Sony, its third-party service providers, suppliers and other business partners make extensive use of information technology to support business operations, and to provide network and online services to customers. These operations and services, as well as Sony’s business information, may be intentionally or inadvertently compromised by malicious third parties, including state-sponsored organizations, criminal organizations, Sony’s officers or employees, third-party service providers or other business partners. Such organizations or individuals may use a variety and combination of techniques, such as installing malicious software, exploiting vulnerabilities in information technology, using social engineering to mislead officers, employees and business partners into disclosing passwords and sensitive information, and coordinating distributed denial-of-service attacks to render services unavailable. As cyber-attacks become increasingly sophisticated and automated, and as tools and resources become more readily available, there can be no guarantee that Sony’s actions, security measures and controls designed to prevent, detect or respond to outside intrusion, limit access to data, prevent loss, destruction, alteration, or exfiltration of business information, or limit the negative impact from such attacks can provide absolute security. In addition, Sony’s officers or employees have been working both in the office and at home following the spread of COVID-19 and this practice is expected to continue. Although Sony takes measures to ensure that appropriate information security protections are in place for the remote workforce, there can be no guarantee that Sony’s actions, security measures and controls designed to prevent, detect or respond to outside intrusion, limit access to data, prevent loss, destruction, alteration, or exfiltration of business information, or limit the negative impact from such attacks, can provide absolute security. As a result, Sony’s business information, including personally identifiable information, may be lost, destroyed, disclosed, misappropriated, altered, or accessed without consent, and Sony’s information technology systems or operations, or those of its service providers or other business partners, may be disrupted. Malicious adversaries may also use unauthorized access to Sony’s networks as a platform to compromise Sony’s third-party business partners without Sony’s knowledge. Sony has previously been the subject of sophisticated and targeted attacks. For example, network services in the G&NS segment, the internal network and IT infrastructure in the Pictures segment, and Sony’s websites have been subject to cyber-attacks, resulting in unauthorized access, denial of service, and the theft and/or disclosure of Sony’s business information, including officer and employee information, customer information, and other information, as well as the destruction of data. Any of the above incidents can result in significant remediation costs. In addition, a disruption to Sony’s network and online services, information technology, or other compromise of its information security may have serious consequences to its business and operations, including lost revenues, damage to relationships with business partners and other third parties, disclosure, alteration, destruction or use of proprietary information and the failure to retain or attract customers. Moreover, such disruptions and breaches may result in a diversion of management’s attention and resources. Further, it may result in adverse media coverage, which may harm Sony’s brand image and reputation. Sony may also be subject to legal claims or legal proceedings, including regulatory investigations and actions. Sony’s cyber insurance may not cover all expenses and losses and, accordingly, such breaches or other compromises of Sony’s information security or that of its third-party service providers or business partners may have an adverse impact on Sony’s operating results and financial condition.