Estee Lauder Companies Inc.: 10-K Risk Factor Changes

The outbreak and global spread of the COVID-19 pandemic has continued to significantly disrupt our operating environment, including retail stores, travel retail, and the ability of some of our customers to operate. We have also seen shifts in consumer preferences and practices. Considerable uncertainty remains regarding this pandemic, including responsive measures being taken by various authorities and others. As we continue to monitor COVID-19 developments, including the impacts on our consumers, customers and suppliers, we have taken and will continue to take further measures. Some of the actions we take could adversely impact our business, and there is no certainty that our actions will be sufficient to mitigate the risks and the impacts of COVID-19. The degree to which COVID-19 continues to impact our business will depend on future developments that are highly uncertain and cannot be predicted, many of which are outside our control, including the extent to which there are sustainable improvements in the retail environment and general economic conditions.

We rely on information technology that supports our business processes, including product development, marketing, sales, order processing, production, distribution, finance and intracompany communications throughout the world. We have e-commerce, m-commerce and other Internet websites in the United States and many other countries. These systems may be susceptible to outages due to fire, floods, power loss, telecommunications failures, break-ins and other events. Our systems and data may be vulnerable to constantly evolving cybersecurity threats such as malware, break-ins and similar disruptions from unauthorized tampering. The occurrence of these or other events could disrupt or damage our information technology, including operational technology, and adversely affect our business. Insurance policies that may provide coverage with regard to such events may not cover any or all of the resulting financial losses. 22 22 22 Table of Contents Table of Contents

We are dependent upon automated information technology processes. As part of our normal business activities, we collect and store certain information that is confidential, proprietary or otherwise sensitive, including personal information with respect to customers, consumers and employees. We share some of this information with certain vendors who assist us with business matters. Moreover, the success of our e-commerce and m-commerce operations depends upon the secure transmission of confidential and personal data over public networks, including the use of cashless payments. Any failure on the part of us or our vendors to maintain the security of our confidential data and personal information, including via the penetration of our network security and the misappropriation of confidential and personal information, could result in business disruption, damage to our reputation, financial obligations to third parties, fines, penalties, regulatory proceedings and private litigation with potentially large costs, and also result in deterioration in our employees’, consumers’ and customers’ confidence in us and other competitive disadvantages, and thus could have a material adverse effect on our business. In addition, a security or data privacy breach could require that we expend significant additional resources to enhance our information security systems and could result in a disruption to our operations. Furthermore, third parties, including our suppliers and customers, also rely on information technology and may be subject to cybersecurity breaches that could impact their businesses and could in turn disrupt our supply chain and/or our business.

Our implementation, maintenance and utilization of global information technology, including operational technology, supply chain and finance systems, human resource management systems, creative asset management and retail operating systems, as well as associated hardware and use of cloud-based models, involve risks and uncertainties. Failure to implement, maintain or utilize these and other systems as planned, in terms of timing, specifications, security policies, costs, or otherwise, could have a material adverse effect on our business.