Added factors have no prior-year match; removed factors have no current-year match. Changed wording describes edits within matched factors. Check whether unmatched wording was reorganised elsewhere: an added factor does not establish a new risk, and a removed factor does not establish resolved exposure.

🟡 Changed wording Disclosure change7/10

Failure of key technology systems, cyberattacks, privacy breaches or data breaches could have a material adverse effect on the Company’s business, financial condition, results of operations and reputation.

high match confidence

Sentence-level differences:

View all 46 sentence differences

Removed sentence: "To conduct its business, the Company relies extensively on IT and OT systems, many of which are managed, hosted, provided and/or used by third parties and their vendors."
Removed sentence: "These systems include, but are not limited to, programs and processes relating to communicating within the Company and with customers, consumers, business partners, investors and other parties; ordering and managing materials from suppliers; converting materials to finished products; receiving and processing purchase orders and shipping products to customers; processing transactions; storing, processing and transmitting data, including personal confidential information and historical payment card industry data; hosting, processing and sharing confidential and proprietary research, business and financial information; and complying with financial reporting, regulatory, legal and tax requirements."
Removed sentence: "The Company is in the process of a multi-year phased upgrade of its digital and productivity capabilities and ERP system replacement."
Removed sentence: "It also uses various other hardware, software and operating systems that may need to be upgraded or replaced in the near future as such systems cease to be supported by third-party service providers, and may be vulnerable to increased risks, including the risk of further security breaches, system failures and disruptions."
Removed sentence: "Any such upgrade could take time, oversight and be costly to the Company, and may include potential challenges, such as the cost of training personnel, data migration, the potential instability of the new system and cost overruns."
Removed sentence: "If such systems are not successfully upgraded or replaced in a timely manner, system outages, disruptions or delays, or other issues may arise."
Removed sentence: "If a new system does not function properly or is not adequately supported by third-party service providers and processes, it could adversely affect the Company’s business and operations, which, in turn, could adversely impact the Company’s results of operations and cash flows."
Removed sentence: "The IT/OT systems of the Company, its customers, business partners, suppliers, and third-party providers have been, and will continue to be, subject to cyber-threats such as computer viruses or other malicious codes, security breaches, ransomware, unauthorized access attempts, business email compromise, data encryption or exfiltration, cyber extortion, denial of service attacks, phishing, deepfakes, social engineering, unintentional or malicious actions of employees or contractors, hacking and other cyberattacks attempting to exploit vulnerabilities by hackers, criminal groups, nation-states and nation-state-sponsored organizations and social-activist organizations."
Removed sentence: "The Company experienced a cyberattack in August 2023 and may continue to experience an increase in the number of such attacks, which may result in unauthorized access, disclosure and misuse of customer, employee, vendor, Company, or consumer information, including personal consumer information obtained through online and e-commerce sales, and online activities, including promotions, rebates and customer loyalty programs, as well as increased costs related to the Company’s involvement in investigations or notifications conducted by the Company’s business partners."
Added sentence: "To conduct its business, the Company relies extensively on IT and operational technology (OT) systems, many of which are managed, hosted, provided and/or used by third parties and their vendors."
Added sentence: "These systems include, but are not limited to, programs and processes relating to core business operations, including communications, supply chain management, transaction processing, data storage, and financial reporting."
Added sentence: "The Company completed the replacement of its ERP system in January 2026 as part of a broader, multi-year upgrade of its digital and productivity capabilities."
Added sentence: "It also uses various other hardware, software and operating systems that may need to be upgraded or replaced in the near future as such systems cease to be supported by third-party service providers and may be vulnerable to security breaches, system failures or disruptions."
Added sentence: "Any such upgrade could take time and be costly, and may include challenges such as data migration, system integration and training."
Added sentence: "Similar risks may arise in connection with integrating the systems and infrastructure of acquired businesses, including those of GOJO, which may introduce compatibility or integration challenges, data migration risks and potential security vulnerabilities during the integration process."
Added sentence: "If such systems are not successfully upgraded or replaced in a timely manner, or do not function properly or are not adequately supported by third-party service providers, the Company may experience operational disruptions that could adversely affect its business, results of operations and cash flows."
Added sentence: "Over the past few years, cyberattacks have become more prevalent and increasingly sophisticated, including through the use of artificial intelligence, which may increase the speed and effectiveness of attacks and limit the ability to detect and respond in a timely manner."
Added sentence: "The IT/OT systems of the Company, its customers, business partners, suppliers, and third-party providers have been, and will continue to be, subject to cyber-threats, including malware, ransomware, unauthorized access and other attacks."
Added sentence: "The Company experienced a cyberattack in August 2023 and may continue to experience an increase in the number of such attacks, which may result in unauthorized access to or disclosure of information and increased response and remediation costs."
Added sentence: "Threat actors may leverage such technologies to identify and exploit vulnerabilities more rapidly, develop more effective and complex attack vectors, and automate large-scale campaigns, including phishing and social engineering campaigns, and malicious code generation, which may reduce the time between the identification of a vulnerability by a threat actor and its exploitation."
Added sentence: "In addition, threat actors are increasingly targeting identity and access controls as a primary attack vector, using compromised or fraudulently obtained credentials to gain unauthorized access to systems and data."
Added sentence: "Such attacks may involve impersonation, credential theft, or the abuse of legitimate user privileges, allowing attackers to bypass traditional security controls and move laterally within the Company."
Added sentence: "Threat actors may also exploit trusted relationships with third-party service providers or leverage compromised non-human identities, such as service accounts or automated processes, to gain indirect access to the Company’s system and data."
Added sentence: "As a result, these evolving capabilities may increase the likelihood, severity, and impact of cybersecurity incidents affecting the Company, its third-party service providers or its broader supply chain."
Added sentence: "These risks may be heightened during periods of system implementation, stabilization or integration, and the integration of acquired businesses."
Removed sentence: "The security efforts of the Company and its third-party providers may not prevent or timely detect future attacks and resulting breaches or breakdowns of its databases or systems."
Removed sentence: "These attacks may also be difficult to detect for periods of time and, even if detected, the nature and extent of the incident may not be immediately clear and an investigation into an incident could take a significant amount of time to complete."
Removed sentence: "These factors may inhibit the Company’s ability to provide rapid, complete, and reliable information about the cybersecurity incident to customers, counterparties, and regulators, as well as the public."
Removed sentence: "The Company has in place disaster recovery and business continuity plans to address Company and third-party incidents, but if these plans or those of its third-party providers are not sufficient or comprehensive, or do not effectively resolve such breaches or breakdowns on a timely basis or at all, the Company may experience interruptions in its ability to manage or conduct business, as well as reputational harm, governmental fines, penalties, regulatory proceedings, litigation and remediation expenses, adverse impacts on employee morale, loss of customers or consumers, as well as heightened regulatory and legal scrutiny."
Removed sentence: "The need to coordinate with various third-party service providers, including with respect to timely notification and access to personnel and information concerning an incident, may complicate the Company’s efforts to address issues that arise."
Removed sentence: "As a result, the Company is subject to the risk that the activities associated with its third-party service providers can adversely affect its business, financial condition and results of operations, even if the attack or breach does not directly impact its systems or information."
Removed sentence: "Cyber-threats and techniques are becoming more sophisticated and are constantly evolving and are being made by groups and individuals with a wide range of expertise and motives, and this increases the difficulty of detecting and successfully defending against them."
Removed sentence: "Continued geopolitical instability has also heightened the risk of cyberattacks."
Added sentence: "The security efforts of the Company and its third-party providers may not prevent or timely detect cyber incidents."
Added sentence: "Such incidents may be difficult to detect or assess, which may delay response and remediation efforts and limit the Company’s ability to provide timely and accurate information to customers, counterparties, regulators, and the public."
Added sentence: "The Company has in place disaster recovery and business continuity plans to address Company and third-party incidents, but if these plans or those of its third-party providers are ineffective or not implemented successfully, the Company may experience operational disruptions, unauthorized access to or disclosure of sensitive information, remediation costs, investigations, litigation, reputational harm, governmental fines, penalties, loss of customers or business partners, as well as heightened regulatory and legal scrutiny."
Added sentence: "Reliance on third-party service providers and interconnected systems may further complicate incident response efforts and expose the Company to risks arising from their activities, including incidents that originate with or affect third parties."
Added sentence: "These risks may be heightened following acquisitions, including GOJO, as the Company integrates additional third-party vendors, systems and data environments."
Added sentence: "In addition, data breaches or theft of personal information collected by the Company and its third-party service providers as well as data breaches or theft of Company information and assets have occurred in the past and may occur in the future."
Added sentence: "The Company is subject to the laws and regulations of various countries where it operates related to solicitation, collection, processing, transferring, storing or use of consumer, customer, business partner or employee information or related data."
Removed sentence: "Increased regulation of data collection, use, and retention practices, including self-regulation and industry standards, changes in existing laws and regulations, including reporting requirements, enactment of new laws and regulations, increased enforcement activity, and changes in interpretation of laws, could increase the Company's cost of compliance and operation, limit its ability to grow its business or otherwise harm its business."
Removed sentence: "In addition, data breaches or theft of personal information collected by the Company and its third-party service providers as well as data breaches or theft of Company information and assets have occurred in the past and may occur in the future."
Removed sentence: "The Company is subject to the laws and regulations of various countries where it operates or does business related to solicitation, collection, processing, transferring, storing or use of consumer, customer, business partner or employee information or related data."
Removed sentence: "These laws and regulations change frequently, and new legislation continues to be introduced and may include different standards and requirements, be interpreted and applied differently from jurisdiction to jurisdiction and create inconsistent or conflicting requirements."
Removed sentence: "The changes introduced by data privacy and protection regulations increase the complexity of regulations enacted to protect business and personal data and subject the Company to additional costs and have required, and may in the future require, costly changes to the Company’s security systems, policies, procedures and practices."
Added sentence: "These requirements are increasingly complex, vary across jurisdictions, and continue to evolve, subjecting the Company to additional costs and potentially requiring costly changes to the Company's security systems, policies, procedures and practices."

Current (2026):

Read full text

To conduct its business, the Company relies extensively on IT and operational technology (OT) systems, many of which are managed, hosted, provided and/or used by third parties and their vendors. These systems include, but are not limited to, programs and processes relating to core business operations, including communications, supply chain management, transaction processing, data storage, and financial reporting.

The Company completed the replacement of its ERP system in January 2026 as part of a broader, multi-year upgrade of its digital and productivity capabilities. It also uses various other hardware, software and operating systems that may need to be upgraded or replaced in the near future as such systems cease to be supported by third-party service providers and may be vulnerable to security breaches, system failures or disruptions. Any such upgrade could take time and be costly, and may include challenges such as data migration, system integration and training. Similar risks may arise in connection with integrating the systems and infrastructure of acquired businesses, including those of GOJO, which may introduce compatibility or integration challenges, data migration risks and potential security vulnerabilities during the integration process. If such systems are not successfully upgraded or replaced in a timely manner, or do not function properly or are not adequately supported by third-party service providers, the Company may experience operational disruptions that could adversely affect its business, results of operations and cash flows.

Over the past few years, cyberattacks have become more prevalent and increasingly sophisticated, including through the use of artificial intelligence, which may increase the speed and effectiveness of attacks and limit the ability to detect and respond in a timely manner. The IT/OT systems of the Company, its customers, business partners, suppliers, and third-party providers have been, and will continue to be, subject to cyber-threats, including malware, ransomware, unauthorized access and other attacks.

The Company experienced a cyberattack in August 2023 and may continue to experience an increase in the number of such attacks, which may result in unauthorized access to or disclosure of information and increased response and remediation costs. The rapid evolution and increased adoption of emerging technologies, such as artificial intelligence, may also increase the frequency and magnitude of cyberattacks on the Company and amplify its cybersecurity risks. Threat actors may leverage such technologies to identify and exploit vulnerabilities more rapidly, develop more effective and complex attack vectors, and automate large-scale campaigns, including phishing and social engineering campaigns, and malicious code generation, which may reduce the time between the identification of a vulnerability by a threat actor and its exploitation. In addition, threat actors are increasingly targeting identity and access controls as a primary attack vector, using compromised or fraudulently obtained credentials to gain unauthorized access to systems and data. Such attacks may involve impersonation, credential theft, or the abuse of legitimate user privileges, allowing attackers to bypass traditional security controls and move laterally within the Company. Threat actors may also exploit trusted relationships with third-party service providers or leverage compromised non-human identities, such as service accounts or automated processes, to gain indirect access to the Company’s system and data. As a result, these evolving capabilities may increase the likelihood, severity, and impact of cybersecurity incidents affecting the Company, its third-party service providers or its broader supply chain. These risks may be heightened during periods of system implementation, stabilization or integration, and the integration of acquired businesses. In addition, while the Company has purchased cybersecurity insurance, costs related to a cyberattack may exceed the amount of insurance coverage or be excluded under the terms of its cybersecurity insurance policy. The Company may be unable to obtain cybersecurity insurance in amounts and on terms the Company views as appropriate for its operations.

The security efforts of the Company and its third-party providers may not prevent or timely detect cyber incidents. Such incidents may be difficult to detect or assess, which may delay response and remediation efforts and limit the Company’s ability to provide timely and accurate information to customers, counterparties, regulators, and the public. The Company has in place disaster recovery and business continuity plans to address Company and third-party incidents, but if these plans or those of its third-party providers are ineffective or not implemented successfully, the Company may experience operational disruptions, unauthorized access to or disclosure of sensitive information, remediation costs, investigations, litigation, reputational harm, governmental fines, penalties, loss of customers or business partners, as well as heightened regulatory and legal scrutiny. Reliance on third-party service providers and interconnected systems may further complicate incident response efforts and expose the Company to risks arising from their activities, including incidents that originate with or affect third parties. These risks may be heightened following acquisitions, including GOJO, as the Company integrates additional third-party vendors, systems and data environments.

In addition, data breaches or theft of personal information collected by the Company and its third-party service providers as well as data breaches or theft of Company information and assets have occurred in the past and may occur in the future. The Company is subject to the laws and regulations of various countries where it operates related to solicitation, collection, processing, transferring, storing or use of consumer, customer, business partner or employee information or related data. The Company has incurred, and will continue to incur, expenses to comply with privacy and data protection standards and protocols imposed by law, regulation, industry standards and contractual obligations. These requirements are increasingly complex, vary across jurisdictions, and continue to evolve, subjecting the Company to additional costs and potentially requiring costly changes to the Company's security systems, policies, procedures and practices. These laws and regulations also may result in the Company incurring additional expenses and liabilities in the event of unauthorized access to or disclosure of personal data.

View prior text (2025)

To conduct its business, the Company relies extensively on IT and OT systems, many of which are managed, hosted, provided and/or used by third parties and their vendors. These systems include, but are not limited to, programs and processes relating to communicating within the Company and with customers, consumers, business partners, investors and other parties; ordering and managing materials from suppliers; converting materials to finished products; receiving and processing purchase orders and shipping products to customers; processing transactions; storing, processing and transmitting data, including personal confidential information and historical payment card industry data; hosting, processing and sharing confidential and proprietary research, business and financial information; and complying with financial reporting, regulatory, legal and tax requirements.

The Company is in the process of a multi-year phased upgrade of its digital and productivity capabilities and ERP system replacement. It also uses various other hardware, software and operating systems that may need to be upgraded or replaced in the near future as such systems cease to be supported by third-party service providers, and may be vulnerable to increased risks, including the risk of further security breaches, system failures and disruptions. Any such upgrade could take time, oversight and be costly to the Company, and may include potential challenges, such as the cost of training personnel, data migration, the potential instability of the new system and cost overruns. If such systems are not successfully upgraded or replaced in a timely manner, system outages, disruptions or delays, or other issues may arise. If a new system does not function properly or is not adequately supported by third-party service providers and processes, it could adversely affect the Company’s business and operations, which, in turn, could adversely impact the Company’s results of operations and cash flows.

The IT/OT systems of the Company, its customers, business partners, suppliers, and third-party providers have been, and will continue to be, subject to cyber-threats such as computer viruses or other malicious codes, security breaches, ransomware, unauthorized access attempts, business email compromise, data encryption or exfiltration, cyber extortion, denial of service attacks, phishing, deepfakes, social engineering, unintentional or malicious actions of employees or contractors, hacking and other cyberattacks attempting to exploit vulnerabilities by hackers, criminal groups, nation-states and nation-state-sponsored organizations and social-activist organizations. The Company experienced a cyberattack in August 2023 and may continue to experience an increase in the number of such attacks, which may result in unauthorized access, disclosure and misuse of customer, employee, vendor, Company, or consumer information, including personal consumer information obtained through online and e-commerce sales, and online activities, including promotions, rebates and customer loyalty programs, as well as increased costs related to the Company’s involvement in investigations or notifications conducted by the Company’s business partners. The rapid evolution and increased adoption of emerging technologies, such as artificial intelligence, may also increase the frequency and magnitude of cyberattacks on the Company and amplify its cybersecurity risks. In addition, while the Company has purchased cybersecurity insurance, costs related to a cyberattack may exceed the amount of insurance coverage or be excluded under the terms of its cybersecurity insurance policy. The Company may be unable to obtain cybersecurity insurance in amounts and on terms the Company views as appropriate for its operations.

The security efforts of the Company and its third-party providers may not prevent or timely detect future attacks and resulting breaches or breakdowns of its databases or systems. These attacks may also be difficult to detect for periods of time and, even if detected, the nature and extent of the incident may not be immediately clear and an investigation into an incident could take a significant amount of time to complete. These factors may inhibit the Company’s ability to provide rapid, complete, and reliable information about the cybersecurity incident to customers, counterparties, and regulators, as well as the public. The Company has in place disaster recovery and business continuity plans to address Company and third-party incidents, but if these plans or those of its third-party providers are not sufficient or comprehensive, or do not effectively resolve such breaches or breakdowns on a timely basis or at all, the Company may experience interruptions in its ability to manage or conduct business, as well as reputational harm, governmental fines, penalties, regulatory proceedings, litigation and remediation expenses, adverse impacts on employee morale, loss of customers or consumers, as well as heightened regulatory and legal scrutiny. The need to coordinate with various third-party service providers, including with respect to timely notification and access to personnel and information concerning an incident, may complicate the Company’s efforts to address issues that arise. As a result, the Company is subject to the risk that the activities associated with its third-party service providers can adversely affect its business, financial condition and results of operations, even if the attack or breach does not directly impact its systems or information.

Cyber-threats and techniques are becoming more sophisticated and are constantly evolving and are being made by groups and individuals with a wide range of expertise and motives, and this increases the difficulty of detecting and successfully defending against them. Continued geopolitical instability has also heightened the risk of cyberattacks. The Company has incurred, and will continue to incur, expenses to comply with privacy and data protection standards and protocols imposed by law, regulation, industry standards and contractual obligations. Increased regulation of data collection, use, and retention practices, including self-regulation and industry standards, changes in existing laws and regulations, including reporting requirements, enactment of new laws and regulations, increased enforcement activity, and changes in interpretation of laws, could increase the Company's cost of compliance and operation, limit its ability to grow its business or otherwise harm its business.

In addition, data breaches or theft of personal information collected by the Company and its third-party service providers as well as data breaches or theft of Company information and assets have occurred in the past and may occur in the future. The Company is subject to the laws and regulations of various countries where it operates or does business related to solicitation, collection, processing, transferring, storing or use of consumer, customer, business partner or employee information or related data. These laws and regulations change frequently, and new legislation continues to be introduced and may include different standards and requirements, be interpreted and applied differently from jurisdiction to jurisdiction and create inconsistent or conflicting requirements. The changes introduced by data privacy and protection regulations increase the complexity of regulations enacted to protect business and personal data and subject the Company to additional costs and have required, and may in the future require, costly changes to the Company’s security systems, policies, procedures and practices. These laws and regulations also may result in the Company incurring additional expenses and liabilities in the event of unauthorized access to or disclosure of personal data.

2026: Failure of key technology systems, cyberattacks, privacy breaches or data breaches could have a material adverse effect on the Company’s business, financial condition, results of operations and reputation. — exact passage unavailable; open filing

2025: Failure of key technology systems, cyberattacks, privacy breaches or data breaches could have a material adverse effect on the Company’s business, financial condition, results of operations and reputation. — exact passage unavailable; open filing

Clorox Company: 10-K Risk Factor Changes

Disclosure overview

Failure of key technology systems, cyberattacks, privacy breaches or data breaches could have a material adverse effect on the Company’s business, financial condition, results of operations and reputation.