Risks from cybersecurity and physical threats to energy infrastructure are increasing. Threat actors, including sophisticated nation-state actors and criminal groups, exploit potential vulnerabilities in the electric utility industry, grid infrastructure and other energy infrastructures. Attacks and disruptions, which could involve physical, cyber and hybrid targeting of physical and cyber assets, are increasingly sophisticated and dynamic. The increased implementation of, and reliance on, information technologies and networks to manage business operations, including the operation of technical systems, as well as AEP's use of numerous vendors and suppliers, create additional points of vulnerability that could be, and in certain instances have been, exploited by malicious threat actors. Several U.S. government agencies have warned that the energy sector and its supply chains are subject to increasing risks of physical attacks, ransomware attacks and cybersecurity threats, and that the risks may escalate during periods of heightened geopolitical tensions. In addition, the rapid evolution and increased adoption of AI technologies may intensify AEP's cybersecurity risks.
A security breach of AEP's physical assets or information systems, or those of AEP's competitors, vendors, business partners and interconnected entities (including RTOs) could materially impact AEP by, among other things, impairing the availability of electricity transmitted and distributed by AEP and/or the reliability of generation, transmission and distribution systems, damaging grid infrastructure, interrupting critical business functions, impairing the availability of vendor services and materials that AEP relies on to maintain its operations, or by leading to the theft or inappropriate release of certain types of information, including critical infrastructure information, system data and architecture, sensitive customer, vendor, or employee data, or other confidential data.
AEP has not identified any cybersecurity incidents that have materially affected or are reasonably likely to materially affect its business strategy, results of operation or financial condition.
If a material physical or cybersecurity breach or disruption were to occur, AEP's reputation could be negatively affected, customer confidence in AEP could be diminished and AEP could be subject to legal claims, regulatory exposure, loss of revenues, and increased costs, including infrastructure repairs or operations shutdown, all of which could materially affect AEP's financial condition and materially damage its business reputation. Moreover, the amount and scope of insurance maintained against losses resulting from any such security breaches or disruptions may not be sufficient to cover losses or otherwise adequately compensate for any resulting business disruptions. The continued increase in federal and state regulatory requirements related to cybersecurity and evolving threat actor-capabilities could require changes to measures currently undertaken by AEP or to its business operations and could adversely affect its financial condition.