The Subsidiary Registrants operate in highly regulated industries that require the continued operation of sophisticated technology systems and network infrastructure, which are part of interconnected systems. Because of the critical nature of the infrastructure and the technology systems' inherent vulnerability to disability or failures due to hacking, viruses, denial of service, ransomware, acts of war or terrorism, or other types of data security breaches, the Registrants face a heightened risk of cyberattack. Remote working arrangements also increase the Registrants' data security risks. Additionally, the Registrants' field workforces use mobile technology, which have fewer security measures than the Registrants' wired networks. Portions of the Registrants' system data, architecture, and other materials may also be disclosed, either intentionally or unintentionally, to third parties and the public by regulators, employees, contractors, and vendors. This system information may be used by malicious actors to understand the Registrants' systems to prepare for a cyberattack. In addition, unpatched software or network vulnerabilities, including those resulting from the use of end-of-life operating systems, could be leveraged by an attacker.
Cyber actors, including those associated with foreign governments, have attacked and threatened to attack energy infrastructure. Various regulators have increasingly stressed that these attacks, including ransomware attacks, and attacks targeting utility systems and other critical infrastructure, are increasing in sophistication, magnitude, and frequency. In particular, certain actors, such as nation-state and state-sponsored actors, can deploy significant resources and employ sophisticated methods to plan and carry out attacks. Risk of these attacks may escalate during periods of heightened geopolitical tensions, such as those caused by the war in Ukraine and conflicts in the Middle East.
The Registrants and their third-party vendors have been subject, and will likely continue to be subject, to attempts to gain unauthorized access to their technology systems and confidential data or to attempts to disrupt utility and related business operations. While there have been immaterial incidents of phishing, unauthorized access to technology systems, financial fraud, and disruption of remote access across the Southern Company system, there has been no material impact on business or operations from these attacks. However, the Registrants cannot guarantee that security efforts will have the maturity to detect or prevent breaches, operational incidents, or other breakdowns of technology systems and network infrastructure. This is especially true in the event the Registrants are targeted by a sophisticated attacker with significant resources, such as a nation-state or state-sponsored actor. Further, the Registrants do not have security visibility into all operational technology communications and processes, do not maintain completely exhaustive inventories of assets and applications, and do not centrally manage or monitor all technologies, applications, and environments, which could negatively affect preparation for, investigation of, or response to an information security incident. Accordingly, the Registrants cannot provide any assurance that information security incidents will not have a material adverse effect in the future.
Table of Contents Index to Financial Statements
Table of Contents Index to Financial Statements
In addition, in the ordinary course of business, Southern Company and its subsidiaries collect and retain sensitive information, including personally identifiable information about customers, employees, and stockholders, and other confidential information. In some cases, administration of certain functions may be outsourced to third-party service providers. Malicious actors may target these providers to disrupt the services they provide to the Registrants, or to use those third parties to attack the Registrants. The Registrants do not fully assess the security maturity of all third-party service providers and such third-party service providers could fail to establish adequate risk management and information security measures with respect to their systems and/or could fail to timely notify the Registrants of an information security incident.
Internal or external cyberattacks may have wide-reaching impacts due to incomplete segmentation among network assets and/or reliance of segmented networks on a disrupted network, inhibit the affected Registrant's ability to fulfill critical business functions, including energy delivery service failures, compromise sensitive and other data, violate privacy laws, and lead to customer dissatisfaction. Any cyber breach or theft, damage, or improper disclosure of sensitive electronic data may also subject the affected Registrant to penalties and claims from regulators or other third parties. Insurance may not be adequate to cover any associated losses. Additionally, the cost and operational consequences of implementing, maintaining, and enhancing system protection measures are significant, and they could materially increase to address ever changing intense, complex, and sophisticated cyber risks.