text: Cyber Risk Management and Strategy • We have certain processes for assessing, identifying, and managing cybersecurity risks, which are built into our information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, protect employee and clinical trial information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural, and technical safeguards, and routine review of our policies and procedures in an effort to identify risks and refine our practices. We engage certain external parties to enhance our cybersecurity oversight. • In an effort to deter and detect cyber threats, we perform annual phishing tests with employees. We also conduct annual cybersecurity and prevention training for employees, which may cover topics such as social engineering, phishing, password protection, confidential data protection, and mobile security, and is designed to educate employees on incident reporting. We also use technology-based tools, including third-party tools and solutions, designed to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs. • We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems.

companyName: Bicara Therapeutics Inc.

ticker: BCAX


text: Governance Related to Cybersecurity Risks Our Board of Directors (the "Board") has established oversight mechanisms to manage risks from cybersecurity threats. Our Audit Committee of the Board has primary responsibility for oversight of cybersecurity risk, pursuant to the Audit Committee charter, and periodically updates our board of directors on such matters.

secItem: Item 1C


text: At the management level, our cybersecurity program is managed by our Senior Director, IT, who is tasked with the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks. Our Senior Director, IT reports to the Senior Vice President, Research & Development Strategy and Operations (SVP, R&D). Our Senior Director, IT has over twenty-five (25) years of experience in information technology, and also leverages the experience of a third-party managed systems provider. Our Senior Director, IT regularly reports to the SVP, R&D, as well as to other executive management on cyber matters, as appropriate.


text: Board Oversight of Cybersecurity Matters The Audit Committee is tasked with overseeing the Company's cybersecurity matters. Pursuant to the Audit Committee's charter, one of the Audit Committee's responsibilities is to discuss the Company's major risk exposures with management, including those related to cybersecurity, and the steps taken by management to monitor and control such exposures, including the Company's risk assessment and risk management guidelines, policies and practices.

companyName: Summit Midstream Corp

ticker: SMC


text: The Audit Committee reports to the entire Board of Directors periodically regarding its oversight of cybersecurity matters. In developing such updates to the Board of Directors, the Audit Committee relies in large part on periodic updates from Company management. Management of Cybersecurity Matters The Company's management assumes executive responsibility for assessing, identifying, and managing cybersecurity risks and incidents.


text: In particular, the Senior Vice President, Engineering and Operations (SVP, E&O) reports directly to the President, Chief Executive Officer, and Chairman of the Board and holds the highest level of executive responsibility for assessing and managing all cybersecurity threats, incidents, and risks at the Company, as well as developing and implementing all cybersecurity risk management, strategy, and governance recommendations.


text: The SVP, E&O is supported by critical internal positions within the Company, including but not limited to the Director of Information Technology, Vice President of Operational Technology and dedicated IT and OT resources with cybersecurity responsibilities. The SVP, E&O is further supported by various external parties, including but not limited to cybersecurity service providers, consultants, and other third parties engaged on an as-needed basis.


text: The Company's management has processes in place by which it is informed of and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks. These processes include, but are not limited to: • Maintaining an updated inventory and management of digital assets; • Ensuring familiarity and compliance with cybersecurity frameworks, including the National Institute of Standards and Technology's Cybersecurity Framework and ISO 27001; • Updating and maintaining an internal incident response plan; • Conducting risk assessments of the Company's cybersecurity policies, practices, and tools; • Employing appropriate antivirus, anti-malware, firewall, endpoint detection and response, backup and recovery software, multifactor authentication, virtual private network, account change monitoring, patch management, web content filter, spam filter and reporting, and vulnerability management software; • Conducting regular vulnerability scans of the Company's digital and operational infrastructure; • Requiring employees to complete a Cybersecurity Awareness Program, which includes computer-based training; and • Reviewing and evaluating developments in the threat landscape.


text: The Company's management also has processes in place to oversee and identify material risks from cybersecurity threats associated with its use of third-party service providers. These processes include, but are not limited to: • Maintaining an inventory of all third-party vendors engaged by the Company and assessing each vendor's level of access to the Company's IT and OT systems and information; and • Implementing access controls that restrict vendor access to only specific Company systems and information necessary to perform their service.


text: The SVP, E&O provides updates to the Audit Committee at its quarterly meetings regarding management of the Company's cybersecurity matters, including any new cybersecurity threats, incidents, risks, risk management solutions, trainings or education, infrastructure upgrades, or governance changes.


text: As of March 11, 2025, the Company's business strategy, operations, or financial condition have not been materially affected by and are not likely to be materially affected by, any cybersecurity threats or incidents.


text: Governance Related to Cybersecurity Risks Cybersecurity risk oversight is a top priority for management and our board of directors. Management is responsible for the day-to-day management of cybersecurity risks we face, while our board of directors, as a whole and through committees, is responsible for the oversight of risk management. Our incident response process contemplates that management will notify the board of directors of a material cybersecurity incident.

companyName: Newsmax Inc.

ticker: NMAX


text: Cybersecurity Risk Management To help protect the Company from a major cybersecurity incident that could have a material impact on operations or our financial results, we have implemented policies, procedures, programs and controls, including technology investments that focus on cybersecurity incident prevention, identification and mitigation. The steps we take to reduce our vulnerability to cyberattacks and to mitigate impacts from cybersecurity incidents include but are not limited to establishing information security policies and standards, regular security audits, access controls, controlled use of administrative privileges, advanced threat detection, network security, vulnerability testing, compliance audits, incident response plan, employee training, and engaging third party risk management experts. We leverage CIS (Center for Internet Security) controls as a guideline to enhance our cybersecurity risk management strategy. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation.


text: Additionally, we follow a cybersecurity incident response process that provides a framework for responding to cybersecurity incidents. The process identifies applicable requirements for incident disclosure and reporting and also provides protocols for incident evaluation, including the use of third-party service providers and partners, processes for notification and internal escalation of information to our senior management, the Board and the audit committee. It also addresses requirements for our external reporting obligations. The cybersecurity incident response process is reviewed and updated, as necessary, under the leadership of the Chief Information Officer.


text: Cyber Risk Management and Strategy As a part of the overall risk management system for the Company, processes are in place to assess, identify and manage material risks from cybersecurity threats. The Adviser manages the Company's day-to-day operations and has implemented a cybersecurity policy that applies to the Company and its operations. With respect to cybersecurity, the Company and the Adviser rely on the systems of Goldman Sachs, its third-party service providers and the Company's service providers.

companyName: Goldman Sachs Real Estate Finance Trust Inc


text: Goldman Sachs' cybersecurity risk management processes are integrated into its overall risk management processes. Goldman Sachs has established an Information Security and Cybersecurity Program (the "Cybersecurity Program"), administered by Technology Risk within its Engineering organization, and overseen by its chief information security officer. Goldman Sachs' chief information security officer and senior management within its Technology Risk and Operational Risk, as well as its management personnel overseeing the Cybersecurity Program, all have substantial relevant expertise in the areas of information security and cybersecurity risk management. This program is designed to identify, assess, document and mitigate threats, establish and evaluate compliance with information security mandates, adopt and apply our security control framework, and prevent, detect and respond to security incidents. The Cybersecurity Program is periodically reviewed and modified to respond to changing threats and conditions. A dedicated Operational Risk team, which reports to the chief risk officer of Goldman Sachs, provides oversight and challenge of the Cybersecurity Program, independent of Technology Risk, and assesses the operating effectiveness of the program against industry standard frameworks and risk appetite-approved operational risk limits and thresholds.


text: Cyber Risk Governance The board of directors provides strategic oversight on cybersecurity matters generally, including oversight of material risks associated with cybersecurity threats. The board of directors receives periodic reports and updates from Goldman Sachs which generally include the overall state of the Cybersecurity Program, the current cybersecurity threat landscape, material risks from cybersecurity threats, cybersecurity incidents, risk management policies and/or risk assessment initiatives.


text: Processes for assessing, identifying, and managing material risks from cybersecurity Morgan Stanley's Cybersecurity Program takes into account industry best practices and addresses risks from cybersecurity threats to the Firm's network, infrastructure, computing environment, and the third-parties Morgan Stanley relies on, including third parties relied on by the Company. Morgan Stanley periodically assesses the design of its cybersecurity controls against the Cyber Risk Institute Cyber Profile, which is based on the National Institute of Standards and Technology Cybersecurity ("NIST") Framework for Improving Critical Infrastructure Cybersecurity, as well as against global cybersecurity regulations, and develops improvements to those controls in response to those assessments. Morgan Stanley's Cybersecurity Program also includes cybersecurity and information security policies, procedures, and technologies that are designed to address regulatory requirements and protect Morgan Stanley's clients', employees' and own data, and the data of the Company and its officers and unitholders, against unauthorized disclosure, modification, and misuse. These policies, procedures, and technologies cover a broad range of areas, including: identification of internal and external threats, access control, data security, protective controls, detection of malicious or unauthorized activity, incident response, and recovery planning.

companyName: SL Investment Fund II LLC


text: Board oversight of risks from cybersecurity threats Our Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. Our Board receives periodic updates from the CCO of the Company, the CIO/CISO, and/or Operational Risk functions, regarding the overall state of Morgan Stanley's Cybersecurity Program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Cybersecurity Risk Management and Strategy We view managing cybersecurity risk as imperative to protecting the confidentiality, integrity, availability, and resiliency of the information and systems we use to achieve our strategic business goals and satisfy our customers and partners. To that end, we have developed a formal cybersecurity risk management program that is integrated into our broader enterprise risk processes in an effort to protect our applications, networks, and systems from risks from cybersecurity threats. We use elements of the NIST Cybersecurity Framework and other recognized industry standards to inform and guide the design of this program, though we do not purport to meet any particular technical standards, specifications, or requirements of NIST.

companyName: SailPoint, Inc.

ticker: SAIL


text: We engage with multiple teams across the business, including IT, Product, Engineering, DevOps, Legal, Human Resources, Compliance, and Sales, in an effort to address all aspects and phases of the cybersecurity risk lifecycle, including identification, assessment, treatment, monitoring, and reporting. We also engage with external independent partners on a regular basis to assess the maturity of our cybersecurity risk management program and to recommend improvements thereto, including with respect to third-party risk. We also conduct annual audits and control testing to evaluate the efficiency of our controls across the organization.


text: Key features of our cybersecurity risk management program include • A dedicated team of risk analysts who manage the program and associated activities, such as risk assessments, risk lifecycle management, control assessments, and risk reporting. • Risk assessments that are conducted by the risk team on a regular basis, which sometimes include emerging topics addressed through targeted risk assessments. • Security incident response policies and procedures to investigate and respond to security incidents, including procedures to assess the threat of relevant vulnerabilities or security incidents, and to establish remediation and mitigation actions for events. • Security awareness training campaigns assigned to our users at least twice a year covering a multitude of security and privacy topics. • Management of third-party risk, including conducting cybersecurity assessments of vendors before onboarding them, followed by ongoing monitoring for compliance with standards.


text: We have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We nevertheless face ongoing risks from cybersecurity threats that, if realized, could affect us, including our operations, business strategy, results of operations, or financial condition. See Part I, Item 1A, "Risk Factors" in this Annual Report for additional information regarding potential cybersecurity risks, particularly the risk factor titled "Cyber attacks or other cybersecurity breaches, incidents, or disruptions with respect to our networks, systems, or applications, including unauthorized access to, or disclosure or other processing of, our proprietary, confidential, or sensitive information, including personal information, could disrupt our operations, compromise sensitive information related to our business or personal information processed by us or on our behalf, and expose us to liability, which could harm our reputation and adversely affect our business, financial condition, and results of operations, and as we grow, we may become a more attractive target for cyber attacks."


text: Cybersecurity Governance Our Board oversees our risk management efforts and has created a dedicated cybersecurity committee to specifically oversee our cybersecurity risk policies, plans, and programs. The cybersecurity committee typically meets at least quarterly and at each regular meeting, management, including from our Chief Information Security Officer (CISO), provides an update to the committee regarding our cybersecurity risk management program, including with respect to plan design, recent cybersecurity incidents (if any), and general cybersecurity developments.


text: Our management team, including our CISO, is responsible for assessing and managing our risks from cybersecurity threats under the cybersecurity committee's oversight. Our current CISO has nearly 20 years of cybersecurity experience in both the public and private sectors. His senior public sector roles include Senior Policy Advisor and the Director of Stakeholder Engagement in the Office of the National Cyber Director, Chief of Cyber Threat Analysis at the Cybersecurity and Infrastructure Security Agency (CISA), CISO of the Pandemic Response Accountability Committee, and Deputy CISO of the Pension Benefit Guaranty Corporation.


text: Our CISO leads an internal cybersecurity team comprised of individuals with varying experience and skillsets. This team covers a variety of cybersecurity-related functions, including security operations, strategy and governance risk and compliance, program management, security architecture and engineering, vulnerability management, and product security. We also have a dedicated security operations center that is responsible for detection and monitoring of cybersecurity incidents. Our CISO takes steps to stay informed about and monitor the identification, prevention, detection, protection, mitigation, and remediation of key cybersecurity risks and incidents through various means. In the case of a security event, the security incident response plan is activated to respond to the security event. We also assess and manage our cyber risks through our internal Information Security and Privacy Governance Committee, which is composed of a cross-organizational leadership team and was formed to oversee the management, operation, and overall effectiveness of the information security management system.


text: The Audit Committee ("Audit Committee") of the Company's Board of Directors (the "Board") has been delegated with the oversight of the Company's risk management program, which includes the identification, assessment and management of material cybersecurity risks. A cybersecurity threat is any potential unauthorized occurrence, on or conducted through, the Company's information systems that may result in adverse effects on the confidentiality, integrity or availability of the Company's information systems or any information residing therein. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: TIC Solutions, Inc.

ticker: TIC


text: Cybersecurity risk management and strategy The Company has implemented a comprehensive cybersecurity risk management program designed to protect confidentiality, integrity, and availability of critical systems and information.


text: The Company's cybersecurity program is focused on the following key areas • Technical Safeguards The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning The Company has established and maintains incident response and recovery plans to timely, consistently, and compliantly address cybersecurity threats that may occur despite the Company's safeguards, and such plans are tested and evaluated on a regular basis. • Dedicated Staffing The Company maintains a Network Operations Center staffed with dedicated IT security, infrastructure, and compliance professionals who oversee risk assessments, security processes, and incident responses. • Third-Party Risk Management The Company maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact the Company's business in the event of a cybersecurity incident affecting those third-party systems. • Outside Consultants The Company engages various outside consultants, including contractors, assessors, outside attorneys and other third parties, to among other things Assist in the design, implementation, and testing of our cybersecurity program, policies and procedures monitor Company networks, servers and endpoints to identify vulnerabilities perform assessments on the Company's cybersecurity measures, including independent reviews of the Company's information security control environment and operating effectiveness review and place cyber insurance coverages including access to various third-party vendors to support the Company, should the need arise assist the Company in ensuring ongoing compliance with applicable legal and regulatory requirements. • Education and Awareness The Company provides ongoing and annual training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.


text: As the Company focuses on establishing its governance policies and procedures in all areas, in 2025, the Company plans to establish an Information Security Committee (the "ISC") comprised of the VP Infrastructure and Cybersecurity ("VP of IT"), Chief Information Officer ("CIO"), Chief Financial Officer ("CFO") and General Counsel ("GC"). The ISC will be the focal point for all information security activities throughout the Company and its subsidiaries. The ISC, led by the VP of IT will work collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. The ISC will be charged with continuous improvement and implementation of policies and procedures for incident response handling, monitoring, and addressing security risks on an ongoing basis. The ISC will also be responsible for deploying technology and information security experts to monitor security risks and advise, contain, analyze, and report on security incidents, as necessary. As described above, the Company also retains a third-party cyber security firm to work hand-in-hand with the VP of IT and, once established, the ISC, to develop and oversee a program to prevent, detect, mitigate and remediate cybersecurity incidents.


text: The Board has delegated to the Audit Committee the responsibility for monitoring and overseeing the Company's cybersecurity and other information technology risks, controls, strategies and procedures. The Company's Chief Information Officer, on behalf of the ISC, provides reports to the Audit Committee at least annually regarding technological risk exposure and the Company's cybersecurity risk management strategy and reports any incidents to the Audit Committee in real time. Based on these reports, the Audit Committee periodically evaluates the Company's information security strategies to ensure its effectiveness and, if appropriate, may also include a review from third-party experts. The Company is in the process of developing its Internal Audit function. which will provide quarterly updates to the Audit Committee which include an update on cybersecurity risks and related internal controls.


text: Management's Expertise The Company's CIO has over two decades of experience in technology development, management, and security, including responsibility for global portfolios of digital assets, intellectual property, and proprietary data. The CIO holds a technical undergraduate degree and a graduate business degree with a strong technical focus. Additionally, the Company's CEO, CFO, and GC each have over 15 years of experience managing enterprise risks, including cybersecurity threats, either at the Company or in similar organizations. Each executive holds undergraduate and graduate degrees in their respective fields, further reinforcing the Company's commitment to cybersecurity governance at the highest levels.


text: The Company's VP of IT, reporting to the CIO, oversees cybersecurity and IT infrastructure. The VP of IT remains continuously informed on emerging cybersecurity threats, industry developments, and evolving risk management techniques, ensuring the Company's ability to prevent, detect, mitigate, and remediate cybersecurity incidents. The VP of IT supervises internal cybersecurity teams and external service providers, assesses and manages material cybersecurity risks, and oversees risk mitigation strategies. With extensive global experience in managing complex information systems and deploying advanced cybersecurity technologies, the VP of IT also holds a recognized certification from a leading cybersecurity training and research institute.


text: Risks from Cybersecurity Threats Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents.


text: Cyber Risk Management and Strategy We have implemented and maintain an information security program that includes processes for the identification, assessment, and mitigation of cybersecurity risks. We conduct periodic assessments of our assets as part of our risk management process and to evaluate the effectiveness of applicable security controls. These assessments are informed by industry standards. Our cybersecurity risk management process is a part of our overall risk management program. We also have an employee education program that includes training designed to raise awareness of cybersecurity threats. We maintain an incident response plan that outlines the legal and governance process for identifying and managing material cyber risks to our information and information systems and our framework for assessing and responding to cyber incidents, as applicable.

companyName: Sionna Therapeutics, Inc.

ticker: SION


text: Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we do, from time to time, experience threats and communicate security incidents relating to our and our third party vendors' data and information systems. For more information about these risks, please refer to the section entitled "Risk Factors" in this Annual Report.


text: Governance Related to Cybersecurity Risks Our head of information technology ( IT), who reports to the Chief Financial Officer (collectively, IT Leadership), has primary responsibility for the strategic leadership and management of our cybersecurity program. Our head of IT has over 25 years of experience building and leading information technology and security teams. Our IT Leadership works alongside other functions to maintain and implement our cybersecurity strategy. Our IT Leadership meets as circumstances warrant with other members of our management, including executive leadership, to review and update incident response procedures and other aspects of our cybersecurity program.


text: The audit committee of Sionna's board of directors has ultimate oversight over cybersecurity risk. Our IT Leadership presents to the audit committee periodically regarding cybersecurity matters, including updates on security testing and assessments, cyber risks, and related cyber strategy, as applicable. The Chief Financial Officer and the General Counsel are responsible for informing the audit committee in the event of any material cybersecurity incidents and any potential disclosure obligations arising from such incidents. The audit committee will update the board of directors on matters related to cybersecurity as needed.


text: Material Impact of Cybersecurity Risks As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business. Additional information about cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors" under the heading "The failure of cybersecurity protection systems, as well as the occurrence of events unanticipated in our disaster recovery systems and management continuity planning, could impair our ability to conduct business effectively," which should be read in conjunction with the information above.

companyName: New Mountain Private Credit Fund


text: Our cybersecurity risks and associated mitigations are evaluated by our management and the ITSC as needed, but no less frequently than annually. Management and representatives of the ITSC periodically report to our board of trustees on developments to the information security and cybersecurity risks facing us. Reports include, among other things, an overview of the controls and procedures related to assessing, identifying, and managing risks related to cybersecurity threats, oversight of third-party service providers and related cybersecurity threats, and management's evaluation of cybersecurity risks material to us. Additional information about cybersecurity risks we face is discussed in Item 1A.—Risk Factors—Cybersecurity Breaches, Identity Theft and Other Disasters, which should be read in conjunction with the information above.


text: As a VIE that is 50.1% held by FE, we rely on, and are supported by, FirstEnergy's cyber security risk management program.

companyName: FirstEnergy Transmission, LLC


text: Risk Management and Strategy FirstEnergy has established a broad framework to assess, identify and manage material risks from cyber security threats. This program is established at the executive level, with regular reporting to, and oversight by, the FE Board as described below. At the highest level, FirstEnergy's program includes multi-layered governance by management, the FE Audit Committee, the FE Operations and Safety Committee, and the FE Board, as described in greater detail below.


text: FirstEnergy's Cyber Security Program identifies security controls and user responsibilities for the organization to identify and manage the risk of a cyber security incident. FirstEnergy also conducts various internal and external risk assessments each year. These include required annual compliance assessments, such as requirements under the Sarbanes-Oxley Act and Payment Card Industry Data Security Standard compliance audits, as well as ad-hoc assessments driven by emerging risks, changes in FirstEnergy's environment, or benchmark/roadmap needs. Risks identified in such assessments are considered for inclusion in FirstEnergy's risk portfolio, or incorporated directly into the Cyber Security Program, and are then prioritized and addressed as needed through the organization's written policies and procedures. The risk assessment along with risk-based analysis and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, of impact on FirstEnergy and others, such as vendors and customers, if a risk materializes, feasibility and cost of controls, and impact of controls on operations and others. FirstEnergy also regularly evaluates the adequacy and sufficiency of specific controls.


text: Board Governance and Management The FE Board has identified cyber security as a key enterprise risk and prioritizes the mitigation of this risk through FirstEnergy's enterprise risk management process. Responsibility for oversight of risk management generally lies with the FE Board and the FE Audit Committee has primary responsibility to oversee enterprise risk management. To effectively manage oversight of FirstEnergy's cyber security risk management practices, since 2022, the FE Board has delegated oversight authority to each of FE's Audit and Operations and Safety Committees, respectively, as detailed in each Committees' charters. The FE Audit Committee has primary responsibility to oversee the disclosure of material cyber security incidents, as well as the general obligation to ensure the proper risk oversight structure of cyber security as part of FirstEnergy's overall enterprise risk management program and the internal controls applicable to cyber security matters. The FE Operations and Safety Oversight Committee has primary responsibility to oversee the operational aspects of FirstEnergy's cyber security policies, programs, initiatives and strategies, as well as operational risk considerations related to cyber security matters. FirstEnergy's CISO regularly provides reports at the FE Audit Committee, FE Operations and Safety Oversight Committee, and to the full FE Board. Each such Committee and the full FE Board work collaboratively to ensure fulsome oversight with the proper focus of each respective Board body. These reports include, among other things, current and emerging cyber security risks to FirstEnergy, incidents that were escalated to management during the prior quarter, including those that did not require immediate escalation to the appropriate Committee and/or full FE Board, internal and external assessments of FirstEnergy's cyber security program, and a roadmap of projects to manage its cyber security posture.


text: In the event of any significant cyber security incident involving FET or its subsidiaries, FirstEnergy's Cyber Security Incident Response Plan provides for a severity determination by the cyber security incident response team based on factors such as the number of assets affected, the likelihood of inappropriate data exposure, operational impact, reliability impact, and regulatory impact. Dependent upon the severity of an incident, it is FirstEnergy's practice to escalate the incident to the FE Senior Vice President, Shared Services, FE Chief Risk Officer, and the FE and FET senior leadership teams, including the FE Chief Legal Officer, FE and FET principal financial officers, and the FE and FET principal executive officers. Such members of management then determine whether, based on various factors, the incident requires immediate escalation to the FET Board, FE Audit Committee and FE Operations and Safety Committee, or the full FE Board.


text: Although the risks from cyber threats have not materially affected FirstEnergy's or FET's business strategy, results of operations, or financial condition to date, FirstEnergy continues to closely monitor cyber risk. Overall, FirstEnergy has implemented tactical processes for assessing, identifying, and managing material risks from cyber security threats to FirstEnergy including governance at the executive and board level of FirstEnergy's Cyber Security Program, including FE's risk management strategy and the controls designed to protect its operations. Additionally, FirstEnergy, through its Disclosure Committee, has updated its disclosure controls and procedures to ensure appropriate disclosure of any material cyber security incidents. See Item 1A. Risk Factors for additional information regarding FirstEnergy's or FET's cyber security risks. Those sections of Item 1A. Risk Factors should be read in conjunction with this Item 1C. Cybersecurity.


text: As of December 31, 2024, no risks from cybersecurity threats or incidents have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition.

companyName: APA Corp

ticker: APA


text: The standing Cybersecurity Committee of the Company's Board of Directors assists with oversight of the Company's cybersecurity program and the material risks associated with the threats identified under the program. Given the Cybersecurity Committee's chair's previous military experience in positions relevant to information security and his NACD-sponsored CERT Certificate in Cybersecurity Oversight from Carnegie Mellon University's Software Engineering Institute, the committee benefits from his perspectives, skills, and training when reviewing and managing the Company's exposure to cybersecurity risks.


text: APA's Executive Vice President, Administration, is primarily responsible for identifying, assessing, and managing the material risks associated with cybersecurity threats and the incidents identified from time to time thereunder. He manages the Company's Information Security Team, which comprises cybersecurity professionals responsible for the day-to-day operation of the Company's cybersecurity program and managing the Company's threat intelligence, vulnerability management, forensics, and security architecture systems. APA's Executive Vice President, Administration, has 35 years of experience managing data and technology in the energy industry, including serving as the Company's CIO from 2015-2020. He receives regular updates from external cybersecurity specialists on emerging trends, threats, and technologies in the cybersecurity industry. The Executive Vice President, Administration, reports directly to APA's Chief Executive Officer and presents all relevant information to the Cybersecurity Committee.


text: Additionally, the Company's CyberSmart Defender Network, which is a multi-disciplinary team that includes representatives from across the Company's various departments, is responsible for raising awareness of cybersecurity issues, sharing learnings, and gaining access to advanced cybersecurity information and training.


text: Under the direction of the Executive Vice President, Administration, management's responsibilities with respect to the Company's cybersecurity program include (i) identifying and managing cybersecurity risks, (ii) coordinating cybersecurity incident response, (iii) assessing the health and maturity of the Company's cybersecurity policies, procedures, and plans, including the program, and (iv) reporting overall progress to the Cybersecurity Committee and to the full Board of Directors.


text: The Company's Chief Information Security Officer ("CISO") is responsible for assessing, identifying, and managing our risks from cybersecurity threats. This individual has over 30 years of experience in information security positions. Our CISO holds the Certified in Risk and Information Systems Control ("CRISC") certification from the Information Systems Audit and Control Association, a leading independent cybersecurity association.

companyName: Primo Brands Corp

ticker: PRMB


text: Our Board of Directors, primarily through the Audit Committee, oversees management's approach to managing cybersecurity risks. The Audit Committee holds periodic discussions with management regarding the Company's guidelines and policies with respect to cybersecurity risks and receives regular reports regarding such risks and the steps management has taken to monitor and control any exposure resulting from such risks. Our CISO also leads an annual review and discussion with the full Board of Directors dedicated to the Company's cyber risks, threats, and protections and provides updates throughout the year, as warranted.


text: Material cybersecurity incidents are required to be reported to the Board of Directors and to the SEC on Form 8-K. Our systems and services are vulnerable to interruptions or other failures resulting from cybersecurity attacks, such as computer viruses, ransomware, phishing, hackers, or other security issues. In addition, the rapid evolution and increased adoption of new technologies, such as artificial intelligence, may intensify our cybersecurity risks. An interruption or cybersecurity breach, disruption or misuse of our information systems, or the information systems of our third-party service providers, could have a material negative effect on our business, financial condition and results of operations but we have processes in place to mitigate these risks. As of the date of this report, in the past twelve months, we have not experienced material business disruption, monetary loss, and/or data loss as a result of phishing, business email compromise or other types of attacks, and we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. However, we cannot guarantee that material incidents will not occur in the future.


text: Depending on the environment, systems, and data, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, incident detection and response processes, vulnerability management policy, disaster recovery and business continuity plans, risk assessments, encryption of certain data, data segregation for certain data, network security and access controls, physical security controls, asset management, tracking and disposal, monitoring for certain systems, vendor risks management processes, penetration testing, employee training, cybersecurity insurance, and dedicated cybersecurity staff.

companyName: Lionsgate Studios Corp.

ticker: LION


text: We use third-party service providers to perform a variety of functions throughout our business, application providers, hosting providers, supply chain resources and data back-up service providers. We have a vendor management program designed to manage cybersecurity risks associated with our use of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process involves different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider. Components of the vendor risk management program include, for example, conducting risk assessments for certain vendors, reviewing certain vendors' written security programs, reviewing security assessments and responses to security questionnaires, auditing of certain vendors, vulnerability scans related to vendors, and the imposition of certain contractual information security obligations for certain vendors.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Service disruptions or failures, security incidents impacting Lionsgate or its third-party service providers' information systems, data and networks may disrupt its businesses, damage its reputation, expose it to regulatory investigations, actions, litigation, fines and penalties or have a negative impact on its results of operations including but not limited to loss of revenue or profit, loss of customers or sales and other adverse consequences."


text: Our Board of Directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Audit & Risk Committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: The Company's information security team, which is led by the Company's Director of Information Technology and also includes the Company's Chief Financial Officer and other members of the Company's internal audit and finance departments, is responsible for assessing and managing the Company's cybersecurity risks and data protection practices. The Company's Director of Information Technology has over 10 years of experience in managing cybersecurity risks and advising on cybersecurity matters.

companyName: EVI INDUSTRIES, INC.

ticker: EVI


text: During the fiscal year ended June 30, 2025, the Company did not identify any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition.


text: As previously disclosed in a Current Report on Form 8-K, on August 21, 2024, Halliburton Company (the “Company”) became aware that an unauthorized third party gained access to certain of its systems.

companyName: HALLIBURTON CO

ticker: HAL

secItem: Item 1.05


text: When it learned of the issue, the Company activated its cybersecurity response plan and launched an investigation internally with the support of external advisors to assess and remediate the unauthorized activity. The Company’s response efforts included proactively taking certain systems offline to help protect them and notifying law enforcement. The Company’s ongoing investigation and response include restoration of its systems and assessment of impacted data.


text: Likewise, the Company has been and is communicating with its customers and other stakeholders regarding the incident. The Company is following its process-based safety standards for ongoing operations under the Halliburton Management System and is working to identify effects of the incident. The Company continues to provide its products and services to customers globally.


text: The incident has caused disruptions and limitation of access to portions of the Company’s business applications supporting aspects of the Company’s operations and corporate functions. The Company believes the unauthorized third party accessed and exfiltrated information from the Company’s systems. The Company is evaluating the nature and scope of the information, and what notifications are required.


text: The Company has incurred, and may continue to incur, certain expenses related to its response to this incident. As of the date of this Current Report on Form 8-K, the Company believes that the incident has not had, and is not reasonably likely to have, a material impact on the Company’s financial condition or results of operations. The Company remains subject to various risks due to the incident, including the adequacy of processes during the period of disruption, diversion of management’s attention, potential litigation, changes in customer behavior, and regulatory scrutiny.


text: On May 6, 2024, Key Tronic Corporation (the “Company”) detected unauthorized third party access to portions of its information technology (“IT”) systems. Upon detection of this outside threat, the Company activated its cyber incident procedure to investigate, contain, and remediate the incident, including beginning an investigation with external cybersecurity experts and notifying law enforcement. The incident has caused disruptions, and limitation of access, to portions of the Company’s business applications supporting aspects of the Company’s operations and corporate functions, including financial and operating reporting systems. As the investigation of the incident is ongoing, the full scope, nature and impact of the incident are not yet known, but based on the information reviewed to date, the Company believes the unauthorized activity has been contained and is working diligently to bring the impacted portions of its IT system back online.

companyName: KEY TRONIC CORP

ticker: KTCC


text: As of the date of this filing, the Company does not believe the incident is reasonably likely to have a material impact on the Company, including its financial condition or results of operations.


text: As disclosed in the Original Report, on May 6, 2024, the Company detected unauthorized third party access to portions of its information technology (“IT”) systems (the “cybersecurity incident”). Upon detection of this outside threat, the Company activated its cyber incident response procedure to investigate, contain, and remediate the incident, including engaging external cybersecurity experts to help investigate the scope and impact of the cybersecurity incident and notifying law enforcement. The cybersecurity incident caused disruptions, and limitation of access, to portions of the Company’s business applications supporting aspects of the Company’s operations and corporate functions, including financial and operating reporting systems.


text: As a precautionary measure, the Company halted domestic and Mexico operations for approximately two weeks during remediation efforts, but other international operations continued without disruption. As of the date of this filing, the Company’s operations and corporate functions have been restored, and we believe that the unauthorized third party no longer has access to the Company’s IT systems.


text: Since the date of the Original Report, the Company has determined that the threat actor accessed and exfiltrated limited data from the Company’s environment, which includes some personally identifiable information. The Company is in the process of providing appropriate notifications to potentially affected parties and to regulatory agencies as required by applicable law.


text: The Company has also incurred, and may continue to incur, expenses related to the cybersecurity incident, including approximately $600,000 to date related to external cybersecurity experts. The Company believes that the impact to profit margins due to lost production for approximately two weeks in its domestic and Mexico operations and the incremental expense measures to recover from and remediate the cybersecurity incident will have a material impact on the Company's financial condition and results of operations during the fourth quarter ending June 29, 2024.


text: As previously disclosed in the Original Report, on May 6, 2024, the Company detected unauthorized third party access to portions of its information technology (“IT”) systems (the “cybersecurity incident”). Upon detection of this outside threat, the Company activated its cyber incident response procedure to investigate, contain, and remediate the incident, including engaging external cybersecurity experts to help investigate the scope and impact of the cybersecurity incident and notifying law enforcement. The cybersecurity incident caused disruptions, and limitation of access, to portions of the Company’s business applications supporting aspects of the Company’s operations and corporate functions, including financial and operating reporting systems.


text: As a precautionary measure, the Company halted domestic and Mexico operations for approximately two weeks during remediation efforts. After production was restarted, these locations returned to near capacity approximately another two weeks later. Other international operations continued production without material disruption from the cybersecurity incident. During the disruption of business, the Company continued to pay wages in accordance with statutory requirements. The Company also deployed new IT-related infrastructure and engaged cyber security experts to remediate the incident. The Company’s operations and corporate functions were restored in mid-June, and we believe that the unauthorized third party no longer has access to the Company’s IT systems.


text: Also as previously disclosed, the Company determined that the threat actor accessed and exfiltrated limited data from the Company’s environment, which includes some personally identifiable information. The Company is continuing the process of providing appropriate notifications to potentially affected parties and to regulatory agencies as required by applicable law.


text: As part of the closing process for the fourth quarter of fiscal year 2024, the Company has determined that, due to the cybersecurity incident, it incurred approximately $2.3 million of additional expenses, and was unable to fulfill approximately $15 million of revenue during the fourth quarter. Most of these orders are expected to be fulfilled in fiscal year 2025.


text: On February 21, 2024, UnitedHealth Group (the “Company”) identified a suspected nation-state associated cyber security threat actor had gained access to some of the Change Healthcare information technology systems. Immediately upon detection of this outside threat, the Company proactively isolated the impacted systems from other connecting systems in the interest of protecting our partners and patients, to contain, assess and remediate the incident.

companyName: UNITEDHEALTH GROUP INC

ticker: UNH


text: The Company is working diligently to restore those systems and resume normal operations as soon as possible, but cannot estimate the duration or extent of the disruption at this time. The Company has retained leading security experts, is working with law enforcement and notified customers, clients and certain government agencies. At this time, the Company believes the network interruption is specific to Change Healthcare systems, and all other systems across the Company are operational.


text: During the disruption, certain networks and transactional services may not be accessible. The Company is providing updates on the incident at https://status.changehealthcare.com/incidents/hqpjz25fn3n7. Please access that site for further information.


text: As of the date of this report, the Company has not determined the incident is reasonably likely to materially impact the Company’s financial condition or results of operations.


text: As an update to the Original Report, the Company identified that cybercrime threat actors had gained access to certain Change Healthcare information technology systems. Immediately upon detection of this outside threat, the Company isolated the impacted systems from other connected systems in order to protect the Company’s partners and customers. The Company promptly notified customers, law enforcement and government agencies.


text: The Company is making substantial progress in mitigating the impact to consumers and care providers of the unprecedented cyberattack on the U.S. health system and certain Change Healthcare services. The Company’s focus has been on ensuring patient access to care and medications by addressing challenges to pharmacy, medical claims and payment services targeted by the attack. The Company is working tirelessly to restore affected services and resume normal operations and along with law enforcement is investigating the extent of impacted data. The Company continues to believe the issue is specific to Change Healthcare. All other systems across the Company are operational.


text: The progress the Company is making, including interim measures and an expected timeline for restoration of key Change Healthcare systems, is described in a press release which the Company issued on March 7, 2024, a copy of which is attached to the Amendment as Exhibit 99.1.


text: As of the date of this Amendment, the Company has not determined the incident is reasonably likely to materially impact the Company’s financial condition or results of operations.


text: As an update to information concerning the Change Healthcare cyberattack contained in the Filed Reports, the Company issued a press release on April 22, 2024, regarding its ongoing data assessment and support for impacted individuals, support for providers and customers with notifications, and Change Healthcare service restoration progress. A copy of the press release is attached to the Amendment as Exhibit 99.1 and incorporated by reference herein.


text: On April 19, 2024, AT&T Inc. (“AT&T”) learned that a threat actor claimed to have unlawfully accessed and copied AT&T call logs. AT&T immediately activated its incident response process to investigate and retained external cybersecurity experts to assist. Based on its investigation, AT&T believes that threat actors unlawfully accessed an AT&T workspace on a third-party cloud platform and, between April 14 and April 25, 2024, exfiltrated files containing AT&T records of customer call and text interactions that occurred between approximately May 1 and October 31, 2022, as well as on January 2, 2023, as described below.

companyName: AT&T INC.

ticker: T


text: The data does not contain the content of calls or texts, personal information such as Social Security numbers, dates of birth, or other personally identifiable information. Current analysis indicates that the data includes, for these periods of time, records of calls and texts of nearly all of AT&T’s wireless customers and customers of mobile virtual network operators (“MVNO”) using AT&T’s wireless network. These records identify the telephone numbers with which an AT&T or MVNO wireless number interacted during these periods, including telephone numbers of AT&T wireline customers and customers of other carriers, counts of those interactions, and aggregate call duration for a day or month. For a subset of records, one or more cell site identification number(s) are also included. While the data does not include customer names, there are often ways, using publicly available online tools, to find the name associated with a specific telephone number.


text: AT&T has taken additional cybersecurity measures in response to this incident including closing off the point of unlawful access. AT&T will provide notice to its current and former impacted customers.


text: On May 9, 2024, and again on June 5, 2024, the U.S. Department of Justice determined that, under Item 1.05(c) of Form 8-K, a delay in providing public disclosure was warranted. AT&T is now timely filing this report. AT&T is working with law enforcement in its efforts to arrest those involved in the incident. Based on information available to AT&T, it understands that at least one person has been apprehended. As of the date of this filing, AT&T does not believe that the data is publicly available.


text: As of the date of this filing, this incident has not had a material impact on AT&T’s operations, and AT&T does not believe that this incident is reasonably likely to materially impact AT&T’s financial condition or results of operations.


text: Information set forth herein contains financial estimates and other forward-looking statements that are subject to risks and uncertainties, and actual results might differ materially. A discussion of factors that may affect future results is contained in AT&T’s filings with the Securities and Exchange Commission. AT&T disclaims any obligation to update and revise statements contained herein based on new information or otherwise, except as required by law.


text: SouthState Bank, N.A., (the "Company") detected what was determined to be a cybersecurity incident on February 6, 2024. Upon detection, the Company initiated its incident response and business continuity protocols and began taking measures to disrupt the unauthorized activity. As part of its process to address the incident, the Company proactively took measures to isolate parts of its network, which resulted in some disruption to the Company's business processes. The Company's operations have continued throughout this process in all material respects. The Company is conducting a thorough investigation and a cybersecurity firm has been engaged. Banking regulators and law enforcement have been notified.

companyName: SouthState Bank Corp

ticker: SSB


text: While the investigation is ongoing, as of the date of this filing, the incident has not had a material impact on the Company's operations, and the Company has not determined the incident is reasonably likely to materially impact the Company's financial conditions or results of operations.


text: On December 13, 2023, VF Corporation (“VF” or the “Company”) detected unauthorized occurrences on a portion of its information technology (IT) systems. Upon detecting the unauthorized occurrences, the Company immediately began taking steps to contain, assess and remediate the incident, including beginning an investigation with leading external cybersecurity experts, activating its incident response plan, and shutting down some systems. The threat actor disrupted the Company’s business operations by encrypting some IT systems, and stole data from the Company, including personal data. The Company is working to bring the impacted portions of its IT systems back online and implement workarounds for certain offline operations with the aim of reducing disruption to its ability to serve its retail and brand e-commerce consumers and wholesale customers. VF-operated retail stores globally are open, and consumers can purchase available merchandise, but VF is experiencing certain operational disruptions. Consumers are able to place orders on most of the brand e-commerce sites globally, however, the Company’s ability to fulfill orders is currently impacted. The Company, along with its external cybersecurity experts, continues to work diligently to respond to and mitigate the impact from the incident, and has notified and is cooperating with federal law enforcement.

companyName: V F CORP

ticker: VFC


text: As the investigation of the incident is ongoing, the full scope, nature and impact of the incident are not yet known. As of the date of this filing, the incident has had and is reasonably likely to continue to have a material impact on the Company’s business operations until recovery efforts are completed. The Company has not yet determined whether the incident is reasonably likely to materially impact the Company’s financial condition or results of operations.


text: First American Financial Corporation (the “Company”) recently identified unauthorized activity on certain of its information technology systems. Upon detection of the unauthorized activity, the Company took steps in an effort to contain, assess and remediate the incident. On December 20, 2023, the Company elected to isolate systems from the Internet.

companyName: First American Financial Corp

ticker: FAF


text: The Company is working diligently to restore those systems and resume normal operations as soon as possible, but cannot estimate the duration or extent of the disruption at this time. The Company has retained leading experts, is working with law enforcement and notified certain regulatory authorities.


text: During the disruption, the Company's primary website may be inaccessible or inoperative. The Company has created a special website for communications about the incident at the following URL: www.firstamupdate.com. Please access that site for further information.


text: The Company is also assessing the impact of the incident and whether it may have a material impact on its financial condition and results of operations, which at this point cannot be determined.


text: As disclosed in the Original Report, the Company recently identified unauthorized activity on certain of its information technology systems. Upon detection of the unauthorized activity, the Company took steps in an effort to contain, assess and remediate the incident. On December 20, 2023, the Company elected to isolate systems from the Internet. The Company has retained leading experts, worked with law enforcement and notified certain regulatory authorities.


text: As of the date of this filing, the Company believes it has contained the incident. The Company is in the process of restoring access to its systems and resuming normal business operations.


text: Though the incident is still under investigation, the Company believes the perpetrator of the activity accessed certain Company systems, exfiltrated data and encrypted data on certain non-production systems.


text: The Company continues to assess whether the incident will have a material impact on the Company’s financial condition or results of operations, which at this point cannot be determined.


text: As disclosed in the Original Report, the Company identified unauthorized activity on certain of its information technology systems. Upon detection, the Company acted to contain, assess and remediate the incident. On December 20, 2023, the Company elected to isolate systems from the Internet. The Company retained leading experts, worked with law enforcement and notified certain regulatory authorities. The Company believes it has contained the incident and has resumed business operations.


text: As a result of the incident, certain transactions that would have been consummated in the fourth quarter of 2023 were delayed and, consequently, revenue from those transactions will not be recognized until the first quarter of 2024. Certain other transactions that would have been consummated in the fourth quarter of 2023 were moved to other providers, which resulted in a loss of revenue. In addition, the Company recognizes revenue from its agents when a notice of title policy issuance is received. As a result of the incident, receipt of notices of the issuance of certain title policies have been delayed and, as a result, related revenue that would have been recognized in the fourth quarter of 2023 will not be recognized until the first quarter of 2024. In the fourth quarter of 2023 the Company also incurred one-time expenses as a result of the incident.


text: While the Company expects the incident to have a material impact on the fourth quarter of 2023 results of operations, the Company does not believe the incident will have a material impact on the Company’s overall financial condition or on its ongoing results of operations.


text: MarineMax, Inc. (the "Company") determined on March 10, 2024, that it experienced a “cybersecurity incident,” as defined in applicable Securities and Exchange Commission rules, whereby a third party gained unauthorized access to portions of its information environment. Upon detection, the Company initiated its previously determined incident response and business continuity protocols and took immediate measures to contain the incident. As part of this process, the containment measures resulted in some disruption to a portion of the Company’s business. The Company’s operations have continued throughout this matter in all material respects. The Company continues to investigate the extent of the incident, has engaged cybersecurity expertise, and has notified law enforcement authorities.

companyName: MARINEMAX INC

ticker: HZO


text: While the investigation remains ongoing, as of the date of this filing, the incident has not had a material impact on the Company’s operations, and the Company is still in the process of determining whether the incident is reasonably likely to materially impact the Company’s financial conditions or results of operations. The Company does not maintain sensitive data in the information environment impacted by the incident.


text: On or about March 14, 2024, through its information technology systems monitoring tools, Radiant Logistics, Inc. (the “Company”) detected what was determined to be the initial stages of a cybersecurity incident related to its Canadian operations. Upon detection, the Company immediately initiated its incident response and business continuity protocols and began taking measures to disrupt the unauthorized activity. As part of its process to address the incident, the Company proactively took measures to isolate its Canadian operations from the rest of its network and engaged the services of cybersecurity and forensics professionals to further assess, contain and remediate the incident. While the incident in combination with the Company’s security protocols have caused service delays for customers in Canada, systems recovery efforts are in process and the Company currently estimates those efforts to be largely complete in the coming week. The Company’s U.S. and other international operations have continued without disruption throughout this process in all material respects.

companyName: RADIANT LOGISTICS, INC

ticker: RLGT


text: While the investigation is ongoing, as of the date of this filing, the incident has not had a material impact on the Company’s overall operations, and the Company has not determined the incident is reasonably likely to materially impact the Company's financial conditions or results of operations.


text: As disclosed in the Original Report, on March 10, 2024, we determined that the Company experienced a “cybersecurity incident,” as defined in applicable SEC rules, whereby a third party gained unauthorized access to portions of our information environment (the “Incident”). Upon detection, we immediately initiated our previously determined incident response and business continuity protocols and took immediate measures to contain the Incident. As part of this process, the containment measures resulted in some disruption to a portion of the Company’s business. The Company’s operations have continued throughout this matter in all material respects, and, as of the date of this filing, the affected information environment is remediated.


text: The Company continues to investigate the extent of the Incident with the assistance of external cybersecurity experts. The Company has determined that a cybercrime organization accessed a limited portion of our information environment associated with our retail business. As of the date of this filing, our ongoing investigation has identified that this organization exfiltrated limited data from this environment that includes some customer and employee information, including personally identifiable information. The Company intends to provide appropriate notifications to potentially affected parties and to regulatory agencies as required by federal and state law. The Company also has notified law enforcement authorities.


text: The Company has incurred, and may continue to incur, certain expenses related to its response to this Incident. Further, the Company remains subject to risks and uncertainties as a result of the Incident. While the Company is continuing to evaluate the full scope and impact of the Incident, as of the date of this filing, the Incident has not had a material impact on the Company’s operations, and the Company is still in the process of determining whether the Incident is reasonably likely to materially impact the Company’s financial condition or results of operations.


text: On July 25, 2024, Meta Materials Inc. (the “Company”) became aware that its website, email system and other related information technology (IT) systems were significantly disrupted and taken offline. Upon detecting the disruption, the Company immediately began taking steps to restore, contain, and remediate the incident with internal and external cybersecurity experts, including beginning an investigation as to the cause of the disruption. On initial investigation, the Company learned that a former executive officer of the Company deliberately de-activated and cancelled the renewal of the Company’s website, which significantly impacted the Company’s IT systems, including delivery and receipt of electronic email communications from customers, investors and other stakeholders of the Company. With the assistance of outside legal counsel, the Company was able to compel the reinstatement of the website and commenced a process to ensure that IT functionality would continue uninterrupted. The website was re-activated and email systems restored on July 29, 2024, although functionality continues to be stressed and delayed as systems come back online. The Company, along with its internal and external cybersecurity experts, continue to work diligently to respond to and mitigate any impact from the incident.

companyName: META MATERIALS INC.


text: In addition, the Company continues to evaluate any unauthorized access to sensitive and confidential information of the Company and its stakeholders in connection with this incident. Other than the website being offline for a period of time and delayed communications through the Company’s IT systems, this unauthorized action by the former executive officer does not appear to have had a material impact on the protection of the Company’s intellectual property, or that there was unauthorized access to customer or stakeholder proprietary information. The Company continues to investigate any continuing security issues and IT functionality, and assess other actions the Company will take in response to this security and operational incident.


text: The Company has not yet determined whether the incident is reasonably likely to materially impact the Company’s financial condition or results of operations.


text: The information contained in this Item 7.01 of this Current Report on Form 8-K shall not be deemed “filed” for any purpose, including for the purposes of Section 18 of the Securities Exchange Act of 1934, as amended (the “Exchange Act”), or otherwise subject to the liabilities of that Section, and shall not be deemed incorporated by reference into any filing under the Securities Act of 1933, as amended (the “Securities Act”), or under the Exchange Act, regardless of any general incorporation language in such filing.

companyName: UNITED NATURAL FOODS INC

ticker: UNFI


text: As previously disclosed on its Current Report on Form 8-K filed on June 21, 2024, Sonic Automotive, Inc. (the “Company”) has experienced disruptions since June 19, 2024 in its access to certain information systems provided to the Company by CDK Global (“CDK”) due to a cybersecurity incident experienced by CDK (the “Incident”). The affected systems include the Company’s dealer management system (“DMS”), its customer relationship management system (“CRM”) and other systems that support sales, inventory and accounting functions (collectively with the DMS and the CRM, the “Affected Systems”). As of the date of this filing, access to the basic functionality of the DMS has been restored. Other Affected Systems, including the CRM and certain functions of the DMS, remain offline as the Company continues to investigate and test such systems. Additionally, some third-party applications typically accessible through the Affected Systems also remain offline. The timing of restoration of full access to all Affected Systems remains unclear.

companyName: SONIC AUTOMOTIVE INC

ticker: SAH


text: Since the onset of the Incident, the Company has closely monitored the effect of the Incident on its business, financial condition and results of operations. While the full impact of the Incident on the Company and its results of operations and financial condition are not presently ascertainable, based on the information available to the Company on the date hereof, the Company concluded that the Incident is reasonably likely to have a material impact on the Company’s results of operation for the second fiscal quarter ended June 30, 2024 due to, among other thing, a slower rate of vehicle sales during the period since June 19, 2024 due to the impact of the Incident on the Affected Systems. As a result, the Company expects that its earnings for the second fiscal quarter ended June 30, 2024 will be adversely impacted by the Incident. As of the date hereof, the Company has not yet determined whether the Incident has otherwise had or is otherwise reasonably likely to have a material impact on the Company and its financial condition.


text: As previously disclosed in the Original Form 8-K, the Company has experienced disruptions in its access to certain information systems provided to the Company by CDK Global (“CDK”) due to a cybersecurity incident experienced by CDK on June 19, 2024 (the “Incident”). As of the date of this filing, access to the Company’s information systems affected by the Incident has been restored, including its dealer management system (“DMS”) and customer relationship management system (“CRM”). However, the Company experienced operational disruptions throughout July related to the functionality of certain CDK customer lead applications, inventory management applications and related third-party application integrations with CDK.


text: The Company has concluded that the Incident had a material impact on the Company’s business during and results of operations for the second fiscal quarter ended June 30, 2024 (“Q2”). The Company’s GAAP earnings per diluted share for Q2 were $1.18, and the Company estimates that the Incident adversely affected its GAAP earnings per diluted share for Q2 by approximately $0.64 without taking into account any potential recoveries related to the Incident and after factoring in estimated lost income and expenses attributable to the Incident.


text: Based on the information available to the Company on the date hereof, the Company has concluded that the Incident is not reasonably likely to have a material impact on the Company’s financial condition or its current or future business or results of operations, except as disclosed herein.


text: As of the date of this disclosure, this incident has not had a material impact on the Company’s operations, and the Company is evaluating the impact this incident may reasonably have on its financial condition or results of operations.

companyName: F5, INC.

ticker: FFIV


text: On October 15, 2025, Jewett-Cameron Trading Co. Ltd. (the “Company”) learned that a threat actor had gained unauthorized access to portions of the Company’s information technology (“IT”) environment and claimed to have unlawfully accessed certain Company information and data. The Company immediately activated its cyber incident response process to contain the intrusion, assess and investigate the incident and implement remedial measures. The Company also immediately notified law enforcement and retained external cybersecurity experts to assist. Based on its investigation to date, the Company believes that the cybersecurity incident consisted of unauthorized access and deployment of encryption and monitoring software by a third party to a portion of the Company’s internal corporate IT systems. The incident caused disruptions and limitation of access to portions of the Company’s business applications supporting aspects of the Company’s operations and corporate functions, which the Company voluntarily took offline as a precautionary measure. Based on the information reviewed to date, the Company believes the unauthorized activity has been contained and is working diligently to bring the impacted portions of its IT systems and individual computer devices back online.

companyName: JEWETT CAMERON TRADING CO LTD

ticker: JCTC


text: Although the Company ascertained that certain information was exfiltrated, it is still investigating the extent of compromise of any sensitive information contained within the accessed IT systems. However, it is believed that the threat actors unlawfully accessed certain computer systems and exfiltrated images of video meetings and computer screens that may contain sensitive Company information. The threat actors have threatened to release this information publicly if the Company does not provide them with a monetary payment. The Company has taken additional cybersecurity measures in response to this incident including closing off the point of unlawful access and bolstering its cyber defensive capabilities. The Company believes that the costs associated with these activities will be largely covered by the Company’s cyber security insurance policy. However, due to the extended period that the Company has been and may continue to be offline, operations may be materially impacted, which may also impact the Company’s financial results for the first quarter of fiscal 2026.


text: Current analysis indicates that the data exfiltrated primarily relates to IT related information and financial information the Company has been gathering and analyzing over the past few weeks in preparation of filing with the Securities and Exchange Commission its Annual Report on Form 10-K for the fiscal year ended August 31, 2025, which the Company expects to release in mid-November.


text: As the investigation of the incident is ongoing, the full scope, nature and impact of the incident are not yet completely known. We have no current evidence that any personally identifiable information of any employees, customers, suppliers or vendors has been compromised, but our analysis and review of the potential compromised systems and data continues. The Company is bringing systems and devices online in a thoughtful and methodical manner in coordination with our cybersecurity experts and the ongoing investigation and expects to be at full operational capability shortly.


text: Information set forth herein contains financial estimates and other forward-looking statements that are subject to risks and uncertainties, and actual results might differ materially. A discussion of factors that may affect future results is contained in the Company’s filings with the Securities and Exchange Commission. The Company disclaims any obligation to update and revise statements contained herein based on new information or otherwise, except as required by law.


text: On February 21, 2024, Cencora, Inc. (the “Company”), learned that data from its information systems had been exfiltrated, some of which may contain personal information. Upon initial detection of the unauthorized activity, the Company immediately took containment steps and commenced an investigation with the assistance of law enforcement, cybersecurity experts and external counsel.

companyName: Cencora, Inc.

ticker: COR


text: As of the date of this filing, the incident has not had a material impact on the Company’s operations, and its information systems continue to be operational. The Company has not yet determined whether the incident is reasonably likely to materially impact the Company’s financial condition or results of operations.


text: In the Original Report the Company disclosed that it learned, on February 21, 2024, that data from its information systems had been exfiltrated, some of which may contain personal information. Upon initial detection of the unauthorized activity, the Company immediately took containment steps and commenced an investigation with the assistance of law enforcement, cybersecurity experts and external counsel.


text: Through that investigation, the Company learned that additional data, beyond what was initially identified, had been exfiltrated. The Company has identified and completed its review of most of the exfiltrated data (the “Data”). This review has confirmed that the Data included personally identifiable information (“PII”) and protected health information (“PHI”) of individuals, most of which is maintained by a Company subsidiary that provides patient support services.


text: For PII and PHI discovered in the Data to date, the Company has provided required notifications to potentially affected parties and individuals as well as regulatory agencies. The Company continues to review the Data and it intends to provide any additional required notifications to affected and potentially affected parties and appropriate regulatory agencies. The Company has no evidence that any of the Data has been or will be publicly disclosed.


text: The Company believes it has contained the incident, and the Company has undertaken remediation efforts, which are ongoing. As part of its remediation efforts, the Company is working with cybersecurity experts to reinforce its systems, strengthen its surveillance of cybersecurity threats and prevent unauthorized occurrences on or conducted through its IT systems.


text: The incident has not had a material impact on the Company’s operations, and its information systems have continued to be fully operational. The Company does not believe the incident is reasonably likely to materially impact the Company’s financial condition or results of operations.


text: As disclosed in the Original Report, on December 13, 2023, VF detected unauthorized occurrences on a portion of its information technology (IT) systems. Upon detecting the unauthorized occurrences, VF immediately began taking steps to contain, assess and remediate the cyber incident, including beginning an investigation with leading external cybersecurity experts, activating its incident response plan, and shutting down some systems. As a result of these and other measures, and while VF’s investigation and remediation efforts remain ongoing, VF believes the threat actor was ejected from VF’s IT systems on December 15, 2023. VF has notified, is cooperating with, and will continue to cooperate with and notify, federal law enforcement and the relevant regulatory authorities as required under applicable law.


text: As of the date of this Amendment, VF-operated retail stores, brand e-commerce sites and distribution centers are operating with minimal issues. After VF shut down some of its systems, VF experienced disruption to certain of its operations, including interrupted replenishment of retail store inventory and delayed order fulfillment which had impacts such as the cancellation by customers and consumers of some product orders, reduced demand on certain of its brands’ e-commerce sites, and delay of some wholesale shipments. Since the filing of the Original Report, while VF is still experiencing minor residual impacts from the cyber incident, VF has resumed retail store inventory replenishment and product order fulfillment, and is caught up on fulfilling orders that were delayed as a result of the cyber incident. Since the filing of the Original Report, VF has substantially restored the IT systems and data that were impacted by the cyber incident, but continues to work through minor operational impacts.


text: Based on VF’s preliminary analysis from its ongoing investigation, VF currently estimates that the threat actor stole personal data of approximately 35.5 million individual consumers. However, VF does not collect or retain in its IT systems any consumer social security numbers, bank account information or payment card information as part of its direct-to-consumer practices, and, while the investigation remains ongoing, VF has not detected any evidence to date that any consumer passwords were acquired by the threat actor.


text: While the investigation remains ongoing, as of the date of this Amendment, VF believes that the material impact or reasonably likely material impact on VF is limited to the material impacts on VF’s business operations disclosed in the Original Report which are no longer ongoing at this time. As of the date of this Amendment, VF also believes the impacts of the cyber incident are not material and are not reasonably likely to be material to its financial condition and results of operations.


text: VF will be seeking reimbursement of costs, expenses and losses stemming from the cyber incident by submitting claims to VF’s cybersecurity insurers. The timing and amount of any such reimbursements is not known at this time.


text: On January 12, 2024, Microsoft (the “Company” or “we”) detected that beginning in late November 2023, a nation-state associated threat actor had gained access to and exfiltrated information from a very small percentage of employee email accounts including members of our senior leadership team and employees in our cybersecurity, legal, and other functions, on the basis of preliminary analysis. We were able to remove the threat actor’s access to the email accounts on or about January 13, 2024. We are examining the information accessed to determine the impact of the incident. We also continue to investigate the extent of the incident. We have notified and are working with law enforcement. We are also notifying relevant regulatory authorities with respect to unauthorized access to personal information. As of the date of this filing, the incident has not had a material impact on the Company’s operations. The Company has not yet determined whether the incident is reasonably likely to materially impact the Company’s financial condition or results of operations.

companyName: MICROSOFT CORP

ticker: MSFT


text: This Form 8-K contains forward-looking statements, which are any predictions, projections or other statements about future events based on current expectations and assumptions that are subject to risks and uncertainties, which are described in our filings with the Securities and Exchange Commission. Forward-looking statements speak only as of the date they are made. Readers are cautioned not to put undue reliance on forward-looking statements, and the Company undertakes no duty to update any forward-looking statement to conform the statement to actual results or changes in the Company’s expectations.


text: On February 5, 2024, Prudential Financial, Inc. (the “Company” or “we”) detected that, beginning February 4, 2024, a threat actor had gained unauthorized access to certain of our systems. With assistance from external cybersecurity experts, we immediately activated our cybersecurity incident response process to investigate, contain, and remediate the incident. As of the date of this Report, we believe that the threat actor, who we suspect to be a cybercrime group, accessed Company administrative and user data from certain information technology systems and a small percentage of Company user accounts associated with employees and contractors.

companyName: PRUDENTIAL FINANCIAL INC

ticker: PRU


text: We continue to investigate the extent of the incident, including whether the threat actor accessed any additional information or systems, to determine the impact of the incident. On the basis of the investigation to date, we do not have any evidence that the threat actor has taken customer or client data. We have reported this matter to relevant law enforcement and are informing regulatory authorities. As of the date of this Report, the incident has not had a material impact on the Company’s operations, and the Company has not determined the incident is reasonably likely to materially impact the Company’s financial condition or results of operations.


text: As disclosed in the Original Report, on February 5, 2024, we detected that, beginning February 4, 2024, a threat actor had gained unauthorized access to certain of our systems. With assistance from external cybersecurity experts, we immediately activated our cybersecurity incident response process to investigate, contain, and remediate the incident. As of the date of this Report, we believe the threat actor is a cybercrime group, and our investigation has identified that the group accessed and exfiltrated from a platform limited data that includes some client information and personally identifiable information. The threat actor also accessed and exfiltrated Company administrative and user data from certain information technology systems and accessed a small percentage of Company user accounts associated with employees and contractors. We reported this matter to relevant law enforcement and have been informing regulatory authorities.


text: On the basis of the investigation to date, we have not found any evidence of malware, ransomware, data destruction or alteration, or that the threat actor currently has access to our systems. We continue to investigate the extent and impact of the incident, including whether the threat actor accessed any additional information or systems.


text: As of the date of this Report, the incident has not had a material impact on the Company’s operations, and the Company has not determined the incident is reasonably likely to materially impact the Company’s financial condition or results of operations.


text: As disclosed in the Original Filing, the Company detected that beginning in late November 2023, a nation-state threat actor had gained access to and exfiltrated information from a very small percentage of employee email accounts including members of our senior leadership team and employees in our cybersecurity, legal, and other functions. Since the date of the Original Filing, the Company has determined that the threat actor used and continues to use information it obtained to gain, or attempt to gain, unauthorized access to some of the Company’s source code repositories and internal systems. The threat actor’s ongoing attack is characterized by a sustained, significant commitment of the threat actor’s resources, coordination, and focus. Our active investigations of the threat actor’s activities are ongoing, findings of our investigations will continue to evolve, and further unauthorized access may occur.


text: We have increased our security investments, cross-enterprise coordination and mobilization, and have enhanced our ability to defend ourselves and secure and harden our environment against this advanced persistent threat. We continue to coordinate with federal law enforcement with respect to its ongoing investigation of the threat actor and the incident.


text: As of the date of this filing, the incident has not had a material impact on the Company’s operations. The Company has not yet determined that the incident is reasonably likely to materially impact the Company’s financial condition or results of operations.


text: This Form 8-K contains forward-looking statements, which are any predictions, projections or other statements about future events based on current expectations and assumptions that are subject to risks and uncertainties, which are described in our filings with the SEC. Forward-looking statements speak only as of the date they are made. Readers are cautioned not to put undue reliance on forward-looking statements, and the Company undertakes no duty to update any forward-looking statement to conform the statement to actual results or changes in the Company’s expectations.


text: On or about March 27, 2024, OraSure Technologies, Inc. (the “Company”) became aware of a cybersecurity incident in which an unauthorized third party gained access to Company data from certain information systems. Following detection of the incident, the Company initiated response protocols, commenced an investigation with the assistance of cybersecurity experts and external counsel, and notified law enforcement. The Company believes it has contained the incident and believes it has preserved the integrity of its core financial and operational systems.

companyName: ORASURE TECHNOLOGIES INC

ticker: OSUR


text: Although the Company ascertained that certain files were exfiltrated, it is still investigating the extent of any sensitive information contained within the accessed systems, including any personal information. It is evaluating what, if any, regulatory and legal notifications are required as a result of this incident and will make such notifications as required based on its findings.


text: As of the date hereof, the incident has not had a material impact on the Company’s operations, financial systems, or its financial condition. The Company’s information systems are operational, and it does not anticipate that this incident will have a material impact on its financial condition and results of operations moving forward. While the Company believes it has contained the incident, it continues to investigate this matter to determine the full extent of the impact on the Company.


text: On April 14, 2024, Frontier Communications Parent, Inc. (the “Company”) detected that a third party had gained unauthorized access to portions of its information technology environment. Upon detection, the Company initiated its previously established cyber incident response protocols and took measures to contain the incident. As part of this process, the containment measures, which included shutting down certain of the Company’s systems, resulted in an operational disruption that could be considered material. Based on the Company’s investigation, it has determined that the third party was likely a cybercrime group, which gained access to, among other information, personally identifiable information.

companyName: Frontier Communications Parent, Inc.


text: As of the date of this filing, the Company believes it has contained the incident and has restored its core information technology environment and is in the process of restoring normal business operations.


text: The Company continues to investigate the incident, has engaged cybersecurity experts, and has notified law enforcement authorities. The Company does not believe the incident is reasonably likely to materially impact the Company’s financial condition or results of operations.