Cyberattacks, including through the use of ransomware and other forms of malware, distributed denial of services attacks, credential harvesting, social engineering and other means for obtaining unauthorized access to or disrupting the operation of our networks and systems and those of our suppliers, vendors and other service providers, could have an adverse effect on our business. Cyberattacks against companies, including Verizon, have increased in frequency, scope and potential harm in recent years. Cyberattacks may be perpetrated by a variety of groups or persons, including nation-state and state-sponsored actors, malicious actors, employees, contractors, or other unrelated third parties. Nation-state and state-sponsored actors can sustain malicious activities for extended periods and deploy significant resources to plan and carry out attacks. For example, in September 2024, we became aware that we were one of several telecommunications companies that were the subject of a cyberattack by a highly sophisticated nation-state actor known as Salt Typhoon. In that case, the threat actor was able to access portions of our network as part of what we determined to be a narrowly focused effort to obtain information about a limited number of individuals primarily involved in government or political activity. While we were able to contain the Salt Typhoon attack, we may be unable to contain or mitigate the impacts of a significant cyberattack in the future.
Cyberattacks may cause equipment failures, loss of information, including sensitive personal information of customers or employees or valuable technical, financial and marketing information. Such attacks may also result in disruptions to our customers’ operations or our own business operations, including our ability to operate our networks and systems, activate customers or take payments. Cyberattacks may occur alone or in conjunction with physical attacks, especially where disruption of service is an objective of the attacker. Further, the use of AI and machine learning by threat actors may increase the frequency and severity of cyberattacks against us or other companies. The inability to operate or use our networks and systems or those of our suppliers, vendors and other service providers as a result of cyberattacks, even for a limited period of time, may result in significant expenses to Verizon, a loss of current or future customers and/or a loss of market share to our competitors. The costs associated with a cyberattack on Verizon could include expensive incentives offered to existing customers and business partners to retain their business, increased expenditures on cybersecurity measures and the use of alternate resources, lost revenues from business interruption and the costs of investigations and litigation, including potential damages. Further, certain of Verizon’s businesses, such as those offering security solutions and infrastructure and cloud services to business customers, could be negatively affected if our ability to protect our own networks and systems is called into question as a result of a cyberattack. Our presence in the IoT industry, which includes offerings of telematics products and services, could also increase our exposure to potential costs and expenses and reputational harm in the event of cyberattacks impacting these products or services. Any of these occurrences could damage our reputation, adversely impact customer and investor confidence and result in a material adverse effect on Verizon’s results of operation or financial condition.
The development and maintenance of systems to prevent and detect cyberattacks is costly and requires ongoing monitoring and updating to address the increasing prevalence and sophistication of cyberattacks. In addition, due to the sophistication of threat actors, an attack may persist for an extended period of time before it is detected, and it may be difficult and time consuming to ascertain the extent of an attack once detected.
While none of the cyberattacks to which we have been subject to date have been material to Verizon's operations or financial condition, there can be no guarantee that we will not experience a material cyberattack in the future. The actions we take to reduce the risks associated with cyberattacks, including protecting our systems and networks, may be insufficient to repel or mitigate the effects of a cyberattack in the future.