Waste Management Inc.: 10-K Risk Factor Changes

Substantially all aspects of our business operations rely on digital technology. We use computers, mobile devices, social networking and other online platforms to connect with our employees, customers, vendors, as well as other individuals and third parties. These uses give rise to cybersecurity risks, including security breach, ransomware, espionage, system disruption, theft and/or inadvertent, accidental, unlawful, unauthorized access, loss, alteration, destruction and/or disclosure or release of information. Our business necessitates the processing, collection, use, storage and transmission of numerous classes of sensitive and/or confidential information and intellectual property, including individuals’ personal information, private and sensitive employment-related personal data, and financial and strategic information about the Company and other businesses. In addition to our own safeguarding efforts, we also rely on third parties to process, collect and store sensitive data, including a Payment Card Industry compliant third-party to protect our customers’ credit card information. We are regularly the target of attempted cyber intrusions, have experienced cyber intrusions, and anticipate continuing to be subject to such attempts as cyber intrusions become increasingly sophisticated and more difficult to predict and protect against. Technological advancements, including the progression of the capabilities of artificial intelligence, also increase the risk, likelihood and precision of cyber incidents. As such, we must commit substantial resources to continuously monitor and further enhance our networks and infrastructure to prevent, detect, and address the risk of unauthorized access, misuse, computer malware and other events. These protections and other systems designed to mitigate cybersecurity risks may not fully defend against an attack or future cybersecurity incident, which can be unpredictable in nature. Data security measures that our third-party service providers have implemented may not be effective against all current or future security threats. We also cannot guarantee that the systems, networks, equipment or software used by us or our third-party service providers have not been breached or otherwise compromised. Although we believe that the probability of occurrence of a significant cybersecurity incident is less than likely, if such an incident were to occur, the impact on the Company could be substantial. The magnitude of future cyber intrusions that result in a theft, destruction, loss, misappropriation, or release of sensitive and/or confidential information (belonging to us or third parties) or intellectual property, or material interference with our information technology systems or the technology systems of third parties on which we rely cannot be predicted, such incidents could result in material business disruption, direct financial loss, remediation costs, reputational harm, brand damage, alleged violation of privacy laws, loss of customers, potential regulatory investigations and enforcement or private litigation liability and competitive disadvantage. To mitigate these risks, we maintain a cybersecurity insurance policy; however, due to policy terms, limits and exclusions, such insurance may not apply in all cases, and it may not be adequate to cover all liabilities incurred. Regulatory enforcement action concerning privacy infringement and security incidents is generally increasing, including significant fines recently imposed by U.K. and European regulators. Our Healthcare Solutions operations in Western Europe may subject us to short notification deadlines in international jurisdictions in the event of a significant cybersecurity incident that impacts us globally; it may not be possible for us to comply with such notification deadlines due to the time required to conduct investigations and assess the impact of such incident. Failure to comply with applicable laws and regulatory deadlines could attract enforcement action, penalties, litigation, investigations, proceedings, reputational harm and brand damage. The Company is also expanding and improving its information technologies, resulting in a larger technological presence, utilization of cloud computing services, and corresponding exposure to cybersecurity risk. Certain new technologies, such as the use of autonomous vehicles, remote-controlled equipment, virtual reality, automation and artificial intelligence, present new and significant cybersecurity safety risks that must be analyzed and addressed before implementation. If we fail to assess and identify cybersecurity risks associated with acquisitions and new initiatives, we may become increasingly vulnerable to such risks.