We rely extensively on information and operational technology (IT/OT) systems, networks and services, including internet and intranet sites, data hosting and processing facilities and technologies, physical security systems and other hardware, AI, software and technical applications and platforms. Many of these are managed, hosted, provided and/or used by third parties or their vendors. The various uses of these IT/OT systems, networks and services include, but are not limited to, ordering and managing materials from suppliers; converting materials to finished products; shipping, marketing and selling products; collecting, transferring, storing and/or processing customer, consumer, employee, vendor, investor and other stakeholder information and personal data; summarizing and reporting results of operations, including financial reporting; managing our banking and other cash liquidity systems and platforms; hosting, processing and sharing, as appropriate, confidential and proprietary research, trade secrets, business plans and financial information; collaborating via an online and efficient means of global business communications; complying with regulatory, legal and tax requirements; providing data security; and handling other processes necessary to manage our business.
Increasing and evolving information security threats, including advanced persistent cybersecurity threats and the use of AI to autonomously find and exploit weaknesses, obtain information, craft social engineering content and execute large-scale attacks with increased speed and minimal human effort, pose a risk to the security of our services, systems, networks and supply chain, as well as the confidentiality, availability and integrity of our data and of our critical business operations. In addition, because the techniques, tools and tactics used in cyber-attacks frequently change, continue to advance in sophistication and may be difficult to detect for periods of time, we and our third-party providers may face difficulties in anticipating and implementing adequate preventative measures, quickly evaluating the full impact of an attack or fully containing and mitigating harms after such an attack.
Our IT/OT databases and systems and our third-party providers’ databases and systems have been, and will likely continue to be, subject to advanced computer viruses or other malicious codes, ransomware, unauthorized access attempts, denial of service attacks, phishing (including the use of adversarial AI techniques), social engineering, credential stuffing, automated vulnerability discovery, data encryption or exfiltration, deep fakes, hacking, supply chain software compromise and other cyber-attacks. Such attacks may originate from outside parties, hackers, criminal organizations or other threat actors, including
The Procter & Gamble Company 7
nation states. In addition, operational errors and insider actors - malicious or otherwise - could cause technical disruptions and/or data incidents. We cannot guarantee that our security efforts or the security efforts of our third-party providers will prevent material breaches, operational outages or other breakdowns to our or our third-party providers’ IT/OT databases or systems.
A breach of our data security systems or digital customer products, such as connected devices, or failure of our IT/OT databases and systems and those of our third-parties may have a material adverse impact on our business operations and financial results. If the IT/OT systems, networks or service providers we rely upon fail to function properly or cause operational outages or aberrations, or if we or one of our third-party providers suffer significant unavailability of key operations, or inadvertent disclosure of, lack of integrity of, or loss of our sensitive business or stakeholder information, including personal information, due to any number of causes, including catastrophic events, natural disasters, power outages, computer and telecommunications failures, improper data handling, viruses, phishing attempts, cyber-attacks, malware and ransomware attacks, security incidents, misuse or malicious use of AI or employee error or malfeasance, and our business continuity plans do not effectively address these failures on a timely basis, we may suffer interruptions in our ability to manage operations and be exposed to reputational, competitive, operational, financial and business harm as well as litigation and regulatory action. If our critical IT systems or back-up systems or those of our third-party vendors are damaged or cease to function properly, we may have to make a significant investment to repair or replace them.
In addition, if a ransomware attack, other cybersecurity incident or operational disruption occurs, either internally or at our third-party providers, we could be prevented from accessing our data or systems, which may cause interruptions or delays in our business operations, cause us to incur remediation costs, subject us to demands to pay a ransom or damage our reputation. In addition, such events could result in unauthorized disclosure or loss of confidential information or stakeholder information, including personal data from customers, consumers, employees, vendors, investors and other stakeholders, and we may suffer financial and reputational damage as a result. Additionally, we could be exposed to potential liability, litigation, governmental inquiries, reporting requirements, investigations or regulatory enforcement actions; and we could be subject to payment of fines or other penalties, legal claims by our suppliers, customers or employees and significant remediation costs.
Periodically, we and/or our suppliers also upgrade IT/OT systems or adopt new technologies, including but not limited to AI, in our operations. These technologies may have limitations, including biases, errors, insufficient or erroneous data. If a new system or technology does not function properly, provides flawed or inaccurate outputs or exposes us to increased cybersecurity incidents and failures, it could result in litigation or regulatory enforcement, affect our ability to order materials, make and ship orders and process payments as well as cause other operational and information integrity and loss issues. The costs and operational consequences of responding to the above items and implementing remediation measures could be significant and could adversely impact our results of operations and cash flows and generate negative publicity affecting Company reputation and relationships among consumers, customers and other business partners.