Ufp Technologies (UFPT) Risk Analysis

We rely on a combination of patents, trademarks, and unpatented proprietary know-how and trade secrets to establish and protect our intellectual property rights. We enter into confidentiality agreements with suppliers, customers, employees, consultants, and potential acquisition candidates as necessary to protect our know-how, trade secrets and other proprietary information. However, these measures and our patents and trademarks may not afford complete protection of our intellectual property, and it is possible that third parties may copy or otherwise obtain and use our proprietary information and technology without authorization or otherwise infringe on our intellectual property rights. We cannot assure that our competitors will not independently develop equivalent or superior know-how, trade secrets or production methods. Significant impairment of our intellectual property rights could harm our business or our ability to compete. For example, if we are unable to maintain the proprietary nature of our technologies, our profit margins could be reduced as competitors could more easily imitate our products, possibly resulting in lower prices or lost sales for certain products. In such a case, our business, financial condition, and results of operations may be materially adversely affected.

In the ordinary course of our business, we collect and store sensitive data, including intellectual property, personal information, our proprietary business information and that of our customers, suppliers and business partners, and personally identifiable information of our customers and employees in our data centers and on our networks. The secure maintenance and transmission of this information is critical to our operations and business strategy. We rely on commercially available systems, software, tools and monitoring to provide security for processing, transmission, and storage of confidential information. Computer hackers may attempt to penetrate our computer systems and, if successful, misappropriate personal or confidential business information. In addition, an employee, contractor, or other third-party with whom we do business may attempt to circumvent our security measures in order to obtain such information and may purposefully or inadvertently cause a breach involving such information. Despite the security measures we have in place and any additional measures we may implement in the future to safeguard our systems and to mitigate potential security risks, our facilities and systems, and those of our third-party service providers, could be vulnerable to security breaches, including the Cyber Incident (as defined below) . If unauthorized parties gain access to our systems or databases, such as with the Cyber Incident, or those of third parties on which we rely, they could be able to steal, publish, delete, hold ransom or modify our private and sensitive information, including payment information, personal information, and confidential and other proprietary business information. The Company, its customers, suppliers and business partners, as well as the Company's employees, could suffer harm if valuable business data, or employee, customer and other confidential and proprietary information were corrupted, lost, accessed or misappropriated by third parties due to a cyber-attack, a security systems failure, or due to one of our third-party service providers or our employees. Any such compromise of our data security and access, public disclosure, or loss of personal or confidential business information could result in legal claims or proceedings, liability under laws that protect the privacy of personal information, regulatory penalties, disruption of our operations, damage to our reputation, loss of our customers' willingness to transact business with us, and subject us to additional costs and liabilities which could materially adversely affect our business. While we maintain insurance for cyber events, our insurance may not be sufficient to cover us against all losses that could potentially result from a breach of our systems or loss of sensitive data. Even the most well protected IT networks, systems and facilities remain potentially vulnerable because the techniques used in attempted cybersecurity attacks are continually evolving, and may not be recognized until after the attack is launched against a target or, in some instances, are designed not to be detected and, in fact, may not be detected. Any such compromise of the Company's or any of our partners' IT systems could result in unauthorized access, public disclosure, or loss of personal, sensitive, or confidential business information, could result in legal claims and proceedings, liability under applicable laws and regulatory penalties, and could disrupt the Company's operations, require significant management attention and resources to remedy any damages that result, and damage the Company's reputation and customer willingness to transact business with it, any of which could adversely affect its business.

In June 2024, we entered into a secured $275 million Third Amended and Restated Credit Agreement with Bank of America, N.A., which provided for a $150 million revolving credit facility and a $125 million term loan facility. This Credit Agreement contains covenants imposing various restrictions on our business and financial activities. These restrictions may affect our ability to operate our business and undertake certain financial activities and may limit our ability to take advantage of potential business or financial opportunities as they arise. The restrictions these covenants place on us include limitations on our ability to incur liens, incur indebtedness, make investments, dissolve or merge or consolidate with or into another entity, dispose of certain property, and make restricted payments. The Credit Agreement also requires us to meet certain financial ratios, including a minimum fixed-charge coverage ratio and a maximum total funded debt to earnings before interest, taxes, depreciation and amortization ("EBITDA") ratio. The breach of any of these covenants or restrictions could result in a default under the Credit Agreement, which could have a material adverse impact to our business, financial condition, and results of operation. We are also exposed to the risk of increasing interest rates as our revolving credit and term loan facilities are both at a variable interest rate. Any material changes in interest rates could result in higher interest expense and related payments for us.

Laws and regulations in various countries around the world with regards to cybersecurity, privacy and data protection are rapidly expanding and creating a complex compliance environment. These laws include evolving legislation with respect to the collection, storage, handling, use, disclosure, transfer, and security of personal data and the notification requirements in the event of unauthorized access to or acquisition of certain types of personal information. Implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future, and we cannot yet determine the impact that future laws, regulations, standards, or perception of their requirements may have on our business. This evolution may create uncertainty in our business, affect our ability to operate in certain jurisdictions or to collect, store, transfer, use and share personal information, necessitate the acceptance of more onerous obligations in our contracts, result in liability or impose additional costs on us. Failure to comply with these laws may affect our reputation and operating results negatively, subject us to significant liabilities, costs or expenses, and may require significant management time and attention. In some cases, these legal requirements may be either unclear in their interpretation and application or they may have inconsistent or conflicting requirements with each other. In addition, some of the privacy and data protection laws and regulations in the U.S., the EU, China and other countries place restrictions on our ability to process personal data across our business or across country borders, and could impact our business and operations. Compliance with these laws, many of which entail substantial penalties for non-compliance, or future regulations could impose even greater compliance burdens and risks on us. Furthermore, the Federal Trade Commission ("FTC") and many state Attorneys General continue to enforce federal and state consumer protection laws against companies for online collection, use, dissemination and security practices that appear to be unfair or deceptive. For example, according to the FTC, failing to take appropriate steps to keep consumers' personal information secure can constitute violations under Section 5(a) of the Federal Trade Commission Act. The FTC expects a company's data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. The EU's General Data Protection Regulation (the "GDPR"), the CCPA, and the data protection and security laws of other states and countries impose additional requirements with respect to disclosure and deletion of personal information of their residents, imposing penalties for violations and, in some cases, private right of action for data breaches. These laws, and similar legislation that is developing or has been recently enacted, impose transparency and other obligations with respect to personal data of their respective residents and provide residents with similar rights for certain types of data breaches. We have invested, and continue to invest, human and technology resources in our data compliance efforts that may be time-intensive and costly. Despite our efforts, there is a risk that we may be subject to fines and penalties for non-compliance and experience litigation, reputational harm and business interruption if we fail to protect the privacy of third-party data or to comply with the GDPR, CCPA, and other applicable data privacy and protection regimes.

We primarily use electricity and natural gas at our manufacturing facilities to operate our equipment. Over the past several years, prices for electricity and natural gas have fluctuated significantly. An outbreak or escalation of hostilities between the United States and any foreign power, or between foreign powers, or a natural disaster, could result in a real or perceived shortage of petroleum and/or natural gas, which could result in an increase in the cost of electricity or energy generally as well as an increase in the cost of our raw materials, of which many are petroleum-based. In addition, increased energy costs negatively impact our freight costs due to higher fuel prices. Future limitations on the availability or consumption of petroleum products and/or an increase in energy costs, particularly electricity for plant operations, could have a material adverse effect upon our business, financial condition, and results of operations.

Our operating results could fluctuate from quarter to quarter, making forecasting future performance difficult and resulting in volatility in our stock price. These fluctuations are due to a variety of factors, including the following: - timing of orders placed by our customers;- our customers' approach to inventory management;- changes in the mix of our revenue represented by our various products and customers could result in reductions in our profits if the mix of our revenue represented by lower margin products increases;- a portion of our costs are fixed in nature, which results in our operations being particularly sensitive to fluctuations in production volumes;- increased costs and decreased availability of raw materials or supplies; and - our ability to effectively execute on operational initiatives to drive manufacturing efficiencies.

We face intense competition in all markets and in each area of our business, in some cases from our own customers bringing programs in-house. Our current competitors may increase their participation in, or new competitors may enter into, the markets in which we compete. In addition, our suppliers may acquire or develop the capability and desire to compete with us. If our suppliers choose to expand their own operations, through acquisitions or otherwise, and begin manufacturing and selling products directly to our customers, it could reduce our pricing or sales volume and overall profitability. If we are unable to compete successfully with new or existing competitors, it could have a material adverse effect on our business, financial condition, and results of operations. Further, technological innovation by any of our existing competitors, including our customers, or new competitors entering any of the markets in which we do business, could put us at a competitive disadvantage and could cause us to lose market share. Increased competition for the sales of our products could result in price reductions, reduced margins, and loss of market share, which could materially affect our prospects, business, financial condition and results of operations.

Our customer contracts, particularly with respect to contracts for which the US government is a direct or indirect customer, may include unique and specialized requirements. This may also include contracts with customers that manufacture goods subject to FDA regulations. Failure to comply with the specific provisions in our customer contracts, or any violation of government or FDA contracting regulations, could result in termination of the contracts, increased costs to us, suspension of payments, imposition of fines, and suspension from future government contracting. Further, any negative publicity related to our failure to comply with the provisions in our customer contracts could have a material adverse effect on our business, financial condition, or results of operations.