Company: CI
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0001739940-25-000009
Chunk: 842

Company: Cigna Group
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1
Chunk 842
---
 critical data or systems through ransomware, destructive attacks or other means; and business delays, service or system disruptions, or denials of service.

As we increase the amount of PII that we store and share digitally, our exposure to unauthorized uses and disclosures and data privacy and related cybersecurity risks increases, including the risk of undetected attacks, damage, loss, or unauthorized access or acquisition or misappropriation of proprietary or personal information. The cost of attempting to protect against these risks also increases. The health care data ecosystem is complex and requires data exchange with vendors, business partners, health care professionals, the government and others. If disruptions, data disclosures, security incidents or breaches are not detected quickly, their effect could be compounded. We have dedicated significant resources to implement privacy and security technologies, processes and procedures to protect PII and provide employee awareness training around phishing, malware and other cyber risks; however, there are no assurances that such measures will be effective against all types of security incidents. 

Cybersecurity threats are rapidly evolving, and those threats and the means for obtaining access to our proprietary systems are becoming increasingly sophisticated. Cyberattacks can originate from a wide variety of sources, including terrorists, nation states, internal actors or third parties, such as external service providers, and the techniques used change frequently or are often not recognized until after they have been launched. For example, there continues to be an increase in new financial fraud schemes akin to ransomware attacks on large companies whereby a cybercriminal installs a type of malicious software, or malware, that prevents a user or enterprise from accessing computer files, systems or networks and demands payment of a ransom for their return. Those parties may also attempt to fraudulently induce employees, customers or other users of our systems to disclose or inadvertently provide access to systems in order to gain access to our data or that of our customers. In addition, while we have certain standards for all vendors that provide us services, our vendors, and in turn, their own service providers, may become subject to the same types of security breaches. Finally, our offices may be vulnerable to security incidents or security attacks, acts of vandalism or theft, misplaced or lost data, human error or similar events that could negatively affect our systems and our customers' and clients' data. 

The costs to eliminate or address security threats and vulnerabilities before or after a cyber-incident could be significant. Our remediation efforts may not be successful and could result in interruptions, delays, or cessation of service and loss of customers.

In addition, the unauthorized access to