The Company has previously experienced and expects to continue to experience attempts by unauthorized parties to compromise the Company’s cybersecurity controls, like the 2018 ransomware attack. The Company has also experienced and expects to continue to experience similar attempts by threat actors to penetrate the systems of third-party suppliers and vendors to whom the Company has provided data, like the 2019 AMCA data breach. These attempts, if successful, could result in the misappropriation or compromise of personal information or proprietary or confidential information stored within the Company's systems or within the systems of third parties, create system disruptions or cause shutdowns. Threat actors have a variety of attack methods, including without limitation, by developing and deploying viruses, worms, and other malicious software programs that attack the Company’s systems, the systems of third-parties, or otherwise exploit any security vulnerabilities. In addition, the increased use of AI by threat actors is enhancing the scale sophistication and effectiveness of their cyberattacks. Outside parties may also attempt to fraudulently induce employees to take actions, including the release of confidential or sensitive information or to make fraudulent payments through illegal electronic spamming, phishing, spear phishing, and other tactics.
The Company has implemented a formal cybersecurity program; however, because the techniques used by threat actors to obtain unauthorized access, disable or degrade service, or sabotage systems continue to evolve (and often are not recognized until launched against a target), the Company may be unable to anticipate and/or implement appropriate controls needed to
Index
Index
protect against these evolving threats. In addition, as cyber threats continue to evolve including the use of AI by threat actors to compromise systems, the Company may be required to expend additional resources to continue to enhance the Company’s cybersecurity measures or to investigate and remediate any cybersecurity vulnerabilities. The Company’s remediation efforts may not be sufficient and could result in interruptions, delays, cessation of service, loss of data integrity, loss of confidentiality, and/or loss of data. This could also impact the cost and availability of cyber insurance to the Company. Cybersecurity incidents affecting the Company’s or third parties' security measures and the unauthorized dissemination of personal, proprietary or confidential information about the Company or its customers or other third parties could expose customers’ private information. Such incidents could expose customers to the risk of financial or medical identity theft or expose the Company or other third parties to a risk of loss or misuse of this information, result in litigation and potential liability for the Company, damage the Company’s brand and reputation, or otherwise harm the Company’s business. Any of these incidents could have a material adverse effect on the Company’s business, regulatory compliance, financial condition, reputation, and/or results of operations.
In addition, the Company faces increased cybersecurity risks due to the number of employees that continue to work remotely, which remains at levels higher than prior to the COVID-19 pandemic as a result of changes in the workplace and to management and employee expectations. Increased levels of remote access create additional opportunities for cybercriminals to exploit vulnerabilities, and employees may be more susceptible to phishing and social engineering attempts. In addition, technological resources may become strained due to the number of remote users.