NNN uses information technology and other computer resources to carry out important operational activities and to maintain its business records. This includes the use of third-party software, technologies, tools and a broad array of services and functions. As part of NNN's normal business activities, NNN (i) maintains operational and financial information related to NNN's business, (ii) collects, processes, stores and transmits certain personal identifying and confidential information relating to its tenants, associates and vendors, within NNN's systems and utilizing those of third-party providers, and (iii) allows associates to perform some or all of their business activities remotely.
NNN faces risks associated with security breaches through cyber-attacks or cyber-intrusions, malware, computer viruses and malicious codes, ransomware, attachments to e-mail, unauthorized access attempts, denial of service attacks, phishing, social engineering, persons with access to systems inside NNN's organization, and other significant disruptions of NNN's information technology networks and related systems. The risk of a security breach has generally increased as the frequency, intensity and sophistication of attempted attacks and intrusions from around the world have increased. Even the most well protected information, networks, systems and facilities remain potentially vulnerable because the techniques, tools and tactics used in such attempted security breaches evolve and generally are not recognized until launched against a target, and in some cases are designed to not be detected and, in fact, may not be detected. Accordingly, NNN may be unable to anticipate these techniques or to implement adequate security barriers, disaster recovery or other preventative or corrective measures, and thus it is impossible for NNN to entirely counteract this risk or fully mitigate the harms after such an attack.
NNN has implemented systems and processes intended to address ongoing and evolving cybersecurity risks, secure its information technology, applications and computer systems, and prevent unauthorized access to or loss of sensitive, confidential and personal data. Although NNN and its service providers employ what NNN believes are adequate security, disaster recovery and other preventative and corrective measures, NNN's security measures, taken as a whole, may not be sufficient for all possible situations and may be vulnerable to, among other things, fraud, hacking, associate error, system error, vendors' use of generative artificial intelligence technologies, and faulty password management.
NNN's ability to conduct its business may be impaired if its information technology networks, systems or resources, including its websites or e-mail systems, are compromised, degraded, damaged or fail, whether due to a virus or other harmful circumstance, fraud, intentional penetration or disruption of its information technology resources by:
- a third party,- natural disaster,- a failure of hardware or software due to a design or programmatic flaw,- a failure of hardware or software security controls,- telecommunications system failure,- service provider error or failure,- fraudulent transactions,- intentional or unintentional personnel actions,- lost connectivity to NNN's networked resources, or - a failure of disaster recovery system.
A significant and extended disruption or other material cyber incident could damage NNN's business or reputation and cause:
- loss of revenues or tenant relationships,- unintended and/or unauthorized public disclosure or the misappropriation of proprietary, personal identifying and confidential information, and - NNN to incur significant expenses to address and remediate or otherwise resolve these kinds of issues.
The release of confidential information may also lead to litigation or other proceedings against NNN by affected individuals, business partners and/or regulators, and the outcome of such proceedings, which could include losses, penalties, fines, injunctions, expenses and charges recorded against NNN's earnings and cause NNN reputational harm, could have a material and adverse effect on NNN's business, financial position or results of operations.
In addition, the costs of maintaining adequate protection against data security threats, based on considerations of their evolution, increasing sophistication, pervasiveness and frequency and/or government-mandated standards or obligations regarding protective efforts, could be material to NNN's financial position, results of operations, cash flows, and the market price of NNN's common stock in a particular period or over various periods.