Company: DXPE
Filing Date: 2025-03-10
Form Type: 10-K
Source: 0001020710-25-000036
Chunk: 128

Company: DXP ENTERPRISES INC
Filing Date: 2025-03-10
Form: 10-K
Item: Item 1A
Chunk 128
---
ivable, disburse funds, manage our supply chain, monitor results of operations, and process and store team member or customer data, among other functions, could be adversely affected. Any such interruption of our information systems could have a material adverse effect on our business or results of operations. We have experienced these incidents in the past, which we deemed immaterial to our business and operations individually and in the aggregate, and may be subject to other incidents in the future. We cannot assure you that any future incidents will not be material to our business, operations or financial condition.

21

Cybersecurity breaches and other disruptions or misuse of our network and information systems could affect our ability to conduct our business effectively.

Through our sales channels and electronic communications with customers generally, we collect and maintain confidential information that customers provide to us in order to purchase products or services. We also acquire and retain information about suppliers and employees in the normal course of business. Computer hackers may attempt to penetrate our information systems or our vendors' information systems and, if successful, misappropriate confidential customer, supplier, employee or other business information. In addition, one of our employees, contractors or other third party may attempt to circumvent security measures in order to obtain such information or inadvertently cause a breach involving such information. Loss of information could expose us to claims from customers, suppliers, financial institutions, regulators, payment card associations, employees and other persons, any of which could have an adverse effect on our financial condition and results of operations. We may not be able to adequately insure against cyber risks.

Despite our security measures and those of our third-party service providers, our systems may be vulnerable to interruption or damage from computer hacks, computer viruses, worms or other destructive or disruptive software, process breakdowns, denial of service attacks, malicious social engineering or other malicious activities, or any combination of the foregoing. Our computer systems have been, and will likely continue to be, subject to cyber incidents. A cyber incident is considered to be any adverse event that threatens the confidentiality, integrity or availability of our information resources. More specifically, a cyber incident is an intentional attack or an unintentional event that can include gaining unauthorized access to systems to disrupt operations, corrupt data or steal confidential information. Our three primary risks that could directly result from the occurrence of a cyber incident include operational interruption, damage to our reputation and image and private data exposure. While we have implemented controls and taken other preventative actions to further strengthen our systems against future attacks, these controls and preventative actions may not be effective against future attacks. Any