text: In an effort to provide short-term liquidity to fund the cybersecurity incident’s remediation efforts and other operations, the Company and its lender have agreed to waive payment of the Company’s interest payments due in March 2025. BH Finance LLC, a Nebraska limited liability company (“BH Finance”) is the Company’s sole lender, and the waiver applies to interest owed under the Credit Agreement dated January 29, 2020. The Covenant Waiver also applies to lease payments in March 2025 owed to BH Media Group, Inc., a Delaware corporation, under the Lease Agreement dated March 16, 2020, between the Company and BH Media (“Lease Agreement”). In total, the Covenant Waiver will provide $3.7M of additional capital. All waived Interest and Basic Rent payments will be added to the principal amount due under the Credit Agreement to be due as of the date such payments become due under the Credit Agreement.


text: As previously disclosed on its Current Report on Form 8-K filed on June 21, 2024, Sonic Automotive, Inc. (the “Company”) has experienced disruptions since June 19, 2024 in its access to certain information systems provided to the Company by CDK Global (“CDK”) due to a cybersecurity incident experienced by CDK (the “Incident”). The affected systems include the Company’s dealer management system (“DMS”), its customer relationship management system (“CRM”) and other systems that support sales, inventory and accounting functions (collectively with the DMS and the CRM, the “Affected Systems”). As of the date of this filing, access to the basic functionality of the DMS has been restored. Other Affected Systems, including the CRM and certain functions of the DMS, remain offline as the Company continues to investigate and test such systems. Additionally, some third-party applications typically accessible through the Affected Systems also remain offline. The timing of restoration of full access to all Affected Systems remains unclear.

companyName: SONIC AUTOMOTIVE INC

ticker: SAH

secItem: Item 1.05


text: SouthState Bank, N.A., (the "Company") detected what was determined to be a cybersecurity incident on February 6, 2024. Upon detection, the Company initiated its incident response and business continuity protocols and began taking measures to disrupt the unauthorized activity. As part of its process to address the incident, the Company proactively took measures to isolate parts of its network, which resulted in some disruption to the Company's business processes. The Company's operations have continued throughout this process in all material respects. The Company is conducting a thorough investigation and a cybersecurity firm has been engaged. Banking regulators and law enforcement have been notified.

companyName: SouthState Bank Corp

ticker: SSB


text: Nucor Corporation (the “Company”) recently identified a cybersecurity incident involving unauthorized third party access to certain information technology systems used by the Company. Upon detecting the incident, the Company began promptly taking steps to contain and respond to the incident, including activating its incident response plan, proactively taking potentially affected systems offline and implementing other containment, remediation, or recovery measures. The Company is actively investigating the incident with the assistance of leading external cybersecurity experts and has notified federal law enforcement authorities. As of the date of this filing and in an abundance of caution, the Company temporarily and proactively halted certain production operations at various locations. However, the Company is currently in the process of restarting the affected operations.

companyName: NUCOR CORP

ticker: NUE


text: As previously disclosed on the Current Report on Form 8-K filed by Crimson Wine Group, Ltd. (the “Company”) on July 5, 2024 (the “Initial Report”), on June 30, 2024, the Company detected a cybersecurity incident in which an unauthorized third party gained access to certain information systems of the Company. Upon detection, the Company promptly initiated response protocols and began taking steps to contain, assess and remediate the cybersecurity incident, including launching an investigation with external cybersecurity experts. As the Company was in early stages of its investigation and assessment of the incident, it was unable to determine at the time of the Initial Report whether the incident had or will have a material impact on the Company.

companyName: Crimson Wine Group, Ltd

ticker: CWGL


text: The Company continues to investigate the extent of the Incident with the assistance of external cybersecurity experts. The Company has determined that a cybercrime organization accessed a limited portion of our information environment associated with our retail business. As of the date of this filing, our ongoing investigation has identified that this organization exfiltrated limited data from this environment that includes some customer and employee information, including personally identifiable information. The Company intends to provide appropriate notifications to potentially affected parties and to regulatory agencies as required by federal and state law. The Company also has notified law enforcement authorities.

companyName: MARINEMAX INC

ticker: HZO


text: On October 15, 2025, Jewett-Cameron Trading Co. Ltd. (the “Company”) learned that a threat actor had gained unauthorized access to portions of the Company’s information technology (“IT”) environment and claimed to have unlawfully accessed certain Company information and data. The Company immediately activated its cyber incident response process to contain the intrusion, assess and investigate the incident and implement remedial measures. The Company also immediately notified law enforcement and retained external cybersecurity experts to assist. Based on its investigation to date, the Company believes that the cybersecurity incident consisted of unauthorized access and deployment of encryption and monitoring software by a third party to a portion of the Company’s internal corporate IT systems. The incident caused disruptions and limitation of access to portions of the Company’s business applications supporting aspects of the Company’s operations and corporate functions, which the Company voluntarily took offline as a precautionary measure. Based on the information reviewed to date, the Company believes the unauthorized activity has been contained and is working diligently to bring the impacted portions of its IT systems and individual computer devices back online.

companyName: JEWETT CAMERON TRADING CO LTD

ticker: JCTC


text: We continue to investigate the extent of the incident, including whether the threat actor accessed any additional information or systems, to determine the impact of the incident. On the basis of the investigation to date, we do not have any evidence that the threat actor has taken customer or client data. We have reported this matter to relevant law enforcement and are informing regulatory authorities. As of the date of this Report, the incident has not had a material impact on the Company’s operations, and the Company has not determined the incident is reasonably likely to materially impact the Company’s financial condition or results of operations.

companyName: PRUDENTIAL FINANCIAL INC

ticker: PRU


text: As previously disclosed in the Original Report, on May 6, 2024, the Company detected unauthorized third party access to portions of its information technology (“IT”) systems (the “cybersecurity incident”). Upon detection of this outside threat, the Company activated its cyber incident response procedure to investigate, contain, and remediate the incident, including engaging external cybersecurity experts to help investigate the scope and impact of the cybersecurity incident and notifying law enforcement. The cybersecurity incident caused disruptions, and limitation of access, to portions of the Company’s business applications supporting aspects of the Company’s operations and corporate functions, including financial and operating reporting systems.

companyName: KEY TRONIC CORP

ticker: KTCC


text: On or about March 14, 2024, through its information technology systems monitoring tools, Radiant Logistics, Inc. (the “Company”) detected what was determined to be the initial stages of a cybersecurity incident related to its Canadian operations. Upon detection, the Company immediately initiated its incident response and business continuity protocols and began taking measures to disrupt the unauthorized activity. As part of its process to address the incident, the Company proactively took measures to isolate its Canadian operations from the rest of its network and engaged the services of cybersecurity and forensics professionals to further assess, contain and remediate the incident. While the incident in combination with the Company’s security protocols have caused service delays for customers in Canada, systems recovery efforts are in process and the Company currently estimates those efforts to be largely complete in the coming week. The Company’s U.S. and other international operations have continued without disruption throughout this process in all material respects.

companyName: RADIANT LOGISTICS, INC

ticker: RLGT


text: The Company is making substantial progress in mitigating the impact to consumers and care providers of the unprecedented cyberattack on the U.S. health system and certain Change Healthcare services. The Company’s focus has been on ensuring patient access to care and medications by addressing challenges to pharmacy, medical claims and payment services targeted by the attack. The Company is working tirelessly to restore affected services and resume normal operations and along with law enforcement is investigating the extent of impacted data. The Company continues to believe the issue is specific to Change Healthcare. All other systems across the Company are operational.

companyName: UNITEDHEALTH GROUP INC

ticker: UNH


text: Governance Related to Cybersecurity Risks Our Chief Technology Officer, with over 15 years of experience in software development and security architecture, is responsible for the establishment and maintenance of our cybersecurity risk management processes, including the day-to-day oversight of the assessment and management of cybersecurity risks. Our Chief Technology Officer provides reports to and meets periodically with our General Counsel to discuss and review our information security and cybersecurity risk management processes.

companyName: Doximity, Inc.

ticker: DOCS

secItem: Item 1C


text: The Company's cybersecurity risk management is integrated in our overall risk management processes. Our enterprise risks, including cybersecurity risks, are reviewed on a biannual basis. The review involves participation and engagement by, among others, subject matter experts like the Company's Chief Information Security Officer ("CISO") and Chief Information Officer ("CIO"), representatives of the Company's business segments, and executive management. Mitigation plans are deployed across the Company with cross-functional collaboration as applicable. Enterprise risk management is reviewed with the Board annually.

companyName: Howmet Aerospace Inc.

ticker: HWM


text: The Company has a dedicated CIO and an Information Security Director who are supported by a team of cybersecurity professionals (the "Cybersecurity Team") that are responsible for leading the company-wide cybersecurity program and risk mitigation efforts. The CIO, the Information Security Director, and Cybersecurity Team work across all organizations within the Company to protect the Company and its employees, customers and suppliers against cybersecurity risks. The CIO and Information Security Director, with over 35 and 25 years of experience, respectively, have cybersecurity expertise, coupled with experience in IT strategy, operational management, incident response, and business continuity maintenance.

companyName: EASTMAN CHEMICAL CO

ticker: EMN


text: Governance of Cybersecurity Risk Management The board of directors, as a whole, has oversight responsibility for our strategic and operational risks. The board of directors has delegated to the audit committee the responsibility of reviewing and discussing our risk assessment and risk management practices, including cybersecurity risks, with members of management. The audit committee, in turn, regularly reports on its review with the board of directors.

companyName: Adeia Inc.

ticker: ADEA


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations or financial condition. We face risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A "Risk Factors – Cyberattacks or other security incidents that disrupt our operations or compromise data, may expose us to liability, harm our reputation or otherwise adversely affect our business."

companyName: CALIX, INC

ticker: CALX


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor titled " We are dependent on information technology systems, infrastructure and data, which exposes us to data security risks."

companyName: IONIS PHARMACEUTICALS INC

ticker: IONS


text: To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws;

companyName: TMC the metals Co Inc.

ticker: TMC


text: Risk Management and Strategy Our Cybersecurity and Digital Risk Management ("CDRM") organization, under the leadership of a Global Chief Information Security Officer ("Global CISO"), operates a cybersecurity program that is designed to help us identify, assess, manage, and mitigate risks relating to cybersecurity threats and incidents. We design our cybersecurity standards, policies, processes and controls to operate in an integrated manner, leveraging applicable industry standards and security frameworks, including the NIST Cybersecurity Framework, as guidance in supporting our ability to perform such functions.

companyName: Hewlett Packard Enterprise Co

ticker: HPE


text: In the last two fiscal years, we have not experienced any material cybersecurity incidents and any expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none. As needed, we will contract a professional cybersecurity investigation firm to conduct a full forensic analysis of any suspected material incident. To date, we have concluded that there has not been any evidence of material concern involving malware, persistence mechanisms or other compromised exchange of on-premises accounts within the Company's environment.

companyName: Hyperfine, Inc.

ticker: HYPR


text: Mr. Gharib is responsible for hiring information security personnel, integrating cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Mr. Gharib is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: SPRUCE BIOSCIENCES, INC.

ticker: SPRB


text: Our chief financial officer has primary responsibility for assessing, monitoring and managing cybersecurity risks. We utilize cybersecurity consultants to monitor and report cybersecurity threats or incidents to our chief financial officer and to resolve issues arising from such threats or incidents. Our chief financial officer updates the Nomination and Corporate Governance Committee on any risks related to cybersecurity as needed.

companyName: GALECTIN THERAPEUTICS INC

ticker: GALT


text: The audit committee of the Board (the " Audit Committee ") is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for overseeing these risks. Senior IT leadership regularly informs the Audit Committee, the Chief Financial Officer and other members of the Company's senior leadership of cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company.

companyName: AMC ENTERTAINMENT HOLDINGS, INC.

ticker: AMC


text: The Board of Directors receives periodic training related to cybersecurity and annually reviews comprehensive risk assessments of the Company's information technology, privacy and cybersecurity programs. The Board of Directors formally approves the Company's cybersecurity policies and program annually, and more frequently if material changes are adopted. Oversight of the Company's Information Security Program has been delegated to the Enterprise Risk Management Committee of the Board of Directors. The Enterprise Risk Management Committee receives quarterly reports on the effectiveness and overall performance of the cybersecurity program and provides a report of the same to the full Board of Directors.

companyName: LINKBANCORP, Inc.

ticker: LNKB


text: Identification and Reporting: The Adviser has implemented a comprehensive, cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. The Adviser's program includes controls and procedures to properly identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents in a timely manner.

companyName: Firsthand Technology Value Fund, Inc.

ticker: SVVC


text: The Apollo Global Management, Inc. ("AGM") board of directors is involved in overseeing Apollo ' s risk management program, including with respect to cybersecurity, which is a critical component of Apollo ' s overall approach to enterprise risk management ("ERM"). Apollo ' s cybersecurity policies and practices are fully integrated into its ERM framework through its reporting, risk management and oversight channels and are based, in part, on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards.

companyName: Apollo Commercial Real Estate Finance, Inc.

ticker: ARI


text: Our CISO and Chief Technology Officer ("CTO") oversee our day-to-day technology and security activities. Our CISO has been with the firm since 2013 and has over 20 years of IT experience in various industries. He is a Certified Chief Information Security Officer from the Carnegie Mellon University executive education program, as well as a Certified Information Security Manager (CISM) and Certified Information Systems Security Professional (CISSP). Our CTO joined the firm in 2020 with 25 years of IT experience, including 12 years of executive level technology experience in the asset management industry.

companyName: Victory Capital Holdings, Inc.

ticker: VCTR


text: Our cybersecurity incident response policy and security incident handling procedure are designed to escalate certain cybersecurity incidents to members of management who are part of the Incident Management Team. The Incident Management Team works to help mitigate and remediate cybersecurity incidents of which they are notified. In addition, the cybersecurity incident response policy and security incident handling procedure include escalating certain cybersecurity incidents to our disclosure committee and, if appropriate, to the Privacy and Security Subcommittee.

companyName: TANDEM DIABETES CARE INC

ticker: TNDM


text: During the period covered by this report, risks from cybersecurity threats did not have a material impact on the Bank's business strategy, results of operations, or financial condition. The Bank updated its information security strategy during the period covered by this report in response to the increasing volume of cybersecurity threats, both to the Bank and to third parties such as suppliers and vendors. The Bank has experienced cybersecurity incidents and threats in the past, though none have had a material effect on the Bank's financial condition or results of operations.

companyName: Federal Home Loan Bank of San Francisco


text: Our cybersecurity program is integrated into our overall risk management systems, including our annual enterprise risk management program, business continuity and crisis management programs, third-party risk management program, insurance risk management program, and employee compliance programs. We have implemented and maintain comprehensive processes designed to manage and mitigate material cybersecurity threats to ensure that the company operates in a protected, compliant environment.

companyName: MANNATECH INC

ticker: MTEX


text: Additionally, as part of our processes to manage risks related to a breach in our information systems, management requires employees to take cybersecurity trainings and shares regular awareness updates regarding cybersecurity threats. Our Cybersecurity Team regularly tests employees throughout the year to assess the effectiveness of our cybersecurity training. We also conduct penetration testing of our network and undertake cybersecurity assessments to improve our risk mitigation and assist in the determination of a potential material impact caused by a cybersecurity incident.

companyName: MERCURY SYSTEMS INC

ticker: MRCY


text: Management of the identified risks is embedded into business processes and key decision making at every level of the Company. Our enterprise risk management team works closely with our Chief Security Officer ("CSO") and IT risk management team to evaluate and address material cybersecurity risks in alignment with our business strategy and operational needs.

companyName: BLACK HILLS CORP /SD/

ticker: BKH


text: We perform periodic assessments for identifying threats and vulnerabilities, covering relevant operational facets, and focusing on identifying, analyzing, evaluating, and treating cyber risks across business functions. Our risk assessment guidelines define risk measurement and prioritization, and consider factors such as likelihood, impact, and potential harm. Mitigation strategies are planned, covering technical and procedural measures, including incident response plans.

companyName: INNODATA INC

ticker: INOD


text: 1. Cybersecurity Risk Management Program – The Company's cybersecurity risk management program includes the following activities: • Regular Security Committee meetings where the head of Information Security briefs the Security Committee on cybersecurity threats and responses, strategies and initiatives relating to cybersecurity, and roadmaps for improving the Company's cybersecurity. • Training employees on cybersecurity upon hire, and at least annually, with more detailed training provided to those employees that have greater access to data and systems. • Over two dozen Information Security policies that focus on specific aspects of our cybersecurity risk management (e.g., Vendor Management).

companyName: QUINSTREET, INC

ticker: QNST


text: In 2023, the Company's Board of Directors established a standing Cybersecurity Committee to assist with oversight of the Company's cybersecurity program and the material risks associated with the threats identified under the program. Given the Cybersecurity Committee's chair's previous military experience in positions relevant to information security and his NACD-sponsored CERT Certificate in Cybersecurity Oversight from Carnegie Mellon University's Software Engineering Institute, the committee benefits from his perspectives, skills, and training when reviewing and managing the Company's exposure to cybersecurity risks.

companyName: APA Corp

ticker: APA


text: Risks from Cybersecurity Threats While we have not experienced any cybersecurity incidents that have materially affected our business strategy, results of operations or financial conditions, we do expend significant resources (including cyber insurance costs) to address the ongoing risks from cybersecurity threats. We believe these risks could be material in light of the sensitive data that we collect, process and store in the operation of our business. See "Risk Factors" above.

companyName: Repay Holdings Corp

ticker: RPAY


text: Engage Third Parties on Risk Management To address the evolving nature and complexity of cybersecurity threats, the Company engages with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing its risk management systems. These partnerships enable the Company to leverage specialized knowledge and insights with respect to its cybersecurity strategies and processes. The collaboration with these third parties includes regular audits, threat assessments, penetration testing, and consultation on security enhancements.

companyName: YORK WATER CO

ticker: YORW


text: Currently, Jack Wang senior advisor of our subsidiary PeriShip Global, has primary responsibility for managing material cybersecurity risks. Mr. Wang holds an undergraduate and master's degree in computer science and has served in various roles in information technology and security for over 20 years. Mr. Wang is responsible for reporting any cybersecurity related incidents to our executive officers. Our executive officers are responsible for reporting material cybersecurity related incidents to our Board of Directors. We may implement other reporting structures governing the day-to-day management and reporting of cybersecurity risks.

companyName: VerifyMe, Inc.

ticker: VRME


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite the capabilities, processes, and other security measures we employ, that we believe are designed to prevent, detect, reduce, and mitigate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or might not accurately assess the probability or risk of an incident. Risk management measures cannot provide absolute security, and may not be sufficient in all circumstances, or mitigate all potential risks.

companyName: Fisker Inc./DE


text: Our Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics from our Chief Information Officer, or CIO, Chief Information Security Officer, or CISO, and Chief Information Risk Officer, or CIRO, and other security staff as part of the Board's continuing education on topics that impact the Company.

companyName: OMNICOM GROUP INC.

ticker: OMC


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents have been immaterial. This includes penalties and settlements, of which there were none. For a description of whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business operations and financial condition, see "Risk Factors" in Item 1A.

companyName: OLD DOMINION ELECTRIC COOPERATIVE


text: Cybersecurity Governance and Oversight The Board of Directors has assigned the Audit Committee to be responsible for reviewing our cybersecurity risk management and strategy program and is presented, at least annually, with a review of our environment and reported incidents. Part of our IRP also calls for the elevation of any necessary incidents to upper management in a timely manner whenever they occur.

companyName: ENANTA PHARMACEUTICALS INC

ticker: ENTA


text: The identification of cybersecurity risks is a continuous and evolving assessment. As a data company, we are subject to cybersecurity risks. We have identified certain cybersecurity risks specific to our business, which are identified above in Part I, Item 1A, "Risk Factors — Risks Related to IT Systems and Cybersecurity" in this Annual Report. The Company has established processes for assessing, identifying, and managing material risks from cybersecurity threats.

companyName: MSP Recovery, Inc.

ticker: MSPR


text: An incident response plan designed to coordinate the activities that we and our third -party security service providers take to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate incidents, as well as to comply with applicable legal obligations and mitigate any reputational damage;

companyName: FutureFuel Corp.

ticker: FF


text: The Company's Vice President of Information Systems has been with the Company for over 19 years and has overseen the Company's information systems, including its cyber risk management program, for the last six years. He is a member of the Global Information Assurance Certification Advisory ("GIAC") Board and has received various GIAC certifications in the areas of information security governance and technical controls focused on protecting, detecting and responding to cybersecurity issues. The Company's Chief Financial Officer has over 25 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.

companyName: EPR PROPERTIES

ticker: EPR


text: Our Information Security Program is overseen by our Chief Information Security Officer ("CISO"), who reports to our Chief Technology Officer ("CTO"). Our CISO oversees the third-party consultants who help assess our security controls and penetration testing previously described. The CTO provides oversight, leadership and direction for data risks, technology risks and information security. Our CISO leads the Cybersecurity organization and has the overall responsibility of implementing its strategy and objectives to build a strong cyber engineering function.

companyName: CANTALOUPE, INC.

ticker: CTLP


text: The Company's IT department, under the direction of its Chief Financial Officer, is responsible for the assessment and management of material cybersecurity risks. The IT department has over 70 years of combined work experience in information technology, including security, auditing, compliance, systems, and programming. The IT department is informed about and monitors the prevention, mitigation, detection and remediation of cybersecurity incidents through management of and participation in the cybersecurity risk management process described above, and regularly reports to the Audit Committee.

companyName: Crimson Wine Group, Ltd

ticker: CWGL


text: Our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Key security, risk, and compliance stakeholders meet regularly to develop strategies for preserving the confidentiality, integrity, and availability ("CIA") of Company and customer information, identifying, preventing, and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents. We maintain cybersecurity incident controls and procedures that are designed to ensure prompt escalation of incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board in a timely manner.

companyName: PGT Innovations, Inc.


text: Our board of directors has overall oversight responsibility for our risk management, including the cybersecurity risk management program. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Vice President of Operations who monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Any significant Cyber incidents are reported to the audit committee and ultimately to the board of directors.

companyName: ThermoGenesis Holdings, Inc.

ticker: THMO


text: In fiscal 2024, we engaged an independent cybersecurity advisory firm to lead a cybersecurity crisis simulation exercise that has been used by our senior leaders to prepare for a possible cyber crisis. In addition, we engaged an international cybersecurity company, specializing in IT services and software development, to augment our monitoring, incident response, detection, and forensics efforts; various Information Sharing and Analysis Centers (ISACs) for threat intelligence, and a recognized cyber defense company that specializes in threat intelligence and incident response services.

companyName: Aramark

ticker: ARMK


text: During the fiscal year ended March 31, 2025, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition, as we have described in the Risk Factors section of this Form 10-K.

companyName: CYANOTECH CORP

ticker: CYAN


text: We use independent third parties to perform ethical hacks of key systems and penetration tests of our network and certain applications to help us better understand the effectiveness of our controls and to implement more effective controls, and we engage with third parties to conduct reviews of our overall program to help us better align our cybersecurity program with what is required of a large financial services organization.

companyName: STATE STREET CORP

ticker: STT


text: Internal Audit Program – We operate an internal audit program. On an annual basis, our internal audit team conducts an overall business risk assessment, which includes an evaluation of cybersecurity risks. Included in this evaluation is a report on our cybersecurity posture and related matters that is presented to the leaders of the relevant business teams, who are responsible for prioritizing and addressing the risks identified.

companyName: KORE Group Holdings, Inc.

ticker: KORE


text: For a discussion of the risks and uncertainties that cybersecurity incidents may have on us, see "Risk Factors: Information systems failure or disruption, due to cyber terrorism or other actions, may adversely impact our business and result in financial loss to the Company or liability to our customers" in this Form 10-K.

companyName: Ingersoll Rand Inc.

ticker: IR


text: Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on the Company. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.

companyName: CROSS COUNTRY HEALTHCARE INC

ticker: CCRN


text: As part of our cybersecurity roadmap, we also assess third-party risks, and we perform third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers and other business partners associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers. In addition, we perform risk management during third-party cybersecurity compromise incidents to identify and mitigate risks to us from third-party incidents.

companyName: Ribbon Communications Inc.

ticker: RBBN


text: believe cybersecurity is critical to advancing our technological advancements. As a fintech company, we face a multitude of cybersecurity threats that range from attacks common to most industries, such as ransomware and denial-of service. Our customers, suppliers, subcontractors, and business partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance, and results of operations. These cybersecurity threats and related risks make it imperative that we expend resources on cybersecurity.

companyName: Netcapital Inc.

ticker: NCPL


text: processes also include assessing cybersecurity threat risks associated with our use of third-party service providers in normal course of business use. Third-party risks are included within our cybersecurity risk management processes discussed above. In addition, we assess cybersecurity considerations in the selection and oversight of our third-party service providers, including due diligence on the third parties that have access to our systems and facilities that house our critical systems and data.

companyName: AMERICAN REBEL HOLDINGS INC

ticker: AREB


text: Management is responsible for assessing and managing our day-to-day risks and control systems, and our Board is responsible for overseeing our enterprise risk management programs as a whole. The Board has delegated the oversight of cybersecurity risk assessment and management to the audit committee. As reflected in its charter, the audit committee is responsible for overseeing and reviewing the Company's cybersecurity and information security programs, practices and risk mitigation efforts. The audit committee receives quarterly reports on cybersecurity risks, or more frequent reports if circumstances dictate.

companyName: ANALOG DEVICES INC

ticker: ADI


text: Governance Related to Cybersecurity Risks The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives periodic updates on cybersecurity and information technology matters and related risk exposures. The Board also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.

companyName: Cogent Biosciences, Inc.

ticker: COGT


text: Operationally, the information security team employs numerous security tools such as threat detection, alerting and monitoring, data loss prevention, vulnerability remediation, anti-malware and email security protections. Consistent with our Business Continuity and Security Incident Response Policies, the Company engages in annual disaster recovery and information security tabletop exercises to simulate threats and events, and engages third-parties on an annual basis to conduct and report on penetration testing exercises. We administer mandatory annual security awareness training, routine employee email phishing testing, and provide regular updates across the Company to highlight recent examples of risks as they are identified.

companyName: HomeTrust Bancshares, Inc.

ticker: HTB


text: Internal Cybersecurity Team and Governance The Board maintains responsibility for oversight of risks that may affect the Company. Our Board has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee. The Audit Committee reviews the Company's policies with respect to risk assessment and enterprise risk management, including with respect to cybersecurity risks. Certain members of our Audit Committee have experience with respect to cybersecurity risk management.

companyName: ESAB Corp

ticker: ESAB


text: Cybersecurity Governance Our Director of Cybersecurity is responsible for the strategic leadership and direction of the Company's information security organization. The individual currently serving as the Director of Cybersecurity has over twenty years of experience working in information technology. The Director of Cybersecurity receives cybersecurity alerts from the Company's third-party security operations center, and provides periodic updates to the Head of Information Technology who informs the Company's executive committee, which includes the Company's Chief Executive Officer, Chief Operating Officer and, Chief Financial Officer.

companyName: Century Therapeutics, Inc.

ticker: IPSC


text: Description of Processes for Assessing, Identifying, and Managing Cybersecurity Risks Cybersecurity is integrated within the Company's Enterprise Risk Management process, which is the Company's systematic approach to identifying, managing and assessing major risk and safeguards, including cybersecurity. We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: 5E Advanced Materials, Inc.

ticker: FEAM


text: Cyber Risk Management and Strategy Under the oversight of our board of directors and the Audit Committee of the board, we have adopted cybersecurity risk management processes that take a risk based approach to assessing, identifying, and managing risks from cybersecurity threats. Management of cybersecurity risks is part of our overall risk management strategy.

companyName: TELA Bio, Inc.

ticker: TELA


text: We also purchase insurance to protect us against the risk of cybersecurity breaches. Our Vice President of Finance and Treasurer is responsible for our insurance policies and reviews on a regular basis our cyber insurance policy with management to ensure we have appropriate coverage. We have business continuity, contingency and disaster recovery plans and procedures in place in the event of a cybersecurity incident. These plans are tested in conjunction with the Company's annual testing of our cybersecurity incident response readiness and reporting through tabletop exercises.

companyName: Riley Exploration Permian, Inc.

ticker: REPX


text: With respect to the prevention, detection, mitigation, and remediation of cybersecurity incidents, our information security team, under the direction of our Senior Vice President, IT Operations, monitors our information systems, assesses the severity of any incidents it detects or that are otherwise reported, and follows escalation procedures embedded within our incident response plan to inform the Senior Vice President, IT Operations, other members of management, the Committee, and the Board, each as needed.

companyName: 1 800 FLOWERS COM INC

ticker: FLWS


text: Depending on the environment and system, we have implemented and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our critical technologies, including, for example: incident response plan; disaster recovery/business continuity plans; risk assessments; encryption of certain data; network security and access controls for certain systems; physical security; asset management, tracking and disposal; systems monitoring; and employee training.

companyName: IONIS PHARMACEUTICALS INC

ticker: IONS


text: We have made efforts to implement the National Institute of Standards and Technology (NIST) Cybersecurity Framework as well as supplemental guidance for information and operational technologies. We seek to follow federal and state statutory and regulatory guidance and have adopted internal policies and standards designed to align with these requirements.

companyName: HF Sinclair Corp

ticker: DINO


text: The Company has also implemented a vulnerability assessment program that is reviewed at least annually and more frequently, depending on changes to the risk environment. This process serves as a guiding enterprise-wide framework to outline the scope and procedures of the Company's cybersecurity risk management processes. By prioritizing vulnerability management and continuously evaluating the Company's internal and external environments for vulnerabilities, the Company aims to implement preventative measures to protect its information assets and technology-based infrastructure from cybersecurity threats. This approach helps to reduce the Company's exposure to material cybersecurity threat risks.

companyName: American Water Works Company, Inc.

ticker: AWK


text: Our dedicated 24x7 Security Operations Center incorporates specialized systems and processes for handling security incidents into its regular work and operates a robust, modern security infrastructure with appropriate security sensors and event monitoring capabilities. Upon detection of a cybersecurity incident, the Security Operations Center determines the severity of the incident in accordance with a pre-established incident severity matrix, initiates the appropriate notification and escalation protocols and begins triage. Predefined severity tiers serve as a guide to match our response to each incident's determined severity or risk level.

companyName: WESTERN DIGITAL CORP

ticker: WDC


text: connection with our use of third party services providers, we have certain processes in place to oversee and identify cybersecurity risks from threats and incidents. To date, we have not been materially impacted by risks from cybersecurity threats or incidents and we are not aware of cybersecurity threats or incidents that are reasonably likely to materially affect our business. However, there could be cybersecurity threats or incidents in the future that may adversely affect our business.

companyName: NETWORK-1 TECHNOLOGIES, INC.

ticker: NTIP


text: Depending on the environment, systems, and data, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, incident detection and response processes, vulnerability management policy, disaster recovery and business continuity plans, risk assessments, encryption of certain data, data segregation for certain data, network security and access controls, physical security controls, asset management, tracking and disposal, monitoring for certain systems, vendor risks management processes, employee training, penetration testing, employee training, cybersecurity insurance, and dedicated cybersecurity staff.

companyName: STARZ ENTERTAINMENT CORP /CN/

ticker: STRZ


text: As previously reported in the Original Form 8-K, on November 25, 2024, the Company became aware of a cybersecurity incident. The preliminary investigation revealed that a threat actor illegally accessed the Company’s information technology (“IT”) system and encrypted some of its data files. Upon detecting the unauthorized access, the Company immediately took steps to contain, assess and remediate the cybersecurity incident, including beginning an internal investigation, engaging external cybersecurity specialists, and restricting access to its IT system.

companyName: ENGLOBAL CORP


text: As the investigation of the incident is ongoing, the full scope, nature and impact of the incident are not yet known. As of the date of this filing, the incident has had and is reasonably likely to continue to have a material impact on the Company’s business operations until recovery efforts are completed. The Company has not yet determined whether the incident is reasonably likely to materially impact the Company’s financial condition or results of operations.

companyName: V F CORP

ticker: VFC


text: As disclosed in the Original Report, on May 1, 2024, the Company detected unauthorized occurrences by a third party on portions of the Company’s information technology (“IT”) systems. Upon detecting the unauthorized occurrences, the Company promptly initiated its previously established response protocols and began taking steps to contain, assess and remediate the cybersecurity incident, including beginning an investigation with leading external cybersecurity experts, activating its incident response plan, shutting down portions of the IT systems and notifying law enforcement.

companyName: BRANDYWINE OPERATING PARTNERSHIP, L.P.


text: As disclosed in the Original Report, the Company recently identified unauthorized activity on certain of its information technology systems. Upon detection of the unauthorized activity, the Company took steps in an effort to contain, assess and remediate the incident. On December 20, 2023, the Company elected to isolate systems from the Internet. The Company has retained leading experts, worked with law enforcement and notified certain regulatory authorities.

companyName: First American Financial Corp

ticker: FAF


text: We have notified and are cooperating with law enforcement and are also assessing our regulatory notification obligations, and we will make notifications as appropriate based on our investigation findings. As of the date of this filing, the incident has not had a material impact on the Company’s operations, and the Company has not determined the incident is reasonably likely to materially impact the Company’s financial condition or results of operations.

companyName: Hewlett Packard Enterprise Co

ticker: HPE


text: The Company has incurred, and may continue to incur, certain expenses related to its response to this incident. Based on the information available to date, the Company believes that the cybersecurity incident will have a material impact on its operations during the quarter ended December 31, 2024 but does not expect the incident to have a material impact on full year 2024 results. The Company remains subject to various risks due to the incident, including diversion of management’s attention, potential litigation, changes in customer or investor behavior, and regulatory scrutiny.

companyName: iLearningEngines, Inc.


text: Since the date of the Original Report, the Company has determined that the threat actor accessed and exfiltrated limited data from the Company’s environment, which includes some personally identifiable information. The Company is in the process of providing appropriate notifications to potentially affected parties and to regulatory agencies as required by applicable law.

companyName: KEY TRONIC CORP

ticker: KTCC


text: On the basis of the investigation to date, we have not found any evidence of malware, ransomware, data destruction or alteration, or that the threat actor currently has access to our systems. We continue to investigate the extent and impact of the incident, including whether the threat actor accessed any additional information or systems.

companyName: PRUDENTIAL FINANCIAL INC

ticker: PRU


text: As disclosed in the Original Report, on February 6, 2024, SouthState Bank, N.A. detected what was determined to be a cybersecurity incident. Upon detection, SouthState initiated its incident response and business continuity protocols and began taking measures to disrupt the unauthorized activity. In addition, SouthState has been conducting an investigation. A cybersecurity firm was engaged to assist. SouthState also notified banking regulators and law enforcement. As a result of these and other measures, SouthState has contained the impact of the cybersecurity incident.

companyName: SouthState Bank Corp

ticker: SSB


text: The Bank then took prompt steps to contain and remediate the incident. The Bank’s own information technology systems and networks were not compromised or affected, no unauthorized transactions were executed and no monies were transferred to the unknown persons, and Bank members were able to continue to execute transactions with the Bank.

companyName: Federal Home Loan Bank of New York


text: The incident impacted the Company’s operations, including distribution of products, billing, collections, and vendor payments. Distribution of print publications across our portfolio of products experienced delays, and online operations were partially limited. As of February 12, 2025, all core products are being distributed in the normal cadence, however weekly and ancillary products have not been restored. These products represent five-percent of the Company’s total operating revenue. The Company anticipates a phased recovery over the next several weeks.

companyName: LEE ENTERPRISES, Inc

ticker: LEE


text: The Company has concluded that the Incident had a material impact on the Company’s business during and results of operations for the second fiscal quarter ended June 30, 2024 (“Q2”). The Company’s GAAP earnings per diluted share for Q2 were $1.18, and the Company estimates that the Incident adversely affected its GAAP earnings per diluted share for Q2 by approximately $0.64 without taking into account any potential recoveries related to the Incident and after factoring in estimated lost income and expenses attributable to the Incident.

companyName: SONIC AUTOMOTIVE INC

ticker: SAH


text: While our investigation of this incident and its scope remains ongoing, the Company now understands this incident is likely related to earlier activity by this threat actor, of which we were notified in June 2023, involving unauthorized access to and exfiltration of a limited number of SharePoint files as early as May 2023. Following the notice in June, we immediately investigated with the assistance of external cybersecurity experts and took containment and remediation measures intended to eradicate the activity. Upon undertaking such actions, we determined that such activity did not materially impact the Company.


text: On November 25, 2024, ENGlobal Corporation (the “Company”) became aware of a cybersecurity incident. The preliminary investigation has revealed that a threat actor illegally accessed the Company’s information technology (“IT”) system and encrypted some of its data files. Upon detecting the unauthorized access, the Company immediately took steps to contain, assess and remediate the cybersecurity incident, including beginning an internal investigation, engaging external cybersecurity specialists, and restricting access to its IT system.


text: First American Financial Corporation (the “Company”) recently identified unauthorized activity on certain of its information technology systems. Upon detection of the unauthorized activity, the Company took steps in an effort to contain, assess and remediate the incident. On December 20, 2023, the Company elected to isolate systems from the Internet.


text: The incident has temporarily impacted Sensata’s operations, including shipping, receiving, manufacturing production, and various other support functions. While the Company has implemented interim measures to allow for the restoration of certain functions, the timeline for a full restoration is not yet known. The preliminary investigation has identified evidence that files were taken from the Company’s environment. The Company is working to identify and review the files involved and will take additional actions as appropriate based on its review, including notifying individuals and regulatory authorities in accordance with applicable law.

companyName: Sensata Technologies Holding plc

ticker: ST


text: This Form 8-K contains forward-looking statements, which are any predictions, projections or other statements about future events based on current expectations and assumptions that are subject to risks and uncertainties, which are described in our filings with the Securities and Exchange Commission. Forward-looking statements speak only as of the date they are made. Readers are cautioned not to put undue reliance on forward-looking statements, and the Company undertakes no duty to update any forward-looking statement to conform the statement to actual results or changes in the Company’s expectations.

companyName: MICROSOFT CORP

ticker: MSFT


text: As the investigation of the incident is ongoing, the full scope, nature and impact of the incident are not yet known. The Company’s real estate operations have continued throughout this matter in all material respects and, as of the date of this filing, the incident has not otherwise had a material impact on the Company’s operations. As of the date of this filing, the Company does not believe the incident is reasonably likely to materially impact the Company’s financial condition or results of operations.


text: Through that investigation, the Company learned that additional data, beyond what was initially identified, had been exfiltrated. The Company has identified and completed its review of most of the exfiltrated data (the “Data”). This review has confirmed that the Data included personally identifiable information (“PII”) and protected health information (“PHI”) of individuals, most of which is maintained by a Company subsidiary that provides patient support services.

companyName: Cencora, Inc.

ticker: COR


text: On May 9, 2024, and again on June 5, 2024, the U.S. Department of Justice determined that, under Item 1.05(c) of Form 8-K, a delay in providing public disclosure was warranted. AT&T is now timely filing this report. AT&T is working with law enforcement in its efforts to arrest those involved in the incident. Based on information available to AT&T, it understands that at least one person has been apprehended. As of the date of this filing, AT&T does not believe that the data is publicly available.

companyName: AT&T INC.

ticker: T


text: Based on VF’s preliminary analysis from its ongoing investigation, VF currently estimates that the threat actor stole personal data of approximately 35.5 million individual consumers. However, VF does not collect or retain in its IT systems any consumer social security numbers, bank account information or payment card information as part of its direct-to-consumer practices, and, while the investigation remains ongoing, VF has not detected any evidence to date that any consumer passwords were acquired by the threat actor.


text: The Company has incurred, and may continue to incur, certain expenses related to its response to this incident. As of the date of this Current Report on Form 8-K, the Company believes that the incident has not had, and is not reasonably likely to have, a material impact on the Company’s financial condition or results of operations. The Company remains subject to various risks due to the incident, including the adequacy of processes during the period of disruption, diversion of management’s attention, potential litigation, changes in customer behavior, and regulatory scrutiny.

companyName: HALLIBURTON CO

ticker: HAL


text: While the Company did not experience material impacts to its operating environment or costs from the event itself, the Company has incurred and accrued material non-recurring expenses in the first quarter related to the event based on potential notification requirements. The Company maintains a cyber insurance policy and has also notified federal law enforcement authorities of the incident.

companyName: CONDUENT Inc

ticker: CNDT


text: The cybersecurity incident has not had a material impact, and is not reasonably likely to have a material impact, on the Company’s business operations, and has not had a material impact, and is not reasonably likely to have a material impact, on the Company’s financial condition or results of operations.

companyName: NUCOR CORP

ticker: NUE


text: Current analysis indicates that the data exfiltrated primarily relates to IT related information and financial information the Company has been gathering and analyzing over the past few weeks in preparation of filing with the Securities and Exchange Commission its Annual Report on Form 10-K for the fiscal year ended August 31, 2025, which the Company expects to release in mid-November.

companyName: JEWETT CAMERON TRADING CO LTD

ticker: JCTC


text: As part of the closing process for the fourth quarter of fiscal year 2024, the Company has determined that, due to the cybersecurity incident, it incurred approximately $2.3 million of additional expenses, and was unable to fulfill approximately $15 million of revenue during the fourth quarter. Most of these orders are expected to be fulfilled in fiscal year 2025.


text: On August 16, 2025, Data I/O Corporation (the “Company”) experienced a ransomware incident (the “Incident”) on certain of its internal IT systems. Upon discovery, the Company promptly activated its response protocols, took steps to secure its global IT systems and implemented containment measures, including proactively taking certain platforms offline and implementing other mitigation measures. The Company also engaged leading cybersecurity experts to support the IT system recovery and conduct a comprehensive investigation. Based on the findings, the Company will take additional actions as appropriate, including notifying affected individuals and regulatory authorities in compliance with applicable laws.

companyName: DATA I/O CORP

ticker: DAIO


text: iLearningEngines, Inc. (the “Company”) recently became aware of a cybersecurity incident. The ongoing investigation has revealed that a threat actor illegally accessed the Company’s environment and certain files on its network, misdirected a $250,000 wire payment, and deleted a number of email messages. The wire payment has not been recovered.


text: When we became aware of the incident, we launched an investigation with industry-leading forensic investigators to understand what happened and mitigate risks to our users. We have notified and are working with law enforcement. As appropriate, we are also notifying regulatory authorities and users with respect to unauthorized access to personal information.

companyName: DROPBOX, INC.

ticker: DBX


text: As of the date of this filing, the incident has not had, and we do not believe it is reasonably likely to have, a material impact on our overall business operations, given our current understanding that this incident is limited to the Dropbox Sign infrastructure. We have not determined that the incident is reasonably likely to materially impact our financial condition or results of operations. We remain subject to various risks due to the incident, including potential litigation, changes in customer behavior, and additional regulatory scrutiny. Our remediation efforts are ongoing.


text: The Company is working diligently to restore those systems and resume normal operations as soon as possible, but cannot estimate the duration or extent of the disruption at this time. The Company has retained leading security experts, is working with law enforcement and notified customers, clients and certain government agencies. At this time, the Company believes the network interruption is specific to Change Healthcare systems, and all other systems across the Company are operational.

companyName: UNITEDHEALTH GROUP INC

ticker: UNH


text: On January 13, 2025, Conduent Incorporated (the "Company") experienced an operational disruption and learned that a ‘threat actor’ gained unauthorized access to a limited portion of the Company’s environment. Upon detection, the Company activated its cybersecurity response plan with the help of external cybersecurity experts to contain, assess, and remediate the incident. The Company restored the affected systems and returned to normal operations within days, and in some cases, hours. The disruption did not have a material impact to the Company’s operations.


text: The Company has incurred, and may continue to incur, certain expenses related to its response to this Incident. Further, the Company remains subject to risks and uncertainties as a result of the Incident. While the Company is continuing to evaluate the full scope and impact of the Incident, as of the date of this filing, the Incident has not had a material impact on the Company’s operations, and the Company is still in the process of determining whether the Incident is reasonably likely to materially impact the Company’s financial condition or results of operations.

companyName: MARINEMAX INC

ticker: HZO


text: On April 19, 2024, AT&T Inc. (“AT&T”) learned that a threat actor claimed to have unlawfully accessed and copied AT&T call logs. AT&T immediately activated its incident response process to investigate and retained external cybersecurity experts to assist. Based on its investigation, AT&T believes that threat actors unlawfully accessed an AT&T workspace on a third-party cloud platform and, between April 14 and April 25, 2024, exfiltrated files containing AT&T records of customer call and text interactions that occurred between approximately May 1 and October 31, 2022, as well as on January 2, 2023, as described below.


text: As disclosed in the Original Report, the Company identified unauthorized activity on certain of its information technology systems. Upon detection, the Company acted to contain, assess and remediate the incident. On December 20, 2023, the Company elected to isolate systems from the Internet. The Company retained leading experts, worked with law enforcement and notified certain regulatory authorities. The Company believes it has contained the incident and has resumed business operations.

companyName: First American Financial Corp

ticker: FAF


text: On June 9, 2025, Zoomcar Holdings, Inc. (the “Company”) identified a cybersecurity incident involving unauthorized access to its information systems. The Company became aware of the incident after certain employees received external communications from a threat actor alleging unauthorized access to Company data. Upon discovery, the Company promptly activated its incident response plan.

companyName: Zoomcar Holdings, Inc.

ticker: ZCAR


text: Although the Company has ascertained that certain files were exfiltrated, it is still investigating the extent of any sensitive information contained in the accessed systems, including whether any personal information was exfiltrated. It is evaluating what legal and regulatory notifications and filings may be required as a result of this incident and will make such filings as are required based on its findings. The Company continues to investigate the nature and scope of the unauthorized access.

companyName: UFP TECHNOLOGIES INC

ticker: UFPT


text: The Company has also incurred, and may continue to incur, expenses related to the cybersecurity incident, including approximately $600,000 to date related to external cybersecurity experts. The Company believes that the impact to profit margins due to lost production for approximately two weeks in its domestic and Mexico operations and the incremental expense measures to recover from and remediate the cybersecurity incident will have a material impact on the Company's financial condition and results of operations during the fourth quarter ending June 29, 2024.

companyName: KEY TRONIC CORP

ticker: KTCC


text: As disclosed in the Original Report, on July 10, 2024, Bassett detected unauthorized occurrences on a portion of its information technology (IT) systems. Upon detecting the unauthorized occurrences, Bassett immediately began taking steps to contain, assess and remediate the cyber incident, including beginning an investigation with leading external cybersecurity specialists, activating its incident response plan, and shutting down some systems. As a result of these and other measures, and while Bassett’s investigation and remediation efforts remain ongoing, Bassett believes the threat actor was ejected from Bassett’s IT systems on July 10, 2024.

companyName: BASSETT FURNITURE INDUSTRIES INC

ticker: BSET


text: The full scope and impact of this incident is not yet known and could result in a future determination that the incident may be material to the Company's financial statements and results of operations. As of the date of this Form 8-K, the incident has not resulted in any material disruption to the subsidiary’s operations or the Company’s business, and the Company does not expect this incident to have a material impact on the Company’s financial results and operations for the three months ended March 31, 2026.

companyName: TRIO-TECH INTERNATIONAL

ticker: TRT


text: On or about March 27, 2024, OraSure Technologies, Inc. (the “Company”) became aware of a cybersecurity incident in which an unauthorized third party gained access to Company data from certain information systems. Following detection of the incident, the Company initiated response protocols, commenced an investigation with the assistance of cybersecurity experts and external counsel, and notified law enforcement. The Company believes it has contained the incident and believes it has preserved the integrity of its core financial and operational systems.

companyName: ORASURE TECHNOLOGIES INC

ticker: OSUR


text: On or about February 14, 2026, UFP Technologies, Inc. (the “Company”) detected suspicious activity involving its information technology (“IT”) systems. Upon detecting the issue, the Company began taking steps to assess, contain, and remediate the unauthorized activity, including isolating the affected systems and launching an investigation with the assistance of external cybersecurity advisors.


text: Based on preliminary findings, the Company determined that an unauthorized third party accessed a limited dataset containing certain personal information of a subset of approximately 8.4 million users, including names, phone numbers, car registration numbers, personal addresses and email addresses associated with such users. At this time, there is no evidence that financial information, plaintext passwords, or other sensitive identifiers were compromised.


text: On February 21, 2024, Cencora, Inc. (the “Company”), learned that data from its information systems had been exfiltrated, some of which may contain personal information. Upon initial detection of the unauthorized activity, the Company immediately took containment steps and commenced an investigation with the assistance of law enforcement, cybersecurity experts and external counsel.

companyName: Cencora, Inc.

ticker: COR


text: This Form 8-K contains forward-looking statements, which are any predictions, projections or other statements about future events based on current expectations and assumptions that are subject to risks and uncertainties, which are described in our filings with the SEC. Forward-looking statements speak only as of the date they are made. Readers are cautioned not to put undue reliance on forward-looking statements, and the Company undertakes no duty to update any forward-looking statement to conform the statement to actual results or changes in the Company’s expectations.

companyName: MICROSOFT CORP

ticker: MSFT


text: As an update to information concerning the Change Healthcare cyberattack contained in the Filed Reports, the Company issued a press release on April 22, 2024, regarding its ongoing data assessment and support for impacted individuals, support for providers and customers with notifications, and Change Healthcare service restoration progress. A copy of the press release is attached to the Amendment as Exhibit 99.1 and incorporated by reference herein.


text: As of the date hereof, the incident has not had a material impact on the Company’s financial systems, operations or financial condition. While the Company’s investigation and assessment of this incident is ongoing, as of the date of this filing, the Company believes its primary IT systems are operational in all material respects and the Company does not believe the incident is reasonably likely to materially impact the Company’s financial condition or results of operations.


text: Upon discovery of the cybersecurity incident, the subsidiary immediately activated its response protocols, implemented containment measures, including proactively taking its network offline, launching an investigation with the assistance of third-party cybersecurity professionals and notifying law enforcement in Singapore. The subsidiary is taking steps to contain the incident, restore affected systems, and enhance monitoring across its network environment. The subsidiary is in the process of notifying affected parties as required by applicable law.


text: Likewise, the Company has been and is communicating with its customers and other stakeholders regarding the incident. The Company is following its process-based safety standards for ongoing operations under the Halliburton Management System and is working to identify effects of the incident. The Company continues to provide its products and services to customers globally.

companyName: HALLIBURTON CO

ticker: HAL


text: In response to the incident, the Company has taken immediate actions to contain the threat and enhance its security posture. These measures include implementing additional safeguards across the cloud and internal network, increasing system monitoring, and reviewing access controls. The Company is also engaging with third-party cybersecurity experts to further assist with the investigation. The Company has also notified the appropriate regulatory and law enforcement authorities and is cooperating fully with their inquiries.


text: On March 11, 2026, Trio-Tech International (“Company”) identified and responded to a cybersecurity incident in one of its subsidiaries (“subsidiary”) in Singapore. The subsidiary experienced a ransomware incident that resulted in encryption of certain files within the Company’s network. At that time, management determined that the incident was not material. On March 18, 2026, the incident escalated and resulted in the unauthorized disclosure of certain Company data. Following this development, management concluded that the incident may constitute a material cybersecurity event.


text: Based on the information available to the Company as of the date hereof, the Company believes that the incident has not had a material impact and is not reasonably likely to have a material impact, on the Company, including the Company’s financial condition and results of operations, except as disclosed herein.

companyName: ENGLOBAL CORP


text: When it learned of the issue, the Company activated its cybersecurity response plan and launched an investigation internally with the support of external advisors to assess and remediate the unauthorized activity. The Company’s response efforts included proactively taking certain systems offline to help protect them and notifying law enforcement. The Company’s ongoing investigation and response include restoration of its systems and assessment of impacted data.


text: The Incident did not involve the compromise of passwords or private keys, and at no time were any of the targeted contractors or employees able to access customer funds. While the Company is still investigating the affected data, it included: •Name, address, phone, and email; •Masked Social Security (last 4 digits only); •Masked bank-account numbers and some bank account identifiers; •Government‑ID images (e.g., driver’s license, passport); •Limited corporate data (including documents, training material, and communications available to support agents).

companyName: Coinbase Global, Inc.

ticker: COIN


text: In the Original Report the Company disclosed that it learned, on February 21, 2024, that data from its information systems had been exfiltrated, some of which may contain personal information. Upon initial detection of the unauthorized activity, the Company immediately took containment steps and commenced an investigation with the assistance of law enforcement, cybersecurity experts and external counsel.


text: As a result of the Company’s remediation and other activities, as of the date this Amendment, the Company believes that (i) the third party has been removed from the Company’s IT systems, (ii) the Company’s access to the affected information has been restored and (iii) the procedures performed have confirmed the completeness and integrity of the impacted information.

companyName: BRANDYWINE OPERATING PARTNERSHIP, L.P.


text: Although the Company ascertained that certain files were exfiltrated, it is still investigating the extent of any sensitive information contained within the accessed systems, including any personal information. It is evaluating what, if any, regulatory and legal notifications are required as a result of this incident and will make such notifications as required based on its findings.


text: While the investigation remains ongoing, as of the date of this Amendment, VF believes that the material impact or reasonably likely material impact on VF is limited to the material impacts on VF’s business operations disclosed in the Original Report which are no longer ongoing at this time. As of the date of this Amendment, VF also believes the impacts of the cyber incident are not material and are not reasonably likely to be material to its financial condition and results of operations.

companyName: V F CORP

ticker: VFC


text: The Company believes it has contained the incident, and the Company has undertaken remediation efforts, which are ongoing. As part of its remediation efforts, the Company is working with cybersecurity experts to reinforce its systems, strengthen its surveillance of cybersecurity threats and prevent unauthorized occurrences on or conducted through its IT systems.


text: The information contained in this Item 7.01 of this Current Report on Form 8-K shall not be deemed “filed” for any purpose, including for the purposes of Section 18 of the Securities Exchange Act of 1934, as amended (the “Exchange Act”), or otherwise subject to the liabilities of that Section, and shall not be deemed incorporated by reference into any filing under the Securities Act of 1933, as amended (the “Securities Act”), or under the Exchange Act, regardless of any general incorporation language in such filing.

companyName: UNITED NATURAL FOODS INC

ticker: UNFI


text: While the investigation is ongoing and the incident has temporarily disrupted Targus’ business operations, as of the date of this filing, the Company does not currently believe that this incident will materially impact the Company’s financial condition or results of operations taken as a whole. Business operations for each of the Company’s other subsidiaries have continued without disruption in all material respects, and no other Company business has been affected. Last year, Targus was not a significant contributor to the Company’s Operating Adjusted EBITDA.

companyName: BRC Group Holdings, Inc.

ticker: RILY


text: While the cybersecurity incident had a significant impact on certain of SouthState’s business processes, as of the date of this filing, it has not had a material impact on SouthState’s overall financial condition or results of operations, and SouthState has determined that the incident is not reasonably likely to have a material impact on its financial conditions or results of operations.

companyName: SouthState Bank Corp

ticker: SSB


text: general operating procedures for cybersecurity risk management are incorporated into our overall enterprise risk management programs, and share common methodologies, reporting channels and governance processes, including the following: General

companyName: INVO Fertility, Inc.

ticker: IVF


text: Governance of Cybersecurity Risks Our board of directors is responsible for the general oversight of cybersecurity risks and is informed of key updates to our cybersecurity processes by our audit committee and relevant members of our executive leadership team on at least an annual basis.

companyName: Amylyx Pharmaceuticals, Inc.

ticker: AMLX


text: As part of our cybersecurity risk management process, we take a risk-based approach to the evaluation of third-party vendors based on the criticality and size of the vendor. This process has included a review by our external partners, as appropriate.

companyName: Kalaris Therapeutics, Inc.

ticker: KLRS


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Committee reports to the full Board regarding its activities, including those related to cybersecurity.

companyName: Evolv Technologies Holdings, Inc.

ticker: EVLV


text: Notwithstanding our commitments to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. Please see Item 1A. "Risk Factors" for a discussion of our cybersecurity risks.

companyName: PROGRESS SOFTWARE CORP /MA

ticker: PRGS


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee oversees the risk assessment, risk management and internal controls over cyber security matters, as outlined in its committee charter.

companyName: CASTLE BIOSCIENCES INC

ticker: CSTL


text: Risk management and strategy We are increasingly dependent on sophisticated software applications and computing infrastructure to conduct key operations. We depend on both our own systems, networks, and technology as well as the systems, networks and technology of our contractors, consultants, vendors and other business partners.

companyName: Phio Pharmaceuticals Corp.

ticker: PHIO


text: Our Group Head, Cybersecurity/Information Security Officer has a total of more than 28 years of experience in cybersecurity, technology and information technology roles with financial services, technology and consulting companies. She joined Envestnet in 2020.

companyName: ENVESTNET, INC.


text: Review and provide oversight on the policies and procedures of the Company with respect to data privacy, and oversee the Company's compliance with applicable data privacy and cybersecurity laws and regulations; Evaluate the Cybersecurity Committee's composition and performance on an annual basis;

companyName: Cohen & Co Inc.

ticker: COHN


text: We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain.

companyName: Information Services Group Inc.

ticker: III


text: We maintain a cyber risk management program designed to identify, assess, manage, mitigate and respond to cybersecurity threats. This program, in conjunction with our enterprise risk management assessment processes, addresses cybersecurity risks to the corporate information technology, or IT, environment including systems, hardware, software, data, people and processes.

companyName: Protara Therapeutics, Inc.

ticker: TARA


text: We believe that cybersecurity is a critical component of our enterprise risk management process, and as such, we have implemented a cybersecurity program to assess, identify, and manage risks from cybersecurity threats that may result in adverse effects on the confidentiality, integrity, and availability of our information systems.

companyName: NPK International Inc.

ticker: NPKI


text: Mr. Tao brings more than 20 years of professional experience in business consultation, operations, and management, with a focus on the marketing industry.

companyName: ENTREPRENEUR UNIVERSE BRIGHT GROUP

ticker: EUBG


text: Risk Management and Strategy Our cybersecurity program is designed to protect information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction.

companyName: TERADATA CORP /DE/

ticker: TDC


text: Our head of the ITS Department and our executive management are primarily responsible for assessing and managing our material risks from cybersecurity threats.

companyName: Amphastar Pharmaceuticals, Inc.

ticker: AMPH


text: The Board of Directors receives quarterly reports from the CISO and CIO concerning NetScout's significant cybersecurity threats and risk and the processes NetScout has implemented to address them. The Board of Directors also receives various reports, summaries and presentations related to cybersecurity strategy, threats, risk and mitigation.

companyName: NETSCOUT SYSTEMS INC

ticker: NTCT


text: Response and Recovery Planning: We maintain incident response and recovery frameworks, tested twice yearly through simulations and tabletop exercises, to improve our preparedness to effectively manage and mitigate cybersecurity incidents.

companyName: Alto Ingredients, Inc.

ticker: ALTO


text: Cybersecurity Risk Management and Strategy As a provider of cybersecurity solutions, we are passionate about cybersecurity risk management. At CrowdStrike, cybersecurity risk management is an integral part of our overall enterprise risk management program.

companyName: CrowdStrike Holdings, Inc.

ticker: CRWD


text: Our ISC members includes our CIO and our Director of IT Security, Risk and Compliance who have a combined 20 years of risk management experience encompassing cybersecurity and technology security, such as threat assessments, risk management, cybersecurity insurance, incident response, end user awareness and vulnerability management.

companyName: ICU MEDICAL INC/DE

ticker: ICUI


text: We have adopted and require employees to abide by our personally identifiable information policy to help protect personal employee, vendor and tenant information. Employees are required to complete regular cybersecurity training and education annually, which is followed-up with quarterly testing and re-training, as necessary.

companyName: CBL & ASSOCIATES PROPERTIES INC

ticker: CBL


text: Our audit committee reports to our board of directors regarding its activities, including those related to cybersecurity. Our board of directors also receives briefings from our management team on our cyber risk management program.

companyName: Boundless Bio, Inc.

ticker: BOLD


text: our computer and communications hardware are protected through physical and software safeguards, they are still vulnerable to system malfunction, computer viruses, malware and ransomware, and other cybersecurity threats such as phishing and social engineering attacks.

companyName: Beyond Air, Inc.

ticker: XAIR


text: Our board of directors monitors and assesses strategic risk exposure, and our executive officers manage the material risks we face.

companyName: FOCUS UNIVERSAL INC.

ticker: FCUV


text: When reviewing key third-party information technology service providers, our engagement process customarily includes, among other things, a review of such providers' cybersecurity measures. Additionally, we use third-party data, such as Security Scorecard, to review and monitor such providers and as an indicator in respect of our cybersecurity environments.

companyName: MERCER INTERNATIONAL INC.

ticker: MERC


text: We believe our information technology team to be well-qualified in this area. These qualifications include professional experience in the field and recent participation in IT and cybersecurity programs organized by leading institutions with expertise in the field.

companyName: MUELLER INDUSTRIES INC

ticker: MLI


text: We have not experienced a cybersecurity incident that would materially affect the company's business strategy, results of operations or financial position.

companyName: Bionano Genomics, Inc.

ticker: BNGO


text: The CSO and CISO stay informed on information security risks through regular meetings on key cybersecurity projects and KPIs. Updates are communicated to the Global Security Steering Committee, which provides quarterly reports to the Board of Directors and to the Audit Committee.

companyName: NetApp, Inc.

ticker: NTAP


text: e-mail services and cloud based storage systems offered by well-known reputable software and service providers which incorporate cybersecurity protections in their products.

companyName: Transit Pro Tech Inc.


text: Risk Management and Strategy As one of the critical elements of our overall risk management approach, our cybersecurity program is focused on the following key areas:

companyName: STORE CAPITAL LLC


text: Eradication—remove malware from all affected systems, identify the root cause of the attack, and take action to prevent similar attacks in the future.

companyName: SCI Engineered Materials, Inc.

ticker: SCIA


text: internal cybersecurity coordinator is responsible for assessing and managing our material risks from cybersecurity threats, in close collaboration with our IT team and report to our CEO. This ensures that the senior management are kept abreast of the cybersecurity posture and potential risks faced by the Company.

companyName: Ainos, Inc.

ticker: AIMD


text: The Board receives regular updates from the Audit Committee, as well as from the Cybersecurity team, including a summary of key risk indicators, test results and related remediation, and recent threats and how the Company is managing those threats.

companyName: HASBRO, INC.

ticker: HAS


text: We did not experience a significant cybersecurity breach or associated expenses, penalties, or settlements for the twelve months ended December 31, 2023 and 2022.

companyName: BLUE DOLPHIN ENERGY CO

ticker: BDCO


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our CFO who serves as our CISO. Our CISO relies on both internal and external cybersecurity resources to manage overall cybersecurity risks.


text: Important to these programs is Invesco's investment in threat-intelligence, its active engagement in industry and government security-related forums, and its utilization of external experts to challenge its program maturity, assess its controls and routinely test its capabilities.

companyName: Invesco DB Multi-Sector Commodity Trust


text: Management Oversight of Cybersecurity Our Chief Information Officer ("CIO") and the Vice President ("VP") of Information Security have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants.

companyName: WATTS WATER TECHNOLOGIES INC

ticker: WTS


text: Commitment to Continuous Improvement Recognizing the dynamic nature of cyber threats, particularly in the digital medicine sector, our incident response plan is subject to ongoing review and refinement. We will regularly update our procedures to incorporate any lessons learned from past incidents and emerging best practices in cybersecurity.

companyName: QHSLab, Inc.

ticker: USAQ


text: The Board and Audit Committee receive regular reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Commerce.com, Inc.

ticker: CMRC


text: Management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with ISP personnel of the Investment Manager.

companyName: AB Commercial Real Estate Private Debt Fund, LLC


text: In the last three fiscal years, we have not identified material cybersecurity incidents, and the expenses we have incurred from cybersecurity incidents were immaterial, including penalties and settlements, of which there were none.

companyName: SILICON LABORATORIES INC.

ticker: SLAB


text: As of December 31, 2022, and 2023, GlobalX remains proud to report that it has not encountered any cybersecurity incidents that have materially impacted, or are reasonably likely to materially impact, the Company.

companyName: Global Crossing Airlines Group Inc.

ticker: JETMF


text: e.conduct regular phishing email simulations for all employees and contractors with access to our email systems to enhance awareness and responsiveness to possible threats; f.conduct annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data;

companyName: Inhibrx, Inc.


text: Risk management and strategy Cytokinetics recognizes the critical importance of developing, implementing, and maintaining cybersecurity measures designed to safeguard our information systems and protect the confidentiality, integrity, and availability of our critical data.

companyName: CYTOKINETICS INC

ticker: CYTK


text: Comprehensive cyber insurance coverage, including protection against social engineering fraud and other cyber incidents, to further mitigate potential financial losses.

companyName: HOOKER FURNISHINGS Corp

ticker: HOFT


text: Our Chief Financial Officer and Chief Operating Officer are jointly responsible for managing cybersecurity risks and implementing the required policies across the Company. Our Chief Executive Officer is responsible for making strategic decisions and approving external communication releases related to cybersecurity risks or incidents.

companyName: Applied Therapeutics, Inc.

ticker: APLT


text: have implemented various processes designed to identify, assess and manage material risks from cybersecurity threats to our information networks, third-party hosted services, communications systems, hardware and software (collectively, our "Systems"), and our data and our clients' data (together, "Data").

companyName: INTELLINETICS, INC.

ticker: INLX


text: Company employs several strategies for assessing, identifying, and managing material risks from cybersecurity threats. Components of this strategy include the use of industry standard traffic monitoring tools, and training users to detect, report, and prevent unusual behavior.

companyName: BLUE BIOFUELS, INC.

ticker: BIOF


text: Additionally, in 2023, the Company established its CyberSmart Defender Network, which is a multi-disciplinary team that includes representatives from across the Company's various departments, responsible for raising awareness of cybersecurity issues, sharing learnings, and gaining access to advanced cybersecurity information and training.

companyName: APA Corp

ticker: APA


text: cybersecurity professionals who analyze cybersecurity threats, define cybersecurity policy and requirements, implement protections, and monitor and respond to cybersecurity incidents;

companyName: Electromed, Inc.

ticker: ELMD


text: The Company's Board of Directors provides oversight of the Company's cybersecurity program through periodic updates, typically on a quarterly basis. Additionally, on an annual basis, cybersecurity risks are discussed as part of enterprise risk management.

companyName: NOV Inc.

ticker: NOV


text: cybersecurity awareness training for our employees, incident response personnel and senior management; and a risk management process for critical third-party service providers, suppliers and vendors that includes due diligence in selection and periodic monitoring to ensure that they adhere to applicable cybersecurity standards.

companyName: CORNING INC /NY

ticker: GLW


text: Thermon's cybersecurity risk management system is a comprehensive framework that helps the Company identify, assess, and mitigate known cybersecurity risks. The system is designed to protect the confidentiality, integrity, and availability of the Company's information assets.

companyName: Thermon Group Holdings, Inc.

ticker: THR


text: provide regular, mandatory training for our employees and contractors regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices;

companyName: TMC the metals Co Inc.

ticker: TMC


text: Management's Role: Day-to-day management of cybersecurity is handled by our IT staff, who do not have specialized training in cybersecurity. We are considering enhancing this role or outsourcing to professionals with specific cybersecurity expertise.

companyName: T3 Defense Inc.

ticker: DFNS


text: We have an IRP to prepare for and respond to cybersecurity incidents. The process is tested in annual tabletop exercises to help identify strengths and areas for improvement.

companyName: GILEAD SCIENCES, INC.

ticker: GILD


text: The goal is to maintain business continuity, protect proprietary technology, and safeguard customer and employee data in the event of a cyber incident.

companyName: FARADAY FUTURE INTELLIGENT ELECTRIC INC.

ticker: FFAI


text: utmost importance on the security of our systems and the data we will handle once BDTP TM is operational. We plan to implement a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes.

companyName: BLACKSTAR ENTERPRISE GROUP, INC.


text: He holds multiple professional certifications, including CISSP, PMP and multiple SANS certifications. Our chief technology officer and senior director of cybersecurity and compliance report to the Audit Committee on these matters. maintain a cybersecurity risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats.

companyName: Purple Innovation, Inc.

ticker: PRPL


text: As a result, we have implemented a multi-layered cybersecurity program that includes administrative, physical, and technical measures to protect our information systems. Through these processes and the other processes described above, including our incident response plan, our management is informed about cybersecurity threats and incidents affecting us.

companyName: ESTABLISHMENT LABS HOLDINGS INC.

ticker: ESTA


text: Dime Community Bank ("Dime", "the Bank") maintains comprehensive information technology and cybersecurity programs which encompass policies, procedures, assessments, monitoring, response plans, and testing to ensure technical, administrative, and physical controls are effective.

companyName: Dime Community Bancshares, Inc. /NY/

ticker: DCOM