Risks from cybersecurity and physical threats to energy infrastructures are increasing. Threat actors, including sophisticated nation-state actors, continue to seek to exploit potential vulnerabilities in the electric and natural gas utility industry, grid infrastructure, and other energy infrastructures, and attacks and disruptions, both physical, cyber, and hybrid targeting physical and cyber assets, are becoming increasingly sophisticated and dynamic. Several U.S. government agencies have warned of increased risks related to physical attacks, ransomware attacks and cybersecurity threats related to the energy sector and its supply chains, and that the risks may escalate during periods of heightened geopolitical tensions. Continued implementation of advanced digital technologies increases the potentially unfavorable impacts of such attacks. In addition, the rapid evolution and increased adoption of artificial intelligence technologies may intensify the Registrants' cybersecurity risks.
A security breach of the Registrants' physical assets or information systems or those of the Registrants' competitors, vendors, business partners and interconnected entities (including RTOs and ISOs) could materially impact Registrants by, among other things, impairing the availability of electricity and gas distributed by Registrants and/or the reliability of transmission and distribution systems, damaging grid infrastructure, interrupting critical business functions, impairing the availability of vendor services and materials that the Registrants rely on to maintain their operations, or by leading to the theft or inappropriate release of certain types of information, including critical infrastructure information, system data and architecture, sensitive customer, vendor, or employee data, or other confidential data. The Registrants' reliance on vendors to provide services and equipment, and its shared information systems with Constellation pursuant to the Transition Services Agreement between Exelon and Constellation, increases the risk to assets, systems, and data. While some of the Registrants' vendors have experienced cybersecurity incidents, such incidents have not, to Registrants' knowledge, resulted in material impact to any of the Registrants to date. The risk of these events and security breaches occurring continues to intensify. The Registrants have been, and will likely continue to be, subjected to physical and cyber-attacks. While to date none of the Registrants has directly experienced a material breach or material disruption to its network or information systems or operations, as such attacks continue to increase in sophistication and frequency, the Registrants may be subject to a material breach or material disruption in the future.
If a significant physical or cybersecurity breach or disruption were to occur, the Registrants' reputation could be negatively affected, customer confidence in the Registrants could be diminished and the Registrants could be subject to legal claims, regulatory exposure, loss of revenues, increased costs including for infrastructure repairs, or operations shutdown, all of which could materially affect the Registrants' financial condition and materially damage its business reputation. Moreover, the amount and scope of insurance maintained against losses resulting from any such security breaches or disruptions may not be sufficient to cover losses or otherwise adequately compensate for any disruptions to business that could result. The continued increase in Federal and state regulatory requirements related to cybersecurity and evolving threat actor-capabilities could require changes to current measures taken by the Registrants or to their business operations and could adversely affect their consolidated financial statements.