Old Dominion Freight Line Inc.: 10-K Risk Factor Changes

Provisions of our articles of incorporation, bylaws and the laws of Virginia, the state in which we are incorporated, may discourage, delay or prevent a change in control of us or a change in management that shareholders may consider favorable. These provisions: •limit who may call a special meeting of shareholders; limit who may call a special meeting of shareholders; •require shareholder action by written consent to be unanimous; require shareholder action by written consent to be unanimous; •establish advance notice and other substantive and procedural requirements for nominations for election to our Board or for proposing matters that can be acted upon at shareholder meetings; establish advance notice and other substantive and procedural requirements for nominations for election to our Board or for proposing matters that can be acted upon at shareholder meetings; •may make it difficult to merge with or otherwise absorb a Virginia corporation acquired in a tender offer for the three years after the acquisition; and may make it difficult to merge with or otherwise absorb a Virginia corporation acquired in a tender offer for the three years after the acquisition; and •may make an unsolicited attempt to gain control of us more difficult by restricting the right of specified shareholders to vote newly acquired large blocks of stock. may make an unsolicited attempt to gain control of us more difficult by restricting the right of specified shareholders to vote newly acquired large blocks of stock. ITEM 1B. UNRESOLVED STAFF COMMENTS None. ITEM 1C. CYBERSECURITYThe Board, through its Risk Committee, oversees the Company’s risk identification, risk tolerance, and management practices for enterprise risks facing the Company, including, but not limited to, risks associated with technology and operations, such as cybersecurity and cyber incident analysis and assessment. Our cybersecurity policies, standards, processes and practices are fully integrated into our enterprise risk management (“ERM”) program and are based on recognized frameworks established by the National Institute of Standards and Technology and other applicable industry best practices. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on protecting our systems to support our business operations, preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively assessing and, if and as needed, responding to any cybersecurity threats and/or incidents. Risk Management and Strategy Key elements of our cybersecurity program include the following:•The Board’s oversight of cybersecurity risk management is supported by the Risk Committee, which regularly interacts with our ERM function, our Director of Information Security, and other members of the OD Technology Department. ITEM 1C. CYBERSECURITY The Board, through its Risk Committee, oversees the Company’s risk identification, risk tolerance, and management practices for enterprise risks facing the Company, including, but not limited to, risks associated with technology and operations, such as cybersecurity and cyber incident analysis and assessment. Our cybersecurity policies, standards, processes and practices are fully integrated into our enterprise risk management (“ERM”) program and are based on recognized frameworks established by the National Institute of Standards and Technology and other applicable industry best practices. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on protecting our systems to support our business operations, preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively assessing and, if and as needed, responding to any cybersecurity threats and/or incidents. The Board, through its Risk Committee, oversees the Company’s risk identification, risk tolerance, and management practices for enterprise risks facing the Company, including, but not limited to, risks associated with technology and operations, such as cybersecurity and cyber incident analysis and assessment. Our cybersecurity policies, standards, processes and practices are fully integrated integrated into our enterprise risk management (“ERM”) program and are based on recognized frameworks established by the National Institute of Standards and Technology and other applicable industry best practices. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on protecting our systems to support our business operations, preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively assessing and, if and as needed, responding to any cybersecurity threats and/or incidents. Risk Management and Strategy Key elements of our cybersecurity program include the following: •The Board’s oversight of cybersecurity risk management is supported by the Risk Committee, which regularly interacts with our ERM function, our Director of Information Security, and other members of the OD Technology Department. The Board’s oversight of cybersecurity risk management is supported by the Risk Committee, which regularly interacts with our ERM function, our Director of Information Security, and other members of the OD Technology Department. 18 18 •We have implemented a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and/or incidents, while also implementing controls and procedures that provide for the prompt escalation of cybersecurity incidents as appropriate (including information that is conveyed to the Board under certain circumstances) so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.•We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. •We have established and maintain comprehensive incident response and recovery plans that are designed to help us to timely and efficiently respond to a cybersecurity incident, and such plans are tested and evaluated on at least an annual basis. •We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. •We provide regular, mandatory training for employees regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.Our Internal Audit Department, as part of its audit plan that is approved by the Audit Committee of the Board, conducts information technology audits as well as periodically engages third parties to perform cybersecurity attack and penetration assessments. We also use third parties to periodically benchmark and assess our cybersecurity readiness and to assess how any known vulnerabilities might impact our Company as well as the sufficiency of our response. The results generated from these activities are reported to management and are used to develop action plans to address any identified opportunities for risk mitigation and overall improvement. The Risk Committee of our Board is apprised by management of the results of the third-party analysis, any related action plans, and progress against those plans. Management, together with members of our OD Technology Department, brief the Board directly, or through their communications with the Risk Committee, on information security matters on at least a quarterly basis. After gathering and assessing information about our risk exposure, the Risk Committee reports the results of its review to the Board on a regular basis.Please refer to “Risks Related to Cybersecurity and Technology Matters” under Item 1A, “Risk Factors” above for a discussion of the risks from cybersecurity threats and the potential impact to our strategy, results of operations and financial condition. Governance The Board and the Risk Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations. The Board and the Risk Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident.Our Director of Information Security, the management position responsible for assessing and managing material risks from cybersecurity threats, has served in various roles in information technology and information security for over 30 years, and is a Certified Information Systems Security Professional (CISSP). He and other members of the OD Technology Department work collaboratively across the Company and have implemented programs designed to protect our information systems from cybersecurity threats and position our Company to promptly respond, in coordination with various members of our senior management team, to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to any cybersecurity incidents. Through ongoing communications and collaboration with these teams, including members of our senior management team, as appropriate, our Director of Information Security monitors the prevention, detection, mitigation and remediation of any cybersecurity threats and incidents in real time, and reports any such threats and incidents to the Risk Committee when appropriate. •We have implemented a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and/or incidents, while also implementing controls and procedures that provide for the prompt escalation of cybersecurity incidents as appropriate (including information that is conveyed to the Board under certain circumstances) so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.•We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. •We have established and maintain comprehensive incident response and recovery plans that are designed to help us to timely and efficiently respond to a cybersecurity incident, and such plans are tested and evaluated on at least an annual basis. •We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. •We provide regular, mandatory training for employees regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.Our Internal Audit Department, as part of its audit plan that is approved by the Audit Committee of the Board, conducts information technology audits as well as periodically engages third parties to perform cybersecurity attack and penetration assessments. We also use third parties to periodically benchmark and assess our cybersecurity readiness and to assess how any known vulnerabilities might impact our Company as well as the sufficiency of our response. The results generated from these activities are reported to management and are used to develop action plans to address any identified opportunities for risk mitigation and overall improvement. The Risk Committee of our Board is apprised by management of the results of the third-party analysis, any related action plans, and progress against those plans. Management, together with members of our OD Technology Department, brief the Board directly, or through their communications with the Risk Committee, on information security matters on at least a quarterly basis. After gathering and assessing information about our risk exposure, the Risk Committee reports the results of its review to the Board on a regular basis.Please refer to “Risks Related to Cybersecurity and Technology Matters” under Item 1A, “Risk Factors” above for a discussion of the risks from cybersecurity threats and the potential impact to our strategy, results of operations and financial condition. Governance The Board and the Risk Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations. The Board and the Risk Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident.Our Director of Information Security, the management position responsible for assessing and managing material risks from cybersecurity threats, has served in various roles in information technology and information security for over 30 years, and is a Certified Information Systems Security Professional (CISSP). He and other members of the OD Technology Department work collaboratively across the Company and have implemented programs designed to protect our information systems from cybersecurity threats and position our Company to promptly respond, in coordination with various members of our senior management team, to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to any cybersecurity incidents. Through ongoing communications and collaboration with these teams, including members of our senior management team, as appropriate, our Director of Information Security monitors the prevention, detection, mitigation and remediation of any cybersecurity threats and incidents in real time, and reports any such threats and incidents to the Risk Committee when appropriate. •We have implemented a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and/or incidents, while also implementing controls and procedures that provide for the prompt escalation of cybersecurity incidents as appropriate (including information that is conveyed to the Board under certain circumstances) so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. We have implemented a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and/or incidents, while also implementing controls and procedures that provide for the prompt escalation of cybersecurity incidents as appropriate (including information that is conveyed to the Board under certain circumstances) so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. •We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. •We have established and maintain comprehensive incident response and recovery plans that are designed to help us to timely and efficiently respond to a cybersecurity incident, and such plans are tested and evaluated on at least an annual basis. We have established and maintain comprehensive incident response and recovery plans that are designed to help us to timely and efficiently respond to a cybersecurity incident, and such plans are tested and evaluated on at least an annual basis. •We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks •We provide regular, mandatory training for employees regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. We provide regular, mandatory training for employees regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. Our Internal Audit Department, as part of its audit plan that is approved by the Audit Committee of the Board, conducts information technology audits as well as periodically engages third parties to perform cybersecurity attack and penetration assessments. We also use third parties to periodically benchmark and assess our cybersecurity readiness and to assess how any known vulnerabilities might impact our Company as well as the sufficiency of our response. The results generated from these activities are reported to management and are used to develop action plans to address any identified opportunities for risk mitigation and overall improvement. The Risk Committee of our Board is apprised by management of the results of the third-party analysis, any related action plans, and progress against those plans. Management, together with members of our OD Technology Department, brief the Board directly, or through their communications with the Risk Committee, on information security matters on at least a quarterly basis. After gathering and assessing information about our risk exposure, the Risk Committee reports the results of its review to the Board on a regular basis. engages Please refer to “Risks Related to Cybersecurity and Technology Matters” under Item 1A, “Risk Factors” above for a discussion of the risks from cybersecurity threats and the potential impact to our strategy, results of operations and financial condition. Governance The Board and the Risk Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations. The Board and the Risk Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident.Our Director of Information Security, the management position responsible for assessing and managing material risks from cybersecurity threats, has served in various roles in information technology and information security for over 30 years, and is a Certified Information Systems Security Professional (CISSP). He and other members of the OD Technology Department work collaboratively across the Company and have implemented programs designed to protect our information systems from cybersecurity threats and position our Company to promptly respond, in coordination with various members of our senior management team, to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to any cybersecurity incidents. Through ongoing communications and collaboration with these teams, including members of our senior management team, as appropriate, our Director of Information Security monitors the prevention, detection, mitigation and remediation of any cybersecurity threats and incidents in real time, and reports any such threats and incidents to the Risk Committee when appropriate. The Board and the Risk Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations. The Board and the Risk Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident. The Board and the Risk Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations. The Board and the Risk Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident. Our Director of Information Security, the management position responsible for assessing and managing material risks from cybersecurity threats, has served in various roles in information technology and information security for over 30 years, and is a Certified Information Systems Security Professional (CISSP). He and other members of the OD Technology Department work collaboratively across the Company and have implemented programs designed to protect our information systems from cybersecurity threats and position our Company to promptly respond, in coordination with various members of our senior management team, to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to any cybersecurity incidents. Through ongoing communications and collaboration with these teams, including members of our senior management team, as appropriate, our Director of Information Security monitors the prevention, detection, mitigation and remediation of any cybersecurity threats and incidents in real time, and reports any such threats and incidents to the Risk Committee when appropriate. Our Director of Information Security, the management position responsible for assessing and managing material risks from cybersecurity threats, has served in various roles in information technology and information security for over 30 years, and is a Certified Information Systems Security Professional (CISSP). He and other members of the OD Technology Department work collaboratively across the Company and have implemented programs designed to protect our information systems from cybersecurity threats and position our Company to promptly respond, in coordination with various members of our senior management team, to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to any cybersecurity incidents. Through ongoing communications and collaboration with these teams, including members of our senior management team, as appropriate, our Director of Information Security monitors the prevention, detection, mitigation and remediation of any cybersecurity threats and incidents in real time, and reports any such threats and incidents to the Risk Committee when appropriate. Our Director of Information Security, the management position responsible for assessing and managing material risks from cybersecurity threats, has served in various roles in information technology and information security for over 30 years, and is a Certified Information Systems Security Professional (CISSP). Our Director of Information Security, the management position responsible for assessing and managing material risks from cybersecurity threats, has served in various roles in information technology and information security Director of Information Security, the management position responsible for assessing and managing material risks from cybersecurity threats, has served in various roles in information technology and information security for over 30 years, and is a Certified Information Systems Security Professional (CISSP). He and other members of the OD Technology Department work collaboratively across the Company and have implemented programs designed to protect our information systems from cybersecurity threats and position our Company to promptly respond, in coordination with various members of our senior management team, to any cybersecurity incidents in accordance with our incident response and recovery plans. He and other members of the OD Technology Department work collaboratively across the Company and have implemented programs designed to protect our information systems from cybersecurity threats and position our Company to promptly respond, in coordination with various members of our senior management team, to any cybersecurity incidents in accordance with our incident response and recovery plans. reports 19 19 ITEM 2. PROPERTIESWe own our principal executive office located in Thomasville, North Carolina, and 240 of the 260 service centers we operated as of December 31, 2025. Our facilities are strategically dispersed over the states in which we operate. Our owned service centers include most of our larger facilities and account for approximately 96% of the total door capacity in our network. At December 31, 2025, the terms of our leased properties ranged from month-to-month to a lease that expires in 2039.We believe that all of our properties are in good repair and are capable of providing the level of service required by current business levels and customer demands. In addition, we believe we have sufficient capacity in our service center network to accommodate increased demand for our services. ITEM 3. LEGAL PROCEEDINGSWe are involved in or addressing various legal proceedings and claims, governmental inquiries, notices and investigations that have arisen in the ordinary course of our business and have not been fully adjudicated, some of which may be covered in whole or in part by insurance. Certain of these matters include collective and/or class-action allegations. We do not believe that the resolution of any of these matters will have a material adverse effect upon our financial position, results of operations or cash flows.Consistent with SEC Regulation S-K Item 103, we have elected to disclose those environmental legal proceedings with a governmental authority if management reasonably believes that the proceedings may involve potential monetary sanctions of $1.0 million or more. Applying this threshold, there are no such unresolved proceedings to disclose as of December 31, 2025.ITEM 4. MINE SAFETY DISCLOSURESNot applicable. ITEM 2. PROPERTIES We own our principal executive office located in Thomasville, North Carolina, and 240 of the 260 service centers we operated as of December 31, 2025. Our facilities are strategically dispersed over the states in which we operate. Our owned service centers include most of our larger facilities and account for approximately 96% of the total door capacity in our network. At December 31, 2025, the terms of our leased properties ranged from month-to-month to a lease that expires in 2039. We believe that all of our properties are in good repair and are capable of providing the level of service required by current business levels and customer demands. In addition, we believe we have sufficient capacity in our service center network to accommodate increased demand for our services. ITEM 3. LEGAL PROCEEDINGS We are involved in or addressing various legal proceedings and claims, governmental inquiries, notices and investigations that have arisen in the ordinary course of our business and have not been fully adjudicated, some of which may be covered in whole or in part by insurance. Certain of these matters include collective and/or class-action allegations. We do not believe that the resolution of any of these matters will have a material adverse effect upon our financial position, results of operations or cash flows. Consistent with SEC Regulation S-K Item 103, we have elected to disclose those environmental legal proceedings with a governmental authority if management reasonably believes that the proceedings may involve potential monetary sanctions of $1.0 million or more. Applying this threshold, there are no such unresolved proceedings to disclose as of December 31, 2025. ITEM 4. MINE SAFETY DISCLOSURES Not applicable. 20 20 PART IIITEM 5. MARKET FOR REGISTRANT’S COMMON EQUITY, RELATED STOCKHOLDER MATTERS AND ISSUER PURCHASES OF EQUITY SECURITIESCommon Stock Information Our common stock is traded on the Nasdaq Global Select Market (“Nasdaq”) under the symbol ODFL. At February 17, 2026, there were 717,652 holders of our common stock, including 69 shareholders of record. The following table provides information regarding our repurchases of our common stock during the fourth quarter of 2025: ISSUER PURCHASES OF EQUITY SECURITIES Total Number of Shares Purchased (1) Average Price Paid per Share (2) Total Number of Shares Purchased as Part of Publicly Announced Programs Approximate Dollar Value of Shares that May Yet Be Purchased Under the Programs October 1-31, 2025 330,331 $ 139.31 329,657 $ 1,620,435,734 November 1-30, 2025 289,748 $ 135.16 289,074 $ 1,581,368,579 December 1-31, 2025 257,183 $ 155.58 256,510 $ 1,541,446,222 Total 877,262 $ 142.71 875,241 (1)Total number of shares purchased during the quarter includes 2,021 shares of our common stock surrendered by participants to satisfy tax withholding obligations in connection with the vesting of equity awards issued under our stock incentive plans.(2)Average price paid per share excludes a 1% excise tax imposed by the Inflation Reduction Act of 2022. On July 28, 2021, we announced that our Board of Directors had approved a stock repurchase program authorizing us to repurchase up to an aggregate of $2.0 billion of our outstanding common stock (the “2021 Repurchase Program”). The 2021 Repurchase Program began after completion of our prior repurchase program in January 2022 and was completed in May 2024. On July 26, 2023, we announced that our Board of Directors had approved a new stock repurchase program authorizing us to repurchase up to an aggregate of $3.0 billion of our outstanding common stock (the “2023 Repurchase Program”). The 2023 Repurchase Program, which does not have an expiration date, began after the completion of the 2021 Repurchase Program in May 2024.Under our repurchase programs, we may repurchase shares from time to time in open market purchases or through privately negotiated transactions. Shares of our common stock repurchased under our repurchase programs are canceled at the time of repurchase and are classified as authorized but unissued shares of our common stock.At December 31, 2025, we had $1.54 billion remaining authorized under the 2023 Repurchase Program. PART II ITEM 5. MARKET FOR REGISTRANT’S COMMON EQUITY, RELATED STOCKHOLDER MATTERS AND ISSUER PURCHASES OF EQUITY SECURITIES