Company: IPGP
Filing Date: 2025-02-20
Form Type: 10-K
Source: 0001111928-25-000023
Chunk: 84

Company: IPG PHOTONICS CORP
Filing Date: 2025-02-20
Form: 10-K
Item: Item 1A
Chunk 84
---
 a significant failure of our various information technology systems could adversely affect our ability to complete an evaluation of our internal controls and attestation activities pursuant to Section 404 of the Sarbanes-Oxley Act of 2002 under the updated framework issued in 2013.

As part of our day-to-day business, we store our data and certain data about our customers, employees and service providers in our information technology system. While our system is designed with access security, if a third party gains unauthorized access to our data or technology, including information regarding our customers, employees and service providers, such security breach could expose us to a risk of loss of this information, loss of business, litigation and possible liability. Our security measures may be breached as a result of third-party action, including intentional misconduct by computer hackers, employee error, malfeasance or otherwise. Additionally, third parties may attempt to fraudulently induce employees or customers into disclosing sensitive information such as usernames, passwords or other information in order to gain access to our customers' data or our data, including our intellectual property and other confidential business information, employee information or our information technology systems. Because the techniques used to obtain unauthorized access, or to sabotage systems, change frequently and generally are not recognized until launched against a target, we may be unable to anticipate or detect these techniques or to implement adequate preventative measures. Any unauthorized access could negatively impact our customers' products, result in a loss of confidence by our customers, damage our reputation, disrupt our business, result in a misappropriation of our assets (including cash), lead to legal liability and negatively impact our future sales. Additionally, such actions could result in significant costs associated with loss of our intellectual property, impairment of our ability to conduct our 

19

operations, rebuilding our network and systems, prosecuting and defending litigation, responding to regulatory inquiries or actions, paying damages or taking other remedial steps.  In addition, we may incur significant costs designed to prevent or mitigate the damage related to cybersecurity incidents. For instance, we may retain additional employees or consultants, implement new policies and procedures, and install information technology to detect and prevent identity theft, data breaches, or system disruptions. We would incur any such costs with the intent that proactively preventing a cybersecurity incident ultimately helps to mitigate potential cybersecurity liability. As previously disclosed, on September 14, 2020, the Company detected a ransomware attack impacting certain of our operational and information technology systems that we do not believe had a material impact on the Company's business, operations or financial condition.

The