Company: EXEEZ
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0000895126-25-000021
Chunk: 212

Company: EXPAND ENERGY Corp
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1A
Chunk 212
---
 reconnaissance or surveillance by threat actors, which may remain undetected for an extended period notwithstanding our monitoring and detection efforts, we may be required to spend significant additional resources to modify or enhance our protective measures or to investigate and remediate any vulnerabilities to cyber-attacks of our IT and OT systems.

Any losses, costs or liabilities directly or indirectly related to cyberattacks or similar incidents may not be covered by, or may exceed the coverage limits of, any or all of our insurance policies.

We collect, process, store and use personal information and other data, and our actual or perceived failure to protect such information and data or comply with data privacy and security laws and regulations could damage our reputation and brand and harm our business and operating results.

Along with our own data and information that we collect and retain in the normal course of our business, we and our business partners collect and retain significant volumes of certain other types of data, some of which are subject to data protection laws, including information related to our past, current and prospective employees, royalty owners, and other parties. The regulatory environment surrounding the collection, use, transfer and protection of such data, both domestically and internationally, is becoming increasingly complex, constantly evolving, and is subject to frequent significant change. We and our vendors are subject to a variety of federal and state data privacy 

37

laws, rules, regulations, industry standards and other requirements governing data privacy and the unauthorized disclosure of confidential information. Complying with these jurisdictional requirements could increase the costs and complexity of compliance procedures, and any failure to comply with these laws and regulations could result in significant penalties and legal liability. For example, we are subject to various state privacy laws, such as the California Consumer Privacy Act (“CCPA”), which came into effect in January 2020, and the California Privacy Rights Act (“CPRA”), which expands upon the CCPA and came into effect in January 2023 (with a lookback period beginning January 2022). The CCPA and the CPRA, among other things, contain new disclosure obligations for businesses that collect personal information about California residents, provide such individuals expanded rights to access, delete and correct their personal information and opt-out of certain sales or transfers of personal information and provide for statutory fines and penalties for certain data security breaches or other CCPA and CPRA violations. The enactment of the CCPA has prompted a wave of similar legislative developments in other states in the United States, which creates the potential for a patchwork of overlapping but different state laws. Any failure or perceived failure by