Company: UIS
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0000746838-25-000008
Chunk: 47

Company: UNISYS CORP
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1A
Chunk 47
---

We have experienced, and will continue to experience, cybersecurity attacks and other security incidents and breaches that have and, in the future, could result in access to, or in some instances, loss or disclosure of, sensitive information that would require significant human and financial resources to respond. These include cybersecurity attacks from computer hackers, cyber criminals, including nation states and nation state-sponsored actors, insiders and other malicious internet-based adversaries. The sophistication and occurrence of cybersecurity attacks and other security breaches continue to increase globally, and our systems, including the systems of our outsourced service providers, have been and may in the future be targeted by attacks such as infiltration of “fake employees” enabling laptop farming schemes, Internet of Things, cybersecurity attacks, denial of service attacks, wireless network attacks, viruses and worms, malicious software, ransomware, malware, misconfigurations, software supply chain attacks, application centric attacks, peer-to-peer attacks, phishing, vishing and smishing attempts, backdoor trojans, distributed denial of service attacks, social engineering, including deepfake attacks, business email compromises and cybersecurity-extortion, among other cybersecurity threats. As a known provider of IT solutions, we are and will remain an attractive target for such attacks. Furthermore, our industry subjects us to elevated risk and, accordingly, security vulnerabilities can occur and will continue to occur across a broad range of hardware, software or other infrastructure, increasing for us the potential of occurrence and the cost of response and remediation. These attacks have been successful against us and those of our third-party service providers and have resulted in, and in the future could result in, misappropriation, misuse, alteration, theft, loss, corruption, leakage, falsification, and accidental or premature release or improper disclosure of confidential or other information, including intellectual property, personal information, and data of the company, third parties, employees, clients or others. For example, in 2022, the company disclosed a cybersecurity attack involving our software lab environment, which caused no service disruptions for our operations or, to our knowledge, to our clients, but resulted in the exfiltration of source code for our cybersecurity and product and platform software. The techniques used by computer hackers and cyber criminals to obtain unauthorized access to data or to sabotage computer systems change frequently and are growing in sophistication, which increases the risk and severity when they occur. Additionally, limitations in the ability of our IT teams to remain up-to-date with the volume of common vulnerabilities and exposures that require constant patching that often compete with the availability of service to