Company: EAI
Filing Date: 2025-02-18
Form Type: 10-K
Source: 0000065984-25-000012
Chunk: 820

Company: ENTERGY ARKANSAS, LLC
Filing Date: 2025-02-18
Form: 10-K
Item: Item 7
Chunk 820
---
 including ransomware and phishing attacks, business email compromises, viruses, malicious code, and data breaches, whether as a direct or indirect act against one of Entergy’s generation, transmission or distribution facilities, operations centers, infrastructure, or information technology systems used to manage, monitor, and transport power to customers and perform day-to-day business functions as well as against the systems of critical suppliers and contractors or other third parties interconnected through the grid.  Like many businesses and operators of critical infrastructure, Entergy and its subsidiaries and their third-party suppliers have in the past and, will in the future, continue to be subject to cyber attacks, cybersecurity threats and attempts to compromise and penetrate the information technology systems of Entergy and its subsidiaries and disrupt their operations.

Entergy and its subsidiaries operate in a business that requires evolving and advanced information technology systems that include sophisticated data collection, processing systems, software, network infrastructure, and other technologies that are becoming more complex and may be subject to mandatory and prescriptive reliability and security standards.  The functionality of Entergy’s technology systems depends on its own and its suppliers’ and their contractors’ technology.  Suppliers’ and their contractors’ technology systems to which Entergy is connected directly or indirectly support a variety of business processes and activities to store sensitive data, including (i) intellectual property, (ii) proprietary business information, (iii) personally identifiable information of customers, employees, and others, and (iv) data with respect to invoicing and the collection of payments, accounting, procurement, and supply-chain activities.  Any significant failure, misconfiguration, or malfunction of such information technology systems could result in loss of or inappropriate access to data or disruptions of operations.

There have been attacks and threats of attacks on energy infrastructure by cyber actors, including those associated with foreign governments.  Further, attacks may become more frequent in the future as technology becomes more prevalent and sophisticated in energy infrastructure.  An attack could affect Entergy’s or its subsidiaries’ ability to operate, including its ability to operate the information technology systems and network infrastructure on which it relies to conduct business.

311

Table of ContentsPart I Item 1A, 1B, and 1CEntergy Corporation, Utility operating companies, and System Energy

Given the fraught geopolitical landscape and rapid technological advancements of existing and emerging threats, including threats fueled by artificial intelligence, Entergy’s technology systems remain inherently vulnerable despite implementations and enhancements of the multiple layers of security and controls.  In addition, the prevalent use of smartphones, tablets, and other wireless devices, as