We rely extensively on information and operational technology systems ("IT/OT Systems"), some of which are managed, hosted, provided and/or used by third parties, including cloud-based service providers, and their vendors, in order to conduct our business. Our uses of these systems include, but are not limited to:
- communicating within our company and with other parties, including our customers and consumers;- ordering and managing materials from suppliers;- converting materials to finished products;- receiving and processing orders from, shipping products to and invoicing our customers and consumers;- marketing products to consumers;- collecting, storing, transferring and/or processing customer, consumer, employee, vendor, investor and other stakeholder information and personal data, including, but not limited to, such data from residents of states, countries and regions with important data protection laws and regulations;- processing transactions, including but not limited to employee payroll, employee and retiree benefits and payments to customers and vendors;- hosting, processing and sharing confidential and proprietary research, intellectual property, business plans and financial information;- summarizing and reporting results of operations, including financial reporting;- managing our banking and other cash liquidity systems and platforms;- complying with legal, regulatory and tax requirements;- providing data security; and - handling other processes involved in managing our business.
Although we have a broad array of information and operational security measures in place, our IT/OT Systems, including those of third-party service providers with whom we have contracted, have been, and will likely continue to be, subject to computer viruses or other malicious codes, unauthorized access attempts, phishing and other cyberattacks. Cyberattacks and other cyber incidents are occurring more frequently, are constantly evolving in nature, are becoming more sophisticated and are being made by groups, individuals and nation states with a wide range of expertise and motives. Such cyberattacks and cyber incidents can take many forms, including cyber extortion, social engineering, password theft or introduction of viruses or malware, such as ransomware. In addition, the techniques used in cyberattacks and cyber incidents continue to evolve and develop, including through the use of emerging technologies, such as artificial intelligence.
We cannot guarantee that our security efforts will prevent breaches or breakdowns of our or our third-party service providers' IT/OT Systems because the techniques used in these attacks change frequently and may be difficult to detect for periods of time. In addition, although we have policies and procedures in place to ensure that all personal information collected by us or our third-party service providers is securely maintained, data leakages due to human error or intentional or unintentional conduct have occurred and likely will continue to occur. Furthermore, we periodically upgrade our IT/OT Systems or adopt new technologies. If such an upgrade or new technology does not function as designed or does not go as planned or if an attacker identifies a vulnerability in our IT/OT Systems, then our exposure to a cyberattack or cyber incident may increase significantly.
A cyberattack or cyber incident may adversely impact our business, including our ability to ship products to customers, issue invoices and process payments or order raw and packaging materials. Although we have seen no material impact on our business operations from the cybersecurity incidents we have experienced to date, if we suffer a significant loss or disclosure of confidential business or stakeholder information as a result of a breach of our IT/OT Systems, including those of third-party service providers with whom we have contracted, or otherwise, we may suffer reputational, competitive and/or business harm, incur significant costs and be subject to government investigations, litigation, fines and/or damages, which may adversely impact our business, results of operations, cash flows and financial condition. In addition, the rapid evolution and increased adoption of emerging technologies, such as artificial intelligence, may intensify our cybersecurity risks. Further, while we currently maintain insurance coverage that, subject to its terms and conditions, is intended to address costs associated with certain aspects of cybersecurity incidents and IT/OT System failures, this insurance coverage may not, depending on the specific facts and circumstances surrounding an incident, cover all losses or all types of claims that arise from an incident, or the damage to our business, reputation or brands that may result from an incident. As the frequency and magnitude of cybersecurity incidents increase globally, we may be unable to obtain the insurance coverage that we think is appropriate or necessary to offset the risk.
While we have disaster recovery and business continuity plans in place, if our IT/OT Systems are damaged, breached or cease to function properly for any reason, including the poor performance of, failure of or cyberattack on third-party service providers, catastrophic events, power outages, cybersecurity breaches, network outages, failed upgrades or other similar events and, if the disaster recovery and business continuity plans do not effectively resolve such issues on a timely basis, we may suffer interruptions in our ability to manage or conduct business as well as reputational harm, and may be subject to governmental investigations and litigation, any of which may adversely impact our business, results of operations, cash flows and financial condition.