text: Material Risks & Integrated Overall Risk Management are developing processes, that seek to assess, identify, and manage material risks from cybersecurity threats to the IT systems and information that we create, use, transmit, receive, and maintain. We also seek to integrate these processes and policies into our overall enterprise risk management system and processes. The processes for assessing, identifying, and managing material risks from cybersecurity threats, including threats associated with our use of third-party service providers, include our efforts to identify the relevant assets that could be affected, determine possible threat sources and threat events, assess threats based on their potential likelihood and impact, and identify controls that are in place or necessary to manage and/or mitigate such risks.

companyName: Vislink Technologies, Inc.

ticker: VISL

secItem: Item 1C


text: Our Audit Committee of the Board of Directors is responsible for oversight of risks from cybersecurity threats. Our Audit Committee receives quarterly reports from our Enterprise Risk Management Committee ("ERM Committee"), as well as directly from our Chief Information Officer ("CIO") or VP Infrastructure, periodically, as appropriate. These reports cover various cybersecurity matters, including risk assessments, risk prevention and mitigation activities, and incident reports along with remediating actions, areas of emerging risks, industry trends, and other areas of importance. Furthermore, our Audit Committee oversees our annual enterprise risk assessment. This assessment encompasses key risks associated with security, technology, and cybersecurity threats in the same manner as other key risks.

companyName: MARZETTI CO

ticker: MZTI


text: We depend on digital technologies, including information systems, infrastructure and cloud applications and services, including those of third parties with which we may deal. Sophisticated and deliberate attacks on, or security breaches in, our systems or infrastructure, or the systems or infrastructure of third parties or the cloud, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. As a company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We may not have sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have adverse consequences on our business and lead to financial loss. However, risks from cybersecurity threats have, to date, not materially affected us, our business strategy, results of operations or financial condition.

companyName: Aeluma, Inc.

ticker: ALMU


text: We have a multi-stakeholder team to help identify, assess, and manage the Company's cybersecurity threats and risks, comprised of representatives from our third-party IT administrator, and from our Legal and Compliance, and Finance departments. This team, along with our third-party IT service providers, identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, using automated monitoring tools, subscribing to analysis and services that identify cybersecurity threats, conducting scans of the threat environment, conducting internal and external review of certain data and systems, and having third parties conduct periodic assessments of our threat environment. We continue to invest in talent and infrastructure in our IT department to manage IT operations and mitigate cyber risk.

companyName: Y-mAbs Therapeutics, Inc.


text: The Company's cybersecurity program is aligned and integrated into the overall company risk management process through its Enterprise Risk Management Program ("ERM"). At Emergent, ERM is a centralized process that prioritizes, and groups the top risks to our organization into 12 categories, one of which is Cybersecurity. We conduct an Enterprise Risk Assessment ("ERA") annually to proactively identify, assess, respond, monitor, and report risks to our enterprise. Identified risks are assessed and we accordingly will either accept the risk or take action to reduce or avoid the risk. Mitigations against risks are developed, as necessary, and all risks are monitored, reviewed quarterly, and reported to executive leadership and the Board of Directors.

companyName: Emergent BioSolutions Inc.

ticker: EBS


text: We engage consultants, or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company. We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.

companyName: QMIS TBS Capital Group Corp.


text: The Board oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that the Company's management implements to address risks from cybersecurity threats. The Board receives presentations on cybersecurity issues and developments as needed. The Board also will receive prompt and timely information regarding any cybersecurity incident that meets established reporting materiality thresholds, as well as ongoing updates regarding such incident until it has been addressed. The Company evaluates the materiality of a cybersecurity incident based on the overall impact of the event, which depends on a number of factors including, but not limited to, the financial impact of the incident and the type of information involved. At least once each year, the Board discusses the Company's approach to cybersecurity risk management with the Company's President and Chief Executive Officer and General Counsel.

companyName: Farmland Partners Inc.

ticker: FPI


text: Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our Company, including financial, operational, regulatory, reputational, and legal. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes and practices are integrated into the Company's ERM program and are based on recognized frameworks established by the Federal Financial Institutions Examination Council and other industry recognized standards. Our Chief Information Security Officer ("CISO"), who reports directly to the Bank's Chief Risk Officer ("CRO"), along with key members of his team, regularly collaborates with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues to identify best practices. The information security program is periodically reviewed by the Bank's CISO with the goal of addressing changing threats and conditions. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Stellar Bancorp, Inc.

ticker: STEL


text: Risks from cybersecurity threats have, to date, not materially affected us, our business strategy, results of operations or financial condition. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor captioned "Our internal information technology systems, or those of our third-party CROs, CMOs, or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our drug candidates' development programs and our commercialization of any products for which we receive regulatory approval."

companyName: TG THERAPEUTICS, INC.

ticker: TGTX


text: We maintain relevant expertise within the Bank's management team to manage cybersecurity risks. In particular, the Bank's Information Security Officer ("ISO") reports directly to the Chief Risk Officer ("CRO") and provides direction and oversight for information and cyber-security related activities across the Company—including existing and emerging initiatives, service provider arrangements, incident response, business continuity management, staff training, monitoring of key controls and adjusting the information security program in response to changes in operations and internal/external threats and vulnerabilities. The ISO has more than 20 years of information security experience at financial institutions as well as information security consulting firms, and maintains various cybersecurity and IT audit professional certifications. The ISO works in partnership with the Company's Information Technology department and is supported by both internal and external information technology and information security tools, resources and staff.

companyName: First Financial Northwest, Inc.


text: the ordinary course of our business, we collect, process, store, and transmit players' data, including confidential, sensitive, proprietary, and personal information. Maintaining the confidentiality, integrity and availability of our information technology systems and data, as well as appropriate limitations on access to such information, is important to our operations and business strategy. To this end, we have implemented various Information Security programs aligned to ISO and NIST cyber security frameworks with functions incorporating the "Identify", "Protect", "Detect", "Respond", and "Recover" concepts. They are designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing in them.

companyName: GAN Ltd


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report, including "If our information technology systems or data or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences."

companyName: Bionano Genomics, Inc.

ticker: BNGO


text: Our Board of Directors has overall responsibility for risk oversight in performing this function. Our Board of Directors assesses cybersecurity and information technology risks and the controls implemented to monitor and mitigate these risks. Our cybersecurity program is overseen by our Health, Safety, and Environmental Director, who has been a Heat Waves employee for over five years and has been in charge of our data protection and product and software security and compliance initiatives for the past several years. Our HSE Director meets regularly with the Board of Directors to share information about potential cybersecurity events and monitor, prevent, and detect potential cybersecurity incidents. The Board of Directors is charged with reviewing our cybersecurity processes for assessing key strategic, operational, and compliance risks. The Board of Directors also discusses relevant incidents in the industry and the evolving threat landscape.

companyName: Enservco Corp

ticker: ENSV


text: Role of the Board of Directors T he Audit Committee has responsibility for overseeing our cybersecurity risk management. In accordance with the Audit Committee's charter, the Audit Committee at least annually reviews and discusses with management, including the CIO and CISO, our processes, policies, procedures, and protocols related to cybersecurity and information security. In addition, the Audit Committee regularly reviews and discusses with management, including the CIO and CISO, cybersecurity program assessments and audits, planned improvements and the status of any information security initiatives, as well as risks from cybersecurity threats pertinent to us and any previous cybersecurity incidents experienced by us, including any material impact or reasonably likely material impact on the Company, our business strategy, results of operations, or financial condition. The Audit Committee provides reports to the Board at each regularly scheduled Board meeting of the matters it has recently addressed, including relating to the oversight of our cybersecurity risk management, and the full Board may participate, as warranted, in the Audit Committee's sessions on cybersecurity risk management. Outside advisors also may meet from time to time with the Audit Committee or Board, as warranted, to review and discuss cybersecurity matters.

companyName: IDEXX LABORATORIES INC /DE

ticker: IDXX


text: The Company's Board is responsible for overseeing cybersecurity risk management as part of its oversight of the Company's enterprise risk management framework. The Company's management team is responsible for the day-to-day oversight and management of cybersecurity risks, supported by our dedicated professionals responsible for cybersecurity, fraud, risk management, and compliance. Additionally, our Cybersecurity Committee, which is composed of certain of our executive management, legal and operations leaders, provides sponsorship and guidance to help achieve our management objectives. Our Vice President for IT Data Security ("VP, IT Data Security") reports to our Chief Technology Officer ("CTO") and assists in the day-to-day management of cybersecurity risks by leading the Information Security department and operationalizing our Information Security management systems.

companyName: IBEX Ltd

ticker: IBEX


text: Cybersecurity Governance Our board of directors considers cybersecurity risk part of its risk oversight function and has delegated to the audit committee of our board of directors (the "Audit Committee") oversight of cybersecurity and other information technology risks. The Audit Committee oversees our cybersecurity risk management program. The Audit Committee receives quarterly and, if necessary, ad-hoc reports from the Vice President of Operation & Information Technology and the Head of Information Technology on our cybersecurity and information technology risks, including data security incidents (material and those with lesser impact potential), annual risk assessments, risk identification and evaluation, and targeted remediation plans and related execution/delivery.

companyName: PRECISION BIOSCIENCES INC

ticker: DTIL


text: Alternus employs a multilayer approach to addressing cybersecurity risk based on the National Institute of Standards and Technology (NIST) framework. It has established a dedicated cybersecurity team that utilizes internal and external assessments, automated monitoring tools, and input from public and private partners to identify potential cyber threats. External third party security firms are engaged to assist with cybersecurity risk assessments, penetration testing and system security analysis. Alternus's cybersecurity team works in conjunction with the risk management, legal, finance, accounting, operations, and information technology areas to assess the risk these identified cybersecurity threats present to the organization. To ensure consistency, these cybersecurity risk assessments are incorporated into Alternus's Information Security Policy, Alternus's information technology leadership reviews the company's enterprise risk management-level cybersecurity risks on a quarterly basis, and key cybersecurity risks are incorporated into Alternus's Information Security Policy. Cybersecurity risks are managed and controlled through multiple overlapping layers of cybersecurity defenses that include: expert input from both public and private partnerships;

companyName: Alternus Clean Energy, Inc.

ticker: ALCE


text: Our cybersecurity program includes an incident response plan. Our incident response plan addresses the detection, reporting, analysis, response, recovery, communication, documentation, and post-incident review of cybersecurity incidents. We test and evaluate this plan on a routine basis. We train our team members on cybersecurity risks and mitigation and retain experienced cybersecurity consultants prepared to assist us in the event of any breach. For material cybersecurity risks, we've developed mitigation measures to reduce the risk's likelihood of occurrence and/or its expected impact. Such mitigation measures have involved, among other things, implementing additional technology controls or policies, increased training for Company personnel, and obtaining additional insurance for the identified risk. Our Information Technology ("IT") team monitors material risks over time and updates the Company's mitigation measures as appropriate. The IT team also regularly reports to the Company's leadership team on the status of material risks, mitigation measures, and incidents related to such risks. In addition to our incident response plan, we perform risk assessments throughout the year to identify and remediate potential cybersecurity threats and vulnerabilities. In connection with our assessment of potential cybersecurity risks, our IT team engages in threat modeling, vulnerability scanning and penetration testing.

companyName: CAVCO INDUSTRIES, INC.

ticker: CVCO


text: Risk Identification and Assessment As part of our overall risk management system, we have a dedicated InfoSec team to oversee management's process for effectively monitoring and mitigating risk. The InfoSec team regularly reviews threat intelligence from various sources, including third-party InfoSec consultants, assesses the applicability of known threats and threat actor behavior and tactics to the Company, and assesses whether these threats pose risks to the Company. The InfoSec team then evaluates potentially appropriate administrative, technical, and physical controls to mitigate and reduce these risks within the appropriate business context and applies such controls where appropriate. We also have implemented a process to identify and mitigate risks from cybersecurity threats related to our use of third-party service providers.

companyName: RECURSION PHARMACEUTICALS, INC.

ticker: RXRX


text: We have not experienced any material risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, which have materially affected us, including our operations, business strategy, results of operations, or financial condition. However, there can be no assurance that our cybersecurity risk management program and processes, including controls, systems and processes that we have or will in the future implement, will be fully implemented, complied with or effective in protecting our systems and information. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See our risk factor titled "Our business could be negatively affected by security threats and disruptions, including electronic, cybersecurity or physical security threats, incidents and other disruptions."

companyName: Tamboran Resources Corp

ticker: TBN


text: The Trustee maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats, which processes are integrated into the Trustee's overall risk management process. The Trustee maintains robust cybersecurity protocols including, but not limited to technological capabilities that prevent and detect disruptions; computer workstations and programs protected with passwords and passphrases, as well as employee training throughout the year on financial regulations and cybersecurity followed up by testing of that knowledge. The protocols are based on recognized best practices and standards for cybersecurity and information technology. The Trustee has an annual assessment, performed by a third-party vendor, of the Trustee's cyber risk management program.

companyName: CROSS TIMBERS ROYALTY TRUST

ticker: CRT


text: When a potential cybersecurity threat or incident is identified, our processes require that the Senior Director of Information Security be promptly notified of the incident, who then is to conduct an initial investigation to determine the probability and potential of the threat or incident to have a material impact on key business systems and processes. If there is a reasonable possibility for a material impact to the Company's business or information systems, the cybersecurity program requires that the Technology Risk Management Committee be promptly notified, which then assigns a risk level to the threat or incident. All threats and incidents identified as high-risk are promptly escalated to Company leadership and the legal department, who are tasked with activating and implementing a high-risk information security incident mitigation and response plan, which details the roles, responsibilities, and strategies to respond. Our cybersecurity program also requires that high-risk cybersecurity incidents or threats be reported to the Company's Materiality Committee and the Audit Committee of the Board within 24 hours of their designation as high-risk by the Technology Risk Management Committee.

companyName: ARROWHEAD PHARMACEUTICALS, INC.

ticker: ARWR


text: Our cybersecurity program includes ongoing vulnerability and risk management processes along with a managed security service provider that utilizes a detection and response solution to provide us with 24/7/365 monitoring and alerting. We have developed an incident response plan that is designed in accordance with the NIST framework to facilitate (1) identification and containment of any cybersecurity incidents; (2) remediation of identified vulnerabilities; (3) mitigation of disruption to critical information systems; and (4) assessment of what occurred, notification of affected individuals as necessary and mitigation of consequences that may arise from any unauthorized access. This plan also identifies and describes the roles and responsibilities of our incident response team, including investigation and escalation as appropriate up to and including our Audit Committee or Board of Directors.

companyName: Life Time Group Holdings, Inc.

ticker: LTH


text: The Audit Committee is primarily responsible for overseeing and reviewing the Company's information security and technology risks, including cybersecurity. In this role, the Audit Committee monitors the prevention, detection, mitigation and remediation of cybersecurity incidents through the regular receipt of reports from management on the effectiveness of its cybersecurity programs. The Audit Committee reports to the full Board on a quarterly basis regarding its oversight activities and the risk management activities of the Company. In addition, the full Board receives periodic presentations from management on emerging information security and cybersecurity risks, as well as incident reports as significant matters may arise.

companyName: Veradigm Inc.


text: Our board of directors is responsible for overseeing and advising our company so that it functions as effectively as possible. The audit committee consists of a subset of the board of directors. The audit committee has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full board of directors for consideration. The audit committee performs oversight functions and meets regularly with management to review the company's business and operations, including the oversight of risks from cybersecurity threats. Management is responsible for and regularly discusses identifying, assessing, and managing material cybersecurity risks on an ongoing basis through programs led by the Chief Information Security Officer, Chief Legal Officer, and the Chief Financial Officer.

companyName: Gitlab Inc.

ticker: GTLB


text: Our information security team for IAS, MIS and Corporate is led by our Chief Digital & Information Officer ("CDIO"), who also serves as our Chief Information Security Officer ("CISO") for IAS, MIS and Corporate. Our CDIO/CISO reports to our President, BRP & CEO, Retail Brokerage Operations. Our CDIO/CISO has served in the role since 2021 and has experience in application security, intrusion detection, penetration testing, complex threat modeling, and unconventional cyber-attack vectors, having previously led technology teams at Comerica Bank, HSBC, Citibank and General Electric. Our CDIO/CISO oversees a team of information security professionals who are devoted full time to assessing and managing cybersecurity threats on a day-to-day basis. Our CDIO/CISO attends each quarterly meeting of the TCRC to brief members on information security matters and discuss cybersecurity risks generally.

companyName: Baldwin Insurance Group, Inc.

ticker: BWIN


text: The Company's policies and procedures identify how cybersecurity measures and controls are developed, implemented, and regularly reviewed and updated. The Company implements and maintains a set of controls to manage information risk, establishes guidelines for the use of information technology, and defines standards for identifying and mitigating information risks. The controls are developed based on risk assessments and a review of controls from multiple security frameworks, such as the Center for Internet Security's Critical Security Control and the Payment Card Industry Data Security Standard. The Company, internally and through third parties, conducts multiple information risk assessments each year. Risks identified in such assessments are considered and evaluated for inclusion in the Company's information risk portfolio and are then prioritized and addressed where appropriate to update the Company's information security programs. Assessments, along with risk-based analysis and judgment, are used by the Company to determine how it should manage these risks.

companyName: ABERCROMBIE & FITCH CO /DE/

ticker: ANF


text: The Board has primary responsibility for oversight of the Company's cybersecurity risks. The Audit Committee is also responsible for reviewing the Company's information and cybersecurity risks and the steps that management has taken to protect against threats to the Company's information systems and security, including results of periodic security assessments performed in conjunction with ongoing monitoring. The Audit Committee has formed a Cybersecurity Risk Subcommittee consisting of two independent directors to assist the Audit Committee in its oversight of cybersecurity risks. By its charter, all members of the Cybersecurity Risk Subcommittee must have a background or experience in information technology or cybersecurity and an understanding of cyber threats, risk mitigation and policy.

companyName: AGILYSYS INC

ticker: AGYS


text: The Company has a written incident response plan and conducts tabletop exercises to enhance incident response preparedness. Business continuity and disaster recovery plans are used to prepare for the potential for a disruption in technology we rely on. The Company is a member of an industry cybersecurity intelligence and risk sharing organization. Employees undergo security awareness training when hired and annually. The Company (or third parties it relies on) may not be able to fully, continuously, and effectively implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine the security controls to implement, and it is possible we may not implement appropriate controls if we do not recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. And events, when detected by security tools or third parties, may not always be immediately understood or acted upon.

companyName: Cinemark Holdings, Inc.

ticker: CNK


text: The Board and Audit Committee maintain responsibility for enterprise risk oversight related to cybersecurity, privacy, and data protection and security. The Audit Committee has delegated the primary responsibility for oversight of compliance and risk management efforts and processes related to these matters to the Cybersecurity Subcommittee, which was established in 2023 and is comprised of independent directors. The Cybersecurity Subcommittee oversees management's efforts and processes to identify, assess, manage, and monitor significant cybersecurity and privacy risks and regulatory developments in this area. Our cybersecurity and privacy leaders meet with the Cybersecurity Subcommittee to discuss the Company's cybersecurity and data protection risk exposures, including the steps management has taken to monitor and manage such exposures and their potential impact on the Company's business, operations, and reputation. The Cybersecurity Subcommittee reports periodically on these matters to the Audit Committee and Board.

companyName: Booking Holdings Inc.

ticker: BKNG


text: The board of directors, as a whole, has oversight responsibility for our strategic and operational risks, while we engage consultants who are responsible for day-to-day assessment and management of cybersecurity risks and who report regularly to the board of directors. We have previously experienced cybersecurity incidents, from time to time. These incidents have not materially affected our business strategy, results of operations or financial condition. We are not currently aware of any cybersecurity incidents that would have a material effect on our business strategy, results of operations or financial condition. Nevertheless, there is always a risk that a phishing attempt, ransomware or other attack by a bad actor could have a material adverse effect on our financial position or results of operations. Based on information currently available, management does not believe that there is a reasonably likely risk of these issues, nevertheless the possibility of one occurring cannot be completely ruled out.

companyName: GUIDED THERAPEUTICS INC

ticker: GTHP


text: Cybersecurity incident identification and response. We use a number of processes and procedures to protect our data, systems and employees from cyber incidents, to reduce our overall cybersecurity risk profile, and to identify and respond to cybersecurity incidents in a timely manner. These processes and procedures leverage a variety of tools, including a security incident and event manager interface that uses behavioral analytics and provides live metrics and reports of attempted breaches and logs of firewalls, authentication attempts, emails, anti-malware, attempted intrusions and applications. We also conduct periodic tests to assess our processes and procedures and the threat landscape, which include, among other things, the engagement of third-party experts for external and internal penetration testing and system security assessments.

companyName: VECTOR GROUP LTD


text: Our CIO and other senior leaders regularly review the results of the assessments, tabletop exercise, cybersecurity roadmap progress, and monthly operational metrics to stay informed about risks from cybersecurity threats and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. They report this information to the Audit Committee and ERM Committee as appropriate, together with measures to be implemented to further strengthen our IT environment as the Company grows and evolves. We have a response plan governing our assessment, response and notifications internally and externally upon the occurrence of a cybersecurity incident that is led by our CIO, in coordination with other senior leaders. Depending on the nature and severity of an incident, our CIO and CEO may escalate notification of the incident to the Audit Committee and to the Board.

companyName: ChampionX Corp


text: Board of Directors, along with its Audit Committee, oversees the management of cybersecurity risks and receives quarterly reports from management on the detection and remediation of cybersecurity incidents, as well as on material security risks and vulnerabilities. Through our outsourced managed service provider, we are informed about, and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents through the management of, and participation in the monitoring systems and processes described above. The information about such incidents is reported to the Company's Chief Executive Officer and Chief Financial Officer, who then would report such information to the Company's Board of Directors, in some cases, earlier than the regular quarterly reports depending on the nature and severity of the incident.

companyName: Motorsport Games Inc.

ticker: MSGM


text: Our Board of Directors (the "Board") and management recognize the importance of maintaining the trust and confidence of our clinical trial participants, investors, business partners and employees. The Board and the Audit Committee of the Board (the "Audit Committee") are actively involved in oversight of our cybersecurity program as part of our approach to risk management. Our cybersecurity policies, processes and practices are integrated into our operations and are based on recognized standards such as the National Institute of Standards and Technology Cybersecurity Framework. In general, we seek to address cybersecurity risks through a comprehensive, coordinated approach that is focused on preserving the confidentiality, integrity, security, and availability of our critical systems and the information that we create through our business operations by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Connect Biopharma Holdings Ltd

ticker: CNTB


text: In collaboration with the IT Department, OFS Advisor's cybersecurity strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats, effective management of security risks and resiliency against incidents. The IT Department's cybersecurity risk management policies and procedures include, among other things: enterprise-wide hardware and software management and security controls; employee training; security assessments; penetration testing; security audits and ongoing risk assessments; due diligence on, and monitoring and oversight of, key third-party providers; vulnerability management; and management oversight to assess, identify and manage material risks from cybersecurity threats. The IT Department's controls leverage the National Institute of Standards and Technology Cyber Security Framework. The IT Department also utilizes industry and government associations, the results from regular internal and third-party audits and other similar resources to inform its cybersecurity processes and to allocate resources, including resources allocated to OFS Advisor.

companyName: OFS Capital Corp

ticker: OFS


text: We have developed a robust organizational structure to manage and oversee our information technology and cybersecurity programs, including full-time information security associates dedicated to cybersecurity. These individuals possess relevant experience and expertise in cybersecurity and risk management. Our Director, IT Infrastructure & Security leads our information security, data privacy and protection, and information technology compliance programs. The Director stays current with security related topics by either webinars, training classes or cybersecurity conferences. Guided by management, our information technology teams maintain a detailed Cyber Incident Response Plan ("CIRP") and hold frequent meetings to ensure the proper communication and execution of our security controls and procedures. The Cybersecurity team has various expertise ranging in Associate of ISC2-CISSP certification and extensive training on current security products. The Director, IT Infrastructure & Security regularly reports to the Vice President of Information Technology and maintains ongoing dialog with the reporting structure to our CEO, CFO and COO, and Board of Directors regarding our information security programs. This reporting includes updates on matters evaluated under our CIRP, the current threat landscape, cybersecurity initiatives, and the effectiveness of our cybersecurity programs.

companyName: ROCKY BRANDS, INC.

ticker: RCKY


text: As part of engaging a new third party provider, we assess their security standards, require security terms and conditions and work with risk management to ensure insurance coverage is adequate for the exposure risk. Service providers and vendors must adhere to security requirements such as security incident or data breach notification and response protocols, appropriate data encryption requirements, and data disposal. Our cyber incident monitoring process includes dialog with any third party or business partner potentially impacted by a disclosed incident. In addition, we leverage third party consultants to perform penetration (PEN) studies. These independent third party assessments provide valuable insight to enhance our cybersecurity posture.

companyName: NorthWestern Energy Group, Inc.

ticker: NWE


text: Management's role and expertise in assessing and managing material cybersecurity risks Our Information Security team is charged with the responsibility for assessing and managing material cybersecurity risks. That team is led by our CISO. Certifications held by the Information Security team include CompTIA A+, Network+, Security+, Project+, & CyberSecurity Analyst+, eLearnSecurity Junior Penetration Tester, EC-Council Certified Ethical Hacker ("CEH"), Certified Encryption Specialist, Certified Security Analyst, & Computer Hacking Forensic Investigator ("CHFI"), CMMC-AB Registered Practitioner ("RP"), and ISC2 Certified Information Systems Security Professional ("CISSP"). Our CISO's background includes over 17 years of experience in IT and Information Security. His formal education includes a Master's degree in Cybersecurity and Information Assurance and a Bachelor's degree in Computer Forensics. Certifications held by the CISO include CompTIA A+, Network+, & Security+, Microsoft Technology Associate ("MTA"), CMMC-AB RP, ISO 27001 Certified Lead Implementer Professional, EC-Council CEH & CHFI, ISACA Certified Data Privacy Solutions Engineer & Certified Information Security Manager, ISC2 CISSP, and Offensive Security Certified Professional. Our CISO reports to our Chief Information Technology Officer ("CITO"), who in turn reports to our Chief Executive Officer ("CEO"). Each of our CITO and our CEO have extensive experience in cybersecurity matters.

companyName: TELOS CORP

ticker: TLS


text: Risk Management Personnel Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the CISO. With over 20 years of experience in the field of information technology, the CISO brings a wealth of expertise to the role. The CISO's education includes a Master's in Cybersecurity Management. The CISO has in-depth knowledge and experience in developing and executing our cybersecurity strategies. The CISO oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our comprehensive employee security awareness program. The CISO is also responsible for building and overseeing a cybersecurity team, including internal and external resources, who provide subject matter expertise and operational talents to achieve our cybersecurity objectives.

companyName: Allegion plc

ticker: ALLE


text: Cybersecurity Incident Detection and Response Process Our information security program is based on five key functions as set forth in the NIST CSF: (i) identify; (ii) protect; (iii) detect; (iv) respond; and (v) recover. As part of that program, we maintain an incident detection and response process that is designed to ensure we appropriately identify, investigate, respond to, and recover from, cybersecurity incidents in order to protect our information, systems and resources. As part of our process, we maintain operational plans for incident response and recovery activities. We regularly review our incident response process and conduct multiple incident response exercises each year, including sessions with management, to test and assess our preparedness to respond to a cybersecurity incident.

companyName: EQUIFAX INC

ticker: EFX


text: Material Impact of Cybersecurity Threats While to date we are not aware of any material information security breaches and have not incurred significant operating expenses related to information security breaches, we acknowledge the persistent and evolving nature of these threats, which have the potential to materially impact our business strategy, operations, and financial standing adversely. See Item 1A, "Risk Factors" under the risks related to our business section for more information. Our incident response practices require incident assessments to be conducted in concert with our Chief Executive Officer, Chief Financial Officer and MSP. This enables faster response and effective communication, including public disclosure if a material cybersecurity event were to occur.

companyName: ClearSign Technologies Corp

ticker: CLIR


text: Cybersecurity Incident Response Plan — In October 2023, we experienced a cybersecurity incident in which certain information of our users was accessed and downloaded from individual 23andMe.com accounts without the account users' authorization. Following this incident, we implemented certain changes to our information systems and processes meant to provide additional protections to our environment, including enhancements to our Security Operations, reset customer passwords, required two-factor verification for new and existing customers, detection tools and capabilities, and implementation of new tools and processes, among others. However, we continue to face a heightened risk of cybersecurity threats which may materially impact our operations. For more information about our cybersecurity related risks, see "We have experienced a criminal cyber incident and could in the future experience other security breaches, disruption to our business, or reputational harm" in Part 1, Item 1A, Risk Factors of this Form 10-K.

companyName: Chrome Holding Co.

ticker: MEHCQ


text: As part of our program to mitigate risk from cyber security threats, the Company actively evaluates and refines its cyber security tools and processes with the intention of reducing cyber security risks and aligning with the National Institute of Standards and Technology Cyber-security Framework for risk management. Features of our cybersecurity program include: Processes designed to comply with information security standards and privacy regulations, including the European Union's General Data Protection Regulation. Maintenance of an ISO 27001 Information Security Management Standard certification. Implementation of a variety of security controls, such as firewalls, and intrusion detection systems. Protection against Denial-of-Service attacks which prevent legitimate use of our services. Security events monitoring in our security operations center. Development of incident response policies and procedures designed to initiate remediation and compliance activities in a timely manner. Implementation of data loss prevention tools. Implementing an ID management system to enforce granular role-based access controls. Performing penetration testing on cloud and app platform. Administration of a comprehensive cyber security awareness program to educate employees about cyber security risks and best practices. Retention of a third-party, independent cyber security firm to conduct cyber security assessments of our systems and procedures.

companyName: SOLAREDGE TECHNOLOGIES, INC.

ticker: SEDG


text: To ensure our employees are educated on potential cybersecurity threats or actions, we train our executive officers and global workforce on an ongoing basis in the event of a potential cyber threat or cybersecurity incident. Our Company-wide Information Security training program includes security awareness training, including regular phishing simulations, acceptable use training, cyber wellness trainings and other targeted trainings throughout the year. Additional training mechanisms we may use to assess, identify, and manage risks from cybersecurity threats, include simulations, tabletop exercises and response readiness tests to test our preparedness and incident response process. These trainings provide employees the opportunity to gain an understanding of the various forms of cybersecurity incidents and enable our employees to handle and report any suspicious activity or threat.

companyName: HERSHEY CO

ticker: HSY


text: Management's Role Managing Risk The Company's Enterprise Risk Management Committee (the "ERM"), an interdepartmental, management-level committee, meets at least quarterly and is responsible for ensuring that the Company has appropriate policies and procedures in place to help identify, measure, monitor and control potentially significant business risks. In connection with these responsibilities, the ERM receives quarterly risk and control self-assessments and action plans for risk remediation, if required, to reduce residual risks. This includes information security action plans from the CISO, the CDO, and/or other key stakeholders. The incorporation of these reports into the ERM's meetings is intended to promote the inclusion of cybersecurity considerations in the risk management decision-making processes throughout the Company.

companyName: Metropolitan Bank Holding Corp.

ticker: MCB


text: In addition, the AAM Information Security Council (ISC), comprised of leadership representatives from across the organization, meets periodically to discuss current threats and trends and the resulting information security initiatives and priorities. The ISC members provide support for policy changes and insights into how the information security team can most effectively educate, communicate, and support AAM. The ISC is led by AAM's Chief Information Security Officer (CISO), our frontline business leader with regard to cybersecurity risk management. AAM's CISO has been an IT professional in various capacities for over 25 years and maintains the following certifications: Certified CISO, Certified Information Systems Security Professional, Certified Cloud Security Professional, and Certified Information Privacy Technologist.

companyName: Dauch Corp

ticker: DCH


text: Notwithstanding our Cybersecurity Program as described above, we cannot anticipate, detect, repel or guarantee the effectiveness of our preventative measures against all cybersecurity threats, particularly because the techniques used are increasingly sophisticated and constantly evolving. Like many companies, we have encountered intrusions and attempts to gain unauthorized access to our IT systems or other attacks and incidents, and we have had third-party service providers who have encountered intrusions. However, during fiscal 2025, we did not identify any risks from cybersecurity threats that materially affected or are reasonably anticipated to materially affect our business strategy, results of operations or financial condition. For additional information about the cybersecurity risks we face, including how such risks could affect us in the future, see "Part I, Item 1A. Risk Factors" in this Annual Report, including the Risk Factors titled "Our business and operations could suffer in the event of security breaches of our IT systems, or other misappropriation of our technology, intellectual property or other proprietary or confidential information" and "Failures in our products, or in the products of our customers or licensees, including those resulting from security vulnerabilities, defects or errors, could harm our business."

companyName: QUALCOMM INC/DE

ticker: QCOM


text: Although the Board has determined that enterprise risk management should be the responsibility of the Board as a whole, it has delegated responsibility to oversee specific areas of risk management to its committees. Our Audit Committee oversees and reviews the Company's cybersecurity, data privacy, and other information technology risks, controls and procedures, including the Company's plans to mitigate cybersecurity risks and respond to data breaches. At periodic meetings of the Board and its committees and in other meetings and discussions, management reports to the Board and its committees with respect to the most significant risks that could affect our business, including cybersecurity-related risks. Our Audit Committee also receives prompt and timely information regarding any cybersecurity incident to meet reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: STANDARD BIOTOOLS INC.

ticker: LAB


text: Longbridge's technology team, and its operational risk management group, perform regular assessments of the firm's cybersecurity and infrastructure posture. These reviews cover a broad range of topics including implementation planning for the deployment of new hardware and software, patch and vulnerability management, considerations for disaster recovery and business continuity, user access controls, data security and Longbridge's threat monitoring services. In such continued maintenance of its cybersecurity posture, Longbridge conducts continuous deprecation of obsolete or unsuitable technology, including legacy hardware and software, has a robust patch and vulnerability management process, and has an external firm dedicated to the continued monitoring of new developments in threat actors' activities in order to take preventative actions.

companyName: Ellington Financial Inc.

ticker: EFC


text: Cybersecurity Threats The Company previously experienced a cybersecurity incident in August of 2020. Although cybersecurity threats, including any previous cybersecurity incidents, have not materially affected the Company's business strategy, results of operations or financial condition, there can be no assurances that future cybersecurity incidents, which are unavoidable, will not materially affect our results of operations, including our business strategy, results of operations, or financial condition. Additional information on cybersecurity risks we face can be found in Part I, Item 1A. "Risk Factors - Unauthorized or improper disclosure of personal information, breach of privacy, whether inadvertent or as the result of a cyber-attack or improperly by our employees, has resulted in liability and could harm us." which should be read in conjunction with the foregoing information.

companyName: IBEX Ltd

ticker: IBEX


text: Security and data privacy awareness and training is provided to new employees and annually for current Aptar employees, which is designed to educate employees on recognizing information security and cybersecurity concerns, how they can help protect the organization and how to inform the cybersecurity team of potential incidents. In addition, Aptar implements stringent processes to oversee and manage risks associated with our third-party providers. As set forth in our Sustainable Purchasing Charter, third-party providers are expected to, among other things, protect personal data and implement security and protection measures in relation thereto. We conduct security assessments of third-party providers before engagement and monitor their compliance with our cybersecurity standards on an ongoing basis. The monitoring includes periodic and ongoing assessments by our Information Security Department. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties. In addition, we maintain cybersecurity insurance as part of our overall insurance portfolio.

companyName: APTARGROUP, INC.

ticker: ATR


text: Cybersecurity Risk Management and Strategy We depend on integrated information systems to conduct our business. In order to defend against cybersecurity threats, we have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. The frameworks used to design and assess our program include the National Institute of Standards and Technology Cybersecurity Framework and Sarbanes Oxley. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: ENERPAC TOOL GROUP CORP

ticker: EPAC


text: Material Impact of Cybersecurity Risks As of the date of this filing, we have not experienced a material cyber incident and the expenses we have incurred from information security incidents have been immaterial, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations, or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors- Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information, and/or damage to our business relationships, all of which could negatively impact our financial results."

companyName: StratCap Digital Infrastructure REIT, Inc.


text: The Company's management and Board recognize the importance of strong oversight of cybersecurity risk, information security and technology in maintaining the trust and confidence of our customers, partners, employees and stockholders. The Company maintains cybersecurity measures aligned with the National Institute of Standards and Technology Cybersecurity Framework (Framework) which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. Our processes for assessing, identifying and managing material risks from cybersecurity threats is incorporated into our Enterprise Risk Management (ERM) program and evaluated against such Framework. Our information security and ERM teams coordinate to regularly review and assess these risks using a wide range of tools and services.

companyName: GENERAC HOLDINGS INC.

ticker: GNRC


text: The Cyber Program is organized under our Chief Information Security Officer. The current Chief Information Security Officer has extensive information technology and program management experience and has served for over a decade in our corporate information security organization. He has a Masters in cybersecurity from Valparaiso University. Additionally, he has both Certified Information Systems Security Professional-Information Systems Security Management Professional ("CISSP-ISSMP") and Certified Information Systems Auditor ("CISA") certifications, and is also a recognized Information Technology Infrastructure Library ("ITIL") expert. The Chief Information Security Officer reports to the Executive Vice President, General Counsel & Secretary with oversight by the Board of Directors. Over the course of the last decade, our management team has gained extensive experience investing in, providing oversight of, and setting the strategy for our cybersecurity program. Prior to joining DRS, our Chief Executive Officer oversaw the development of the DoD cybersecurity strategy while serving as Deputy Secretary of Defense from 2009 to 2011.

companyName: Leonardo DRS, Inc.

ticker: DRS


text: Risk Management and Strategy operate in the life sciences sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations. We have developed and maintain processes, aligned with industry standards and best practices designed to assess, identify, and manage cybersecurity risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. The scope of these processes includes risks that may be associated with both our internally managed information technology ("IT")

companyName: INTERPACE BIOSCIENCES, INC.

ticker: IDXG


text: As discussed more fully under Part 1, Item 1A, Risk Factors, "We are increasingly dependent on information technology, and our systems and infrastructure face certain risks, including cybersecurity and data leakage risks," the sophistication of cybersecurity threats continues to increase, and the preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems and information may be insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all security breaches of these types, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.

companyName: Amneal Pharmaceuticals, Inc.

ticker: AMRX


text: Recognizing the complexity and evolving nature of cybersecurity threats, we also retain a range of external experts, including cybersecurity assessors, consultants and auditors in evaluating and testing our information security processes and systems. These engagements enable us to access specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our engagements with these third parties include regular audits, threat assessments and consultation on security enhancements. We also regularly conduct information security training to ensure that all employees, including those who may come into possession of confidential financial or personally identifiable information, are aware of information security risks and are equipped to take steps to mitigate such risks. The results of such tests, assessments, reviews and trainings are evaluated by senior management and our cybersecurity policies, processes and practices are refined as necessary based on the information provided.

companyName: CubeSmart

ticker: CUBE


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our Vice President of Information Technology and Information Security Officer ("VP of IT"), who is supported by other members of management, as necessary. Our VP of IT is responsible for approving budgets, cybersecurity incident preparedness, approving cybersecurity processes, reviewing security assessments and other security-related reports, and providing the Chief Financial Officer ("CFO") with regular updates on cybersecurity-related matters. The Company also has an IT Executive Steering Committee comprised of the VP of IT, CFO, General Counsel, Chief Operating Officer and Chief Technology Officer and Vice President of Operations. The VP of IT provides regular cybersecurity updates to the Audit Committee. The Company's VP of IT has served in this role for three years and has more than 25 years of relevant experience. In addition, we have an information security team comprised of dozens of employees dedicated to cybersecurity with extensive experience and relevant certifications. The VP of IT is responsible for hiring appropriate personnel, assisting with the integration of cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, and mitigating and remediating in the event of a cybersecurity incident.

companyName: GENTEX CORP

ticker: GNTX


text: Our Board of Directors oversees significant cybersecurity risks to the Company directly and through its Audit Committee. The Board of Directors meets with our CSO or his delegate annually to review significant cybersecurity risks as well as cybersecurity priorities and focus areas for the upcoming fiscal year. The Audit Committee meets with our CSO or his delegate quarterly to review significant cybersecurity incidents and risks, programmatic security modifications and enhancements, and progress made towards key cybersecurity initiatives and matters. The CSO may provide more frequent updates to the Board of Directors and Audit Committee if necessitated by a security incident or other developments. The Audit Committee reports regularly to our Board of Directors regarding the committee's oversight of cybersecurity risk matters.

companyName: Dell Technologies Inc.

ticker: DELL


text: Under the oversight of the Board of Directors (since we do not currently have an Audit Committee), we intend to implement and maintain a risk management program that includes processes for the systematic identification, assessment, management, and treatment of cybersecurity risks. Our cybersecurity oversight and operational processes would be integrated into our overall risk management processes. We intend to implement a risk-based approach to the management of cyber threats, supported by cybersecurity technologies, including automated tools, designed to monitor, identify and address cybersecurity risks. In support of this approach, it is expected that we would have a third-party security consultant implement processes to assess, identify and manage security risks to our company, including in the pillar areas of security and compliance, application security, infrastructure security and data privacy. This process, once implemented, would include regular compliance and critical system access reviews. In addition, we intend to conduct application security assessments, vulnerability management, penetration testing, security audits and ongoing risk assessments as part of our risk management process.

companyName: bowmo, Inc.


text: MarineMax, Inc. (the "Company") determined on March 10, 2024, that it experienced a “cybersecurity incident,” as defined in applicable Securities and Exchange Commission rules, whereby a third party gained unauthorized access to portions of its information environment. Upon detection, the Company initiated its previously determined incident response and business continuity protocols and took immediate measures to contain the incident. As part of this process, the containment measures resulted in some disruption to a portion of the Company’s business. The Company’s operations have continued throughout this matter in all material respects. The Company continues to investigate the extent of the incident, has engaged cybersecurity expertise, and has notified law enforcement authorities.

companyName: MARINEMAX INC

ticker: HZO

secItem: Item 1.05


text: On May 6, 2024, Key Tronic Corporation (the “Company”) detected unauthorized third party access to portions of its information technology (“IT”) systems. Upon detection of this outside threat, the Company activated its cyber incident procedure to investigate, contain, and remediate the incident, including beginning an investigation with external cybersecurity experts and notifying law enforcement. The incident has caused disruptions, and limitation of access, to portions of the Company’s business applications supporting aspects of the Company’s operations and corporate functions, including financial and operating reporting systems. As the investigation of the incident is ongoing, the full scope, nature and impact of the incident are not yet known, but based on the information reviewed to date, the Company believes the unauthorized activity has been contained and is working diligently to bring the impacted portions of its IT system back online.

companyName: KEY TRONIC CORP

ticker: KTCC


text: On April 24, 2024, Dropbox, Inc. (“Dropbox” or “we”) became aware of unauthorized access to the Dropbox Sign (formerly HelloSign) production environment. We immediately activated our cybersecurity incident response process to investigate, contain, and remediate the incident. Upon further investigation, we discovered that the threat actor had accessed data related to all users of Dropbox Sign, such as emails and usernames, in addition to general account settings. For subsets of users, the threat actor also accessed phone numbers, hashed passwords, and certain authentication information such as API keys, OAuth tokens, and multi-factor authentication. Based on what we know as of the date of this filing, there is no evidence that the threat actor accessed the contents of users’ accounts, such as their agreements or templates, or their payment information. Additionally, we believe this incident was limited to Dropbox Sign infrastructure and there is no evidence that the threat actor accessed the production environments of other Dropbox products. We are continuing our investigation.

companyName: DROPBOX, INC.

ticker: DBX


text: As disclosed in the Original Filing, the Company detected that beginning in late November 2023, a nation-state threat actor had gained access to and exfiltrated information from a very small percentage of employee email accounts including members of our senior leadership team and employees in our cybersecurity, legal, and other functions. Since the date of the Original Filing, the Company has determined that the threat actor used and continues to use information it obtained to gain, or attempt to gain, unauthorized access to some of the Company’s source code repositories and internal systems. The threat actor’s ongoing attack is characterized by a sustained, significant commitment of the threat actor’s resources, coordination, and focus. Our active investigations of the threat actor’s activities are ongoing, findings of our investigations will continue to evolve, and further unauthorized access may occur.

companyName: MICROSOFT CORP

ticker: MSFT


text: As disclosed in the Original Report, on March 10, 2024, we determined that the Company experienced a “cybersecurity incident,” as defined in applicable SEC rules, whereby a third party gained unauthorized access to portions of our information environment (the “Incident”). Upon detection, we immediately initiated our previously determined incident response and business continuity protocols and took immediate measures to contain the Incident. As part of this process, the containment measures resulted in some disruption to a portion of the Company’s business. The Company’s operations have continued throughout this matter in all material respects, and, as of the date of this filing, the affected information environment is remediated.


text: On January 12, 2024, Microsoft (the “Company” or “we”) detected that beginning in late November 2023, a nation-state associated threat actor had gained access to and exfiltrated information from a very small percentage of employee email accounts including members of our senior leadership team and employees in our cybersecurity, legal, and other functions, on the basis of preliminary analysis. We were able to remove the threat actor’s access to the email accounts on or about January 13, 2024. We are examining the information accessed to determine the impact of the incident. We also continue to investigate the extent of the incident. We have notified and are working with law enforcement. We are also notifying relevant regulatory authorities with respect to unauthorized access to personal information. As of the date of this filing, the incident has not had a material impact on the Company’s operations. The Company has not yet determined whether the incident is reasonably likely to materially impact the Company’s financial condition or results of operations.


text: As disclosed in the Original Report, on May 6, 2024, the Company detected unauthorized third party access to portions of its information technology (“IT”) systems (the “cybersecurity incident”). Upon detection of this outside threat, the Company activated its cyber incident response procedure to investigate, contain, and remediate the incident, including engaging external cybersecurity experts to help investigate the scope and impact of the cybersecurity incident and notifying law enforcement. The cybersecurity incident caused disruptions, and limitation of access, to portions of the Company’s business applications supporting aspects of the Company’s operations and corporate functions, including financial and operating reporting systems.


text: Based on investigative findings, Coupang has determined that a former employee may have obtained the name, phone number, delivery address, and email address associated with up to 33 million customer accounts, and certain order histories for a subset of the impacted accounts. To Coupang’s knowledge, the former employee has not publicly disclosed the obtained data. No Coupang customers’ banking information, payment card information, or login credentials were obtained or otherwise compromised in the Incident. Coupang is continuing its investigation and has engaged external forensic experts to assist with the investigation. Korean regulators have initiated investigations with which Coupang is fully cooperating. While one or more Korean regulators will potentially impose financial penalties, at this time we cannot reasonably estimate any amount of losses or range of losses that may result from such penalties.

companyName: Coupang, Inc.

ticker: CPNG


text: Through the Company’s efforts, the Company believes that the third party responsible for this cybersecurity incident has been removed from the Company’s IT systems, and the Company’s ability to access information impacted by this incident has been restored in all material respects. The incident appears to have impacted many but not all of the Company’s IT systems and affected functions such as billing and label making for customer deliveries. Certain Company or Company-related data appear to have been stolen or destroyed. As a result of the Company’s contingency plans and data backup systems, the Company implemented planned solutions for the issues posed by the incident. The Company’s operations have continued since the detection of the cybersecurity incident in all material respects.

companyName: UFP TECHNOLOGIES INC

ticker: UFPT


text: Although the Company ascertained that certain information was exfiltrated, it is still investigating the extent of compromise of any sensitive information contained within the accessed IT systems. However, it is believed that the threat actors unlawfully accessed certain computer systems and exfiltrated images of video meetings and computer screens that may contain sensitive Company information. The threat actors have threatened to release this information publicly if the Company does not provide them with a monetary payment. The Company has taken additional cybersecurity measures in response to this incident including closing off the point of unlawful access and bolstering its cyber defensive capabilities. The Company believes that the costs associated with these activities will be largely covered by the Company’s cyber security insurance policy. However, due to the extended period that the Company has been and may continue to be offline, operations may be materially impacted, which may also impact the Company’s financial results for the first quarter of fiscal 2026.

companyName: JEWETT CAMERON TRADING CO LTD

ticker: JCTC


text: As disclosed in the Original Report, on February 5, 2024, we detected that, beginning February 4, 2024, a threat actor had gained unauthorized access to certain of our systems. With assistance from external cybersecurity experts, we immediately activated our cybersecurity incident response process to investigate, contain, and remediate the incident. As of the date of this Report, we believe the threat actor is a cybercrime group, and our investigation has identified that the group accessed and exfiltrated from a platform limited data that includes some client information and personally identifiable information. The threat actor also accessed and exfiltrated Company administrative and user data from certain information technology systems and accessed a small percentage of Company user accounts associated with employees and contractors. We reported this matter to relevant law enforcement and have been informing regulatory authorities.

companyName: PRUDENTIAL FINANCIAL INC

ticker: PRU


text: The data does not contain the content of calls or texts, personal information such as Social Security numbers, dates of birth, or other personally identifiable information. Current analysis indicates that the data includes, for these periods of time, records of calls and texts of nearly all of AT&T’s wireless customers and customers of mobile virtual network operators (“MVNO”) using AT&T’s wireless network. These records identify the telephone numbers with which an AT&T or MVNO wireless number interacted during these periods, including telephone numbers of AT&T wireline customers and customers of other carriers, counts of those interactions, and aggregate call duration for a day or month. For a subset of records, one or more cell site identification number(s) are also included. While the data does not include customer names, there are often ways, using publicly available online tools, to find the name associated with a specific telephone number.

companyName: AT&T INC.

ticker: T


text: Upon learning of the incident, the third-party provider immediately launched an investigation, worked with BayFirst to understand the scope of the issue, and engaged the appropriate cybersecurity experts to assist. The third-party provider also promptly notified law enforcement. The incident was limited to the third-party provider’s environment. Based on the information available to date, personal information, including name, date of birth, and social security/tax identification numbers of some BayFirst customers were accessed without authorization. To date, there is no evidence of the misuse, or attempted misuse, of personal information as a result of this incident. Impacted customers will be notified directly of this incident. BayFirst cannot quantify any material impact to its financial condition or operations, at this time.

companyName: BayFirst Financial Corp.

ticker: BAFN


text: As disclosed in a Current Report on Form 8-K (the “Original Report”), on August 25, 2025, Wytec International, Inc. (the “Company”) became aware of a cybersecurity incident in which a bad actor published a defaced website at the Company’s web address, wytecintl.com. After the Company restored the website from back-ups, the bad actor was able to deface the website again. To date the Company has received no contact from the bad actor, nor is it aware of any reason for this attack. On August 25, 2025, the Company took the website down, placing a temporary page on the site, while the Company continued to review the entire web platform, so that the site could return as soon as security had been confirmed.

companyName: WYTEC INTERNATIONAL INC

ticker: WYTC


text: As disclosed in the Original Form 8-K, the Company recently experienced a cybersecurity incident affecting certain information technology systems used by the Company. The Company’s investigation revealed that a threat actor illegally accessed the Company’s information technology systems. The cybersecurity incident resulted in a temporary limitation of access to portions of the Company’s information technology applications supporting some aspects of the Company’s operations at some of the Company’s facilities, and as noted in the Original Form 8-K, in an abundance of caution, the Company temporarily and proactively halted certain production operations at various locations. The Company’s investigation also determined that the threat actor exfiltrated limited data from the Company’s information technology systems. The Company is reviewing and evaluating the impacted data and will carry out any appropriate notifications to potentially affected parties and to regulatory agencies as required by applicable law.

companyName: NUCOR CORP

ticker: NUE


text: As part of its ongoing investigation, the Company determined that the threat actor exfiltrated a set of files associated with a limited number of the Company’s clients. Due to the complexity of the files, the Company engaged cybersecurity data mining experts to evaluate the exfiltrated data and was recently informed of its nature, scope and validity, confirming that the data sets contained a significant number of individuals’ personal information associated with our clients' end-users. The Company is continuing to further analyze and document the precise and detailed impact of the data exfiltrated, and clients are being informed as appropriate in order to determine next steps as required by federal and state law. To the Company’s knowledge, the exfiltrated data has not been released on the dark web or otherwise publicly.

companyName: CONDUENT Inc

ticker: CNDT


text: As of the date of this filing, the Incident does not appear to have had a material impact on the Company’s business operations; however, the full scope and impact of this Incident is not yet known and could result in a future determination that the incident either was not or has been material to the Company's financial statements and results of operations. The expected costs related to the Incident, including fees for our cybersecurity experts and other advisors, and costs to restore any impacted systems, are reasonably likely to have a material impact on the Company’s results of operations and financial condition.

companyName: DATA I/O CORP

ticker: DAIO


text: This Current Report on Form 8-K contains forward-looking statements made pursuant to the safe harbor provisions of the Private Securities Litigation Reform Act of 1995, such as the Company’s expectations or beliefs regarding future events, actions or performance related to the Incident, including the results of the Company’s investigation of the Incident, the impact of the Incident on the Company and its financial condition and results of operations. Forward-looking statements typically are identified by use of terms such as “anticipate,” “believe,” “expect,” “project,” “may,” “will,” “should,” “could,” “likely” and similar words. Except as required by law, the Company undertakes no obligation to publicly update or revise any forward-looking statements, whether as a result of new information, future events or otherwise. The Company’s actual results could differ materially from those contained in forward-looking statements due to a number of factors, including the impact of the Incident, the results from the Company’s investigation of the Incident, and other risks and factors described by the statements under “Risk Factors” in the Company’s most recent Annual Report on Form 10-K and in its subsequent filings with the United States Securities and Exchange Commission.


text: As previously disclosed in the Original Form 8-K, the Company experienced a system outage on February 3, 2025, caused by a cybersecurity attack by threat actors who unlawfully accessed the Company’s network, encrypted critical applications, and exfiltrated certain files (the “Incident”). As of the date of this filing and because of the Company’s remediation and other activities, the threat has been contained and the Company is working closely with third-party security vendors to restore automation of its business processes impacted by the Incident. Currently all products are being produced and distributed, although some limitations remain including limited depth of products due to tightened schedules. Additionally, certain back-office functions remain delayed including billing our clients, collections, and payments to vendors. We anticipate the business processes to be fully restored in the coming weeks.

companyName: LEE ENTERPRISES, Inc

ticker: LEE


text: While Coinbase has not experienced material operational impacts from these events as of the date hereof, the full financial impact of the Incident on the Company is still in the process of being assessed. Based on the information available to the Company on the date hereof and based on facts that continue to evolve, the Company has preliminarily estimated expenses to be within the range of approximately $180 million to $400 million relating to remediation costs and voluntary customer reimbursements relating to this Incident, prior to further review of potential losses, indemnification claims, and potential recoveries, which could meaningfully increase or decrease this estimate. The Company plans to aggressively pursue all remedies. As the Company’s investigation is ongoing, the full impact of these events are not yet known.

companyName: Coinbase Global, Inc.

ticker: COIN


text: On December 13, 2023, VF Corporation (“VF” or the “Company”) detected unauthorized occurrences on a portion of its information technology (IT) systems. Upon detecting the unauthorized occurrences, the Company immediately began taking steps to contain, assess and remediate the incident, including beginning an investigation with leading external cybersecurity experts, activating its incident response plan, and shutting down some systems. The threat actor disrupted the Company’s business operations by encrypting some IT systems, and stole data from the Company, including personal data. The Company is working to bring the impacted portions of its IT systems back online and implement workarounds for certain offline operations with the aim of reducing disruption to its ability to serve its retail and brand e-commerce consumers and wholesale customers. VF-operated retail stores globally are open, and consumers can purchase available merchandise, but VF is experiencing certain operational disruptions. Consumers are able to place orders on most of the brand e-commerce sites globally, however, the Company’s ability to fulfill orders is currently impacted. The Company, along with its external cybersecurity experts, continues to work diligently to respond to and mitigate the impact from the incident, and has notified and is cooperating with federal law enforcement.

companyName: V F CORP

ticker: VFC


text: As of the date of this Amendment, VF-operated retail stores, brand e-commerce sites and distribution centers are operating with minimal issues. After VF shut down some of its systems, VF experienced disruption to certain of its operations, including interrupted replenishment of retail store inventory and delayed order fulfillment which had impacts such as the cancellation by customers and consumers of some product orders, reduced demand on certain of its brands’ e-commerce sites, and delay of some wholesale shipments. Since the filing of the Original Report, while VF is still experiencing minor residual impacts from the cyber incident, VF has resumed retail store inventory replenishment and product order fulfillment, and is caught up on fulfilling orders that were delayed as a result of the cyber incident. Since the filing of the Original Report, VF has substantially restored the IT systems and data that were impacted by the cyber incident, but continues to work through minor operational impacts.


text: In addition, the Company continues to evaluate any unauthorized access to sensitive and confidential information of the Company and its stakeholders in connection with this incident. Other than the website being offline for a period of time and delayed communications through the Company’s IT systems, this unauthorized action by the former executive officer does not appear to have had a material impact on the protection of the Company’s intellectual property, or that there was unauthorized access to customer or stakeholder proprietary information. The Company continues to investigate any continuing security issues and IT functionality, and assess other actions the Company will take in response to this security and operational incident.

companyName: META MATERIALS INC.


text: On December 12, 2023, Hewlett Packard Enterprise Company (the “Company,” “HPE,” or “we”) was notified that a suspected nation-state actor, believed to be the threat actor Midnight Blizzard, the state-sponsored actor also known as Cozy Bear, had gained unauthorized access to HPE’s cloud-based email environment. The Company, with assistance from external cybersecurity experts, immediately activated our response process to investigate, contain, and remediate the incident, eradicating the activity. Based on our investigation, we now believe that the threat actor accessed and exfiltrated data beginning in May 2023 from a small percentage of HPE mailboxes belonging to individuals in our cybersecurity, go-to-market, business segments, and other functions.

companyName: Hewlett Packard Enterprise Co

ticker: HPE


text: On April 5, 2024, Targus International, LLC and certain affiliates (collectively, “Targus”), each of which is an indirect subsidiary of B. Riley Financial, Inc. (the “Company”), discovered that a threat actor gained unauthorized access to certain of Targus’ file systems. Upon discovery and with assistance from external cybersecurity counsel and consultants, Targus immediately activated its incident response and business continuity protocols to investigate, contain and remediate the incident. Through this process, proactive containment measures to disrupt unauthorized access resulted in a temporary interruption in the business operations of the Targus network. The incident has been contained and Targus systems recovery efforts are in process.

companyName: BRC Group Holdings, Inc.

ticker: RILY


text: Since the onset of the Incident, the Company has closely monitored the effect of the Incident on its business, financial condition and results of operations. While the full impact of the Incident on the Company and its results of operations and financial condition are not presently ascertainable, based on the information available to the Company on the date hereof, the Company concluded that the Incident is reasonably likely to have a material impact on the Company’s results of operation for the second fiscal quarter ended June 30, 2024 due to, among other thing, a slower rate of vehicle sales during the period since June 19, 2024 due to the impact of the Incident on the Affected Systems. As a result, the Company expects that its earnings for the second fiscal quarter ended June 30, 2024 will be adversely impacted by the Incident. As of the date hereof, the Company has not yet determined whether the Incident has otherwise had or is otherwise reasonably likely to have a material impact on the Company and its financial condition.

companyName: SONIC AUTOMOTIVE INC

ticker: SAH


text: On July 25, 2024, Meta Materials Inc. (the “Company”) became aware that its website, email system and other related information technology (IT) systems were significantly disrupted and taken offline. Upon detecting the disruption, the Company immediately began taking steps to restore, contain, and remediate the incident with internal and external cybersecurity experts, including beginning an investigation as to the cause of the disruption. On initial investigation, the Company learned that a former executive officer of the Company deliberately de-activated and cancelled the renewal of the Company’s website, which significantly impacted the Company’s IT systems, including delivery and receipt of electronic email communications from customers, investors and other stakeholders of the Company. With the assistance of outside legal counsel, the Company was able to compel the reinstatement of the website and commenced a process to ensure that IT functionality would continue uninterrupted. The website was re-activated and email systems restored on July 29, 2024, although functionality continues to be stressed and delayed as systems come back online. The Company, along with its internal and external cybersecurity experts, continue to work diligently to respond to and mitigate any impact from the incident.


text: As of the date of this filing, the Company has restored the affected systems and the Incident has been completely contained and remediated. The Incident temporarily impacted the Company’s operations, including internal/external communications, shipping, receiving, manufacturing production, and various other support functions, which are fully operational as of the date of this filing. As of the date of this filing, it does not appear that any revenue has been lost as a result of the Incident. As of September 9, 2025, the estimated costs related to the Incident for remediation, restoration and investigation efforts are expected to total approximately $388,000 in expenses in the third quarter ending September 30, 2025 and will likely have a material impact on the Company’s results of operations and financial condition.


text: Although the Company has determined that the cybersecurity incident has likely had a material impact on the Company’s business operations, as of the date of this Current Report on Form 8-K, the Company believes that the cybersecurity incident has not had a material impact on the Company’s overall financial condition or results of operations. and the Company does not believe the cybersecurity incident is reasonably likely to materially impact the Company’s overall financial condition or results of operations. The Company believes it holds adequate cybersecurity insurance to offset a substantial portion of the costs of the cybersecurity incident; however, the Company may incur expenses and losses related to this incident that are not covered by insurance. To the extent the Company incurs future, material direct expenses or other losses as result of this cybersecurity incident, and those costs are not covered by insurance, the Company will report such material losses in the appropriate period.

companyName: Crimson Wine Group, Ltd

ticker: CWGL


text: As disclosed in the Original Report, on December 13, 2023, VF detected unauthorized occurrences on a portion of its information technology (IT) systems. Upon detecting the unauthorized occurrences, VF immediately began taking steps to contain, assess and remediate the cyber incident, including beginning an investigation with leading external cybersecurity experts, activating its incident response plan, and shutting down some systems. As a result of these and other measures, and while VF’s investigation and remediation efforts remain ongoing, VF believes the threat actor was ejected from VF’s IT systems on December 15, 2023. VF has notified, is cooperating with, and will continue to cooperate with and notify, federal law enforcement and the relevant regulatory authorities as required under applicable law.


text: As of the date of this Form 8-K, Sensata does not expect this incident to have a material impact on the Company’s financial results and operations for the three months ended June 30, 2025; however, the full scope and impact of this incident is not yet known and could result in a future determination that the incident will be material to the Company's financial statements and results of operations. For the three months ended March 31, 2025, the Company expects revenue, adjusted operating income, adjusted net income, and adjusted earnings per share to be within or to slightly exceed the guidance ranges previously provided in its press release dated February 11, 2025.

companyName: Sensata Technologies Holding plc

ticker: ST


text: As part of its remediation activities, the Company is evaluating additional procedures and software to strengthen its surveillance of cybersecurity threats and to prevent unauthorized occurrences on or conducted through its IT systems and to strengthen its information backup systems. The Company currently expects that a substantial portion of its direct costs incurred relating to containing, investigating and remediating the cybersecurity incident will be reimbursed through insurance recoveries. As of the date of this Amendment, the cybersecurity incident has not had a material impact on the Company’s financial condition or results of operations, and the Company does not believe the cybersecurity incident is reasonably likely to materially impact the Company’s financial condition or results of operations.

companyName: BRANDYWINE OPERATING PARTNERSHIP, L.P.


text: As a precautionary measure, the Company halted domestic and Mexico operations for approximately two weeks during remediation efforts. After production was restarted, these locations returned to near capacity approximately another two weeks later. Other international operations continued production without material disruption from the cybersecurity incident. During the disruption of business, the Company continued to pay wages in accordance with statutory requirements. The Company also deployed new IT-related infrastructure and engaged cyber security experts to remediate the incident. The Company’s operations and corporate functions were restored in mid-June, and we believe that the unauthorized third party no longer has access to the Company’s IT systems.

companyName: KEY TRONIC CORP

ticker: KTCC


text: As a result of the incident, certain transactions that would have been consummated in the fourth quarter of 2023 were delayed and, consequently, revenue from those transactions will not be recognized until the first quarter of 2024. Certain other transactions that would have been consummated in the fourth quarter of 2023 were moved to other providers, which resulted in a loss of revenue. In addition, the Company recognizes revenue from its agents when a notice of title policy issuance is received. As a result of the incident, receipt of notices of the issuance of certain title policies have been delayed and, as a result, related revenue that would have been recognized in the fourth quarter of 2023 will not be recognized until the first quarter of 2024. In the fourth quarter of 2023 the Company also incurred one-time expenses as a result of the incident.

companyName: First American Financial Corp

ticker: FAF


text: As previously disclosed in the Original Form 8-K, the Company has experienced disruptions in its access to certain information systems provided to the Company by CDK Global (“CDK”) due to a cybersecurity incident experienced by CDK on June 19, 2024 (the “Incident”). As of the date of this filing, access to the Company’s information systems affected by the Incident has been restored, including its dealer management system (“DMS”) and customer relationship management system (“CRM”). However, the Company experienced operational disruptions throughout July related to the functionality of certain CDK customer lead applications, inventory management applications and related third-party application integrations with CDK.


text: As previously disclosed on August 21, 2025 in a Current Report on Form 8-K filed with the Securities and Exchange Commission (“SEC”), on August 16, 2025, Data I/O Corporation (the “Company”) experienced a ransomware incident (the “Incident”) on certain of its internal IT systems. Through ongoing discovery and investigation efforts, the Company has determined that the Incident was not targeted but originated as a vulnerability of a commercially available third-party firewall service provider. The Company engaged leading cybersecurity experts to support the IT system recovery and conduct a comprehensive investigation. Through dealing with this Incident, the Company has improved and strengthened its IT systems and based on the findings, the Company does not believe any additional actions are necessary.


text: As of the date of this filing, the incident has had and is reasonably likely to have a material impact on the Company’s business operations until recovery efforts are completed. The expected costs related to the incident, including the loss of revenues from digital sales during the recovery period, fees for our cybersecurity experts and other advisors, and costs to restore any impacted systems, are reasonably likely to have a material impact on the Company’s results of operations and financial condition. The Company holds cybersecurity insurance that is expected to offset a portion of the costs of the incident. The Company does not expect this will have a long-term material impact on its results of operations and financial condition.

companyName: Krispy Kreme, Inc.

ticker: DNUT


text: On July 10, 2024, Bassett Furniture Industries, Incorporated (the “Company”) detected unauthorized occurrences on a portion of its information technology (IT) systems. Upon detecting the unauthorized occurrences, the Company immediately began taking steps to contain, assess and remediate the incident, including beginning an investigation, activating its incident response plan, and shutting down some systems. The threat actor disrupted the Company’s business operations by encrypting some data files. As a result of the Company’s containment measures, which included shutting down some systems, the Company has not been, and, as of the date of this Report is not operating its manufacturing facilities. The Company’s retail stores and e-commerce platform are open, and customers are able to place orders and purchase available merchandise; however, the Company’s ability to fulfill orders is currently impacted. The Company is working to bring the impacted portions of its IT systems back online and implement workarounds for certain offline operations with the aim of reducing disruption to its ability to serve its retail, e-commerce and wholesale customers. At this time, the Company does not believe personal information from consumers was compromised. The Company continues to work diligently to respond to and mitigate the impact from the incident.

companyName: BASSETT FURNITURE INDUSTRIES INC

ticker: BSET