Henry Schein (HSIC) Risk Analysis

extended period of time. We rely on information systems ("IS") in our business to obtain, rapidly process, analyze, manage and store customer, product, supplier and employee data to, among other things: maintain and manage worldwide systems to facilitate the purchase and distribution of thousands of inventory items from numerous distribution centers;receive, process and ship orders on a timely basis;manage the accurate billing and collections for our customers;process payments to suppliers;provide products and services that maintain certain of our customers' electronic medical or dental records (including protected health information of their patients); and maintain and manage global human resources, compensation and payroll systems. There could be an adverse impact on our business, financial condition or operating results if we do not maintain an adequate information and technology infrastructure (e.g. , hardware, networks, software, people and processes) to effectively protect and support the current and future information requirements of the business. In addition to health information in our customers' electronic medical and dental records, certain of our IS stores other sensitive personal and financial information, such as health care and other information related to our employees and individuals we service, as well as other sensitive information such as credit card information from our third-party business partners, that is confidential, and in many cases subject to privacy laws. Our IS are susceptible to, among other things, natural disasters, power losses, telecommunication failures,cybersecurity threats and other criminal activity. Information security risks have significantly increased in recent years in part because of an overall increase in cyber incidents, their increased sophistication and the involvement of organized crime, hackers, terrorists and foreign state agents. In particular, the health care industry has been targeted by threat actors seeking to undermine companies' cybersecurity defensive measures. We have processes in place intended to ensure that our security measures keep pace with new and emerging risks. We regularly review,monitor and implement multiple layers of security through technology, processes and our people. We utilize security technologies designed to protect and maintain the integrity of our IS and data, and our defenses are monitored and routinely tested internally and by external parties. Despite these efforts, our facilities and systems and those of our third-party service providers have been, and may in the future be, vulnerable to privacy and security incidents, cybersecurity attacks and data breaches, acts of vandalism or theft, computer viruses and other malicious code, misplaced or lost data, programming and/or human errors, attacks or other acts undermining IS of third party business partners including our customers, or other similar events that could impact the security,reliability and availability of our systems. In addition, hardware, software or applications developed internally or procured from third parties may contain defects in design or manufacture or other problems that could unexpectedly compromise information security. As a practical matter, so long as we depend on IS to operate our business, and our business partners do the same, there can be no guaranty that such measures will successfully stop any one particular cybersecurity incident given the constantly evolving nature of the threat. We have incurred and may in the future incur substantial costs as we update our cybersecurity defense systems and our general computer controls to meet evolving challenges, and legislative or regulatory action related to cybersecurity may increase our costs to develop or implement new technology products and services. A cyberattack that bypasses or compromises our IS cybersecurity and/or general information technology ("IT")controls (including third-party systems we rely on) causing an IS security breach may lead, and has in the past led,to a disruption of our IS business systems (including third-party systems we rely on), interruption of operations (including, without limitation, receiving, verifying and processing customer orders, customer service, accounts payable, warehouse management and shipping and systems tied to internal controls over financial reporting), the loss or alteration of business, financial and other protected information, a negative impact on our financial performance, and to an adverse impact on our financial accounting and reporting controls. A cyberattack that bypasses or compromises our IS cybersecurity and/or general computer controls or those of third parties with whom we engage may also lead to claims against us by affected parties and/or governmental agencies, and involve fines and penalties, as well as substantial defense and settlement expenses. Any of these impacts may alone, or collectively, have a material impact on our business. A successful cyberattack has, and may again in the future,disrupt our business operations, adversely impact our financial accounting and reporting of results of operations,divert the attention of management, and adversely impact our results of operations. In addition, we develop products and provide services to our customers that are technology-based, and a cyberattack that bypasses the IS supporting our products or services causing a security breach and/or perceived security vulnerabilities in our products or services could also cause significant loss of business and reputational harm, and actual or perceived vulnerabilities may lead to claims against us by our customers and/or governmental agencies. In addition, certain of our practice management products and services purchased by health care providers, such as physicians and dentists, are used to store and manage patient medical or dental records, and when cloud-based approaches are used, we may be responsible for hosting those records. These customers, and in some cases, we are subject to laws and regulations which require that they protect the privacy and security of those records, and our products may be used as part of these customers' comprehensive data security programs, including in connection with their efforts to comply with applicable privacy and security laws. In addition to immaterial and unrelated prior incidents at certain of our subsidiaries, in October 2023 Henry Schein experienced a cybersecurity incident that primarily affected the operations of our North American and European dental and medical distribution businesses. Henry Schein One, our practice management software, revenue cycle management and patient relationship management solutions business was not affected, and our manufacturing businesses were mostly unaffected. The October 2023 cybersecurity incident disrupted key business operations,adversely impacted our financial results for the fourth quarter and full year 2023, diverted attention of management,and caused the Company to incur significant remediation costs. The incident had residual impact on our financial results in 2024, and we continue to review the effects of the incident on the Company's business. We have spent,and plan to expend in the future, additional resources to continue to protect against, or to address problems caused by, business interruptions and data security breaches. We also may be perceived as a more vulnerable target of the cyber hackers as a result of the October 2023 incident.

We may be unsuccessful in achieving our strategic growth objectives. Our 2022 – 2024 BOLD+1 Strategic Plan is defined under "Business, Business Strategy" above. We expect to continue to execute the BOLD+1 strategic priorities with the next evolution of our strategic plan. In particular, we are focused on continuing to grow our Henry Schein specialty brands and technology and value-added services solutions both organically and inorganically, and to drive greater efficiencies. If we are unable to effectively implement our strategic plan, we may not achieve our desired return on our investments through our growth strategies.