint venture partners or suppliers using separate information or operational technology systems, not integrated with the systems of the Company, suffers a cybersecurity incident and could result in increased costs related to our involvement in investigations or notifications conducted by these third parties."
Current (2024):
To conduct its business, the Company relies extensively on IT and OT systems, many of which are managed, hosted, provided and/or used by third parties and their vendors. These systems include, but are not limited to, programs and processes relating to communicating within the…
Read full text
To conduct its business, the Company relies extensively on IT and OT systems, many of which are managed, hosted, provided and/or used by third parties and their vendors. These systems include, but are not limited to, programs and processes relating to communicating within the Company and with customers, consumers, business partners, investors and other parties; ordering and managing materials from suppliers; converting materials to finished products; receiving and processing purchase orders and shipping products to customers; processing transactions; storing, processing and transmitting data, including personal confidential information and historical payment card industry data; hosting, processing and sharing confidential and proprietary research, business and financial information; and complying with financial reporting, regulatory, legal and tax requirements. On Monday, August 14, 2023, the Company disclosed it had identified unauthorized activity on some of its IT systems. That activity began on Friday, August 11, 2023 and after becoming aware of it that evening, the Company immediately began taking steps to stop and remediate the activity. The Company also took certain systems offline and engaged third-party cybersecurity experts to support its investigation and recovery efforts. The Company implemented its business continuity plans, including 12 12 12 Table of Contents Table of Contents manual ordering and processing procedures at a reduced rate of operations in order to continue servicing its customers. However, the incident resulted in wide-scale disruptions to the Company’s business operations throughout the remainder of the quarter ended September 30, 2023 and negatively impacted fiscal year 2024 results, though some of the anticipated net sales not recognized in the first quarter of fiscal year 2024 as a result of the disruptions were recognized in the later quarters of fiscal year 2024. The impacts of these system disruptions included order processing delays and significant product outages, resulting in a negative impact on net sales and earnings. The Company has since transitioned back to automated order processing. The Company experienced lessening operational impacts starting in the second quarter of fiscal year 2024 and has since returned to substantially normalized operations. The cyberattack may also lead to additional regulatory scrutiny or litigation exposure. The Company is in the process of a multi-year phased upgrade of its digital capabilities, including enhancing operating efficiencies and transitioning to a cloud-based platform, as well as replacing its enterprise resource planning system. It also uses various other hardware, software and operating systems that may need to be upgraded or replaced in the near future as such systems cease to be supported by third-party service providers, and may be vulnerable to increased risks, including the risk of further security breaches, system failures and disruptions. Any such upgrade could take time, oversight and be costly to the Company, and may include potential challenges, such as the cost of training personnel, migration of data, the potential instability of the new system and cost overruns. If such systems are not successfully upgraded or replaced in a timely manner, system outages, disruptions or delays, or other issues may arise. If a new system does not function properly or is not adequately supported by third-party service providers and processes, it could adversely affect the Company’s business and operations, which, in turn, could adversely impact the Company’s results of operations and cash flows. The IT/OT systems of the Company, its customers, business partners, suppliers, and third-party providers have been, and will continue to be, subject to cyber-threats such as computer viruses or other malicious codes, security breaches, ransomware, unauthorized access attempts, business email compromise, cyber extortion, denial of service attacks, phishing, deepfakes, social engineering, unintentional or malicious actions of employees or contractors, hacking and other cyberattacks attempting to exploit vulnerabilities by hackers, criminal groups, nation-states and nation-state-sponsored organizations and social-activist organizations. These activities may result in unauthorized access, disclosure and misuse of customer, employee, vendor, Company, or consumer information, including personal consumer information obtained through online and e-commerce sales, and online activities, including promotions, rebates and customer loyalty programs, as well as increased costs related to the Company’s involvement in investigations or notifications conducted by the Company’s business partners. The Company has seen and may continue to see an increase in the number of such attacks, especially as the Company continues operating under a hybrid working model under which employees can work and access the Company’s technology infrastructure remotely. The rapid evolution and increased adoption of emerging technologies, such as artificial intelligence, may also increase the frequency and magnitude of cyberattacks on the Company and amplify its cybersecurity risks. In addition, while the Company has purchased cybersecurity insurance, costs related to a cyberattack may exceed the amount of insurance coverage or be excluded under the terms of its cybersecurity insurance policy. The Company may be unable to obtain cybersecurity insurance in amounts and on terms the Company views as appropriate for its operations. The security efforts of the Company and its third-party providers may not prevent or timely detect future attacks and resulting breaches or breakdowns of its databases or systems. The Company has in place disaster recovery and business continuity plans to address these incidents, but if these plans or those of its third-party providers do not effectively resolve such breaches or breakdowns on a timely basis or at all, the Company may experience interruptions in its ability to manage or conduct business, as well as reputational harm, governmental fines, penalties, regulatory proceedings, and litigation and remediation expenses. The need to coordinate with various third-party service providers, including with respect to timely notification and access to personnel and information concerning an incident, may complicate the Company’s efforts to address issues that arise. As a result, the Company is subject to the risk that the activities associated with its third-party service providers can adversely affect its business, financial condition and results of operations, even if the attack or breach does not directly impact its systems or information. Cyber-threats and techniques are becoming more sophisticated and are constantly evolving, including through the use of emerging technologies such as artificial intelligence, and are being made by groups and individuals with a wide range of expertise and motives, and this increases the difficulty of detecting and successfully defending against them. Continued geopolitical instability has also heightened the risk of cyberattacks. The Company has incurred, and will continue to incur, expenses to comply with privacy and data protection standards and protocols imposed by law, regulation, industry standards and contractual obligations. Increased regulation of data collection, use, and retention practices, including self-regulation and industry standards, changes in existing laws and regulations, including reporting requirements, enactment of new laws and regulations, increased enforcement activity, and changes in interpretation of laws, could increase the Company's cost of compliance and operation, limit its ability to grow its business or otherwise harm its business. 13 13 13 Table of Contents Table of Contents In addition, data breaches or theft of personal information collected by the Company and its third-party service providers as well as data breaches or theft of Company information and assets have occurred in the past and may occur in the future. The Company is subject to the laws and regulations of various countries where it operates or does business related to solicitation, collection, processing, transferring, storing or use of consumer, customer, business partner or employee information or related data. These laws and regulations change frequently, and new legislation continues to be introduced and may include different standards and requirements, be interpreted and applied differently from jurisdiction to jurisdiction and create inconsistent or conflicting requirements. The changes introduced by data privacy and protection regulations increase the complexity of regulations enacted to protect business and personal data and they subject the Company to additional costs and have required, and may in the future require, costly changes to the Company’s security systems, policies, procedures and practices. These laws and regulations also may result in the Company incurring additional expenses and liabilities in the event of unauthorized access to or disclosure of personal data.
View prior text (2023)
To conduct its business, the Company relies extensively on information and operational technology systems, many of which are managed, hosted, provided and/or used by third parties and their vendors. These systems include, but are not limited to, programs and processes relating to communicating within the Company and with customers, consumers, vendors, investors and other parties; ordering and managing materials from suppliers; converting materials to finished products; receiving and processing purchase orders and shipping products to customers; processing transactions; storing, processing and transmitting data, including personal confidential information and payment card industry data; hosting, processing and sharing confidential and proprietary research, business and financial information; and complying with financial reporting, regulatory, legal and tax requirements. Furthermore, the Company sells certain of its natural personal care products, vitamins, minerals, supplements and other products directly to consumers online and through websites, mobile apps and connected devices, and the Company also engages in online activities, including promotions, rebates and customer loyalty and other programs, through which it may receive personal information. Through the use of any of these information and operational technology systems or processes, the Company or its vendors have in the past and could in the future again experience cyber-attacks, privacy breaches, data breaches or other incidents that may result in unauthorized access, disclosure and misuse of consumer, customer, employee, vendor or Company information, especially as the Company continues operating under a hybrid working model under which employees can work and access the Company’s technology infrastructure remotely. The Company is in the process of upgrading its enterprise resource planning system but also uses various hardware, software and operating systems that may need to be upgraded or replaced in the near future as such systems cease to be supported by third-party service providers, and may be vulnerable to increased risks, including the risk of security breaches, system failures and disruptions. Any such upgrade could take time, oversight and be costly to the Company. If such systems are not successfully upgraded or replaced in a timely manner, system outages, disruptions or delays, or other issues may arise. If a new system does not function properly, or is not adequately supported by third-party service providers and processes, it could adversely affect the Company’s business and operations, which, in turn, adversely impact the Company’s results of operations and cash flows. Despite the security measures the Company has in place, the information and operational technology systems, including those of our customers, vendors, suppliers and other third-party service providers with whom we have contracted, have, in the past, and may, in the future, be vulnerable to cyber-threats such as computer viruses or other malicious codes, security breaches, unauthorized access, phishing attacks and other disruptions from employee error, unauthorized uses, system failures, including Internet outages, unintentional or malicious actions of employees or contractors or cyber-attacks by hackers, criminal groups, nation-states and nation-state-sponsored organizations and social-activist organizations. The Company’s information and operational technology systems and its third-party providers’ systems, have been, and will likely continue to be, subject to cyber-threats such as computer viruses or other malicious codes, ransomware, unauthorized access attempts, business email compromise, cyber extortion, denial of service attacks, phishing, social engineering, hacking and other cyberattacks attempting to exploit vulnerabilities. The Company has seen and may continue to see an increase in the number of such attacks as the Company has shifted to a hybrid working model under which employees will continue working remotely and accessing its technology infrastructure remotely. In addition, while we have purchased cybersecurity insurance, costs related to a cyberattack may exceed the amount of insurance coverage or be excluded under the terms of our cybersecurity insurance policy. As cyberattacks increase in frequency and magnitude, we may be unable to obtain cybersecurity insurance in amounts and on terms we view as appropriate for our operations. To date, the Company is not aware that its business or operations have been materially impacted by these cyberattacks. However, the Company’s security efforts and the efforts of its third-party providers may not prevent or timely detect attacks and resulting breaches or breakdowns of the Company’s, or its third-party service providers’, databases or systems. In addition, if the Company or its third-party providers are unable to effectively resolve such breaches or breakdowns on a timely basis, the Company may experience interruptions in its ability to manage or conduct business, as well as reputational harm, governmental 14 14 14 Table of Contents Table of Contents fines, penalties, regulatory proceedings, and litigation and remediation expenses. In addition, such incidents could result in unauthorized disclosure and misuse of material confidential information, including personal information. Cyber threats are becoming more sophisticated, are constantly evolving and are being made by groups and individuals with a wide range of expertise and motives, and this increases the difficulty of detecting and successfully defending against them. We have incurred, and will continue to incur, expenses to comply with privacy and data protection standards and protocols imposed by law, regulation, industry standards and contractual obligations. Increased regulation of data collection, use, and retention practices, including self-regulation and industry standards, changes in existing laws and regulations, including reporting requirements, enactment of new laws and regulations, increased enforcement activity, and changes in interpretation of laws, could increase our cost of compliance and operation, limit our ability to grow our business or otherwise harm our business. In addition, data breaches or theft of personal information collected by the Company and its third-party service providers as well as data breaches or theft of Company information and assets have occurred in the past and may occur in the future. The Company is subject to the laws and regulations of various countries where it operates or does business related to solicitation, collection, processing, transferring, storing or use of consumer, customer, vendor or employee information or related data. These laws and regulations change frequently, and new legislation continues to be introduced and may be interpreted and applied differently from jurisdiction to jurisdiction and may create inconsistent or conflicting requirements. The changes introduced by data privacy and protection regulations increase the complexity of regulations enacted to protect business and personal data and they subject the Company to additional costs and have required, and may in the future require, costly changes to the Company’s security systems, policies, procedures and practices. These laws and regulations also may result in the Company incurring additional expenses and liabilities in the event of unauthorized access to or disclosure of personal data. A breach or other breakdown in the Company’s technology, including a cyber-attack, privacy breach, data breach or other incident involving the Company or any of the Company's third-party service providers or vendors, that results in unauthorized disclosure or significant unavailability of business, financial, personal or stakeholder information could adversely affect the Company’s financial condition and results of operations. In addition, if the Company’s service providers, suppliers or customers experience a breach or unauthorized disclosure or system failure, their businesses could be disrupted or otherwise negatively affected, which may result in a disruption in the Company’s supply chain or reduced customer orders or other business operations disruption, which would adversely affect the Company. These risks also may be present to the extent any of our partners, distributors, joint venture partners or suppliers using separate information or operational technology systems, not integrated with the systems of the Company, suffers a cybersecurity incident and could result in increased costs related to our involvement in investigations or notifications conducted by these third parties. These risks may also be present to the extent a business we have acquired, that does not use our information or operational technology systems, experiences a system shutdown, service disruption, or cybersecurity incident. In addition, there is a possibility that the continuing conflict in Ukraine could result in cyberattacks that could either directly or indirectly affect our operations. In addition, we are in the process of a multi-year phased upgrade to our digital capabilities, including replacing our enterprise resource planning system to enhance operating efficiencies and transitioning to a cloud-based platform, as well as the implementation of a suite of other digital technologies. The upgrade poses several challenges, including training of personnel, migration of data and the potential instability of the new system. If we do not allocate and effectively manage the resources necessary to build and sustain the upgraded technology infrastructure, or if we fail to achieve the expected benefits from this enhancement or it does not operate as designed, our business and operations could be adversely affected.