Company: GWW
Filing Date: 2025-02-20
Form Type: 10-K
Source: 0000277135-25-000010
Chunk: 23

Company: W.W. GRAINGER, INC.
Filing Date: 2025-02-20
Form: 10-K
Item: Item 1A
Chunk 23
---
, subject to policy terms and conditions, cover certain aspects of cybersecurity risks, depending on the nature, location and extent of any event, such insurance coverage may be insufficient to cover all losses.
Grainger has experienced certain cybersecurity incidents, and in each instance, Grainger provided notifications where required by applicable law and adopted remedial measures. None of these incidents have been deemed to be material to Grainger and Grainger has neither incurred any material net expenses nor been materially penalized or subject to any material settlement amounts with respect to such incidents. However, there can be no assurance that a future breach or incident would not be material to Grainger’s operations and financial condition.
For further information regarding Grainger's cybersecurity risk management strategy and the Board's oversight role, see Part I, Item 1C: Cybersecurity of this Form 10-K.
Regulatory, Legal and Tax Risks
Grainger is subject to a complex array of laws, regulations and standards globally. Failure to comply or unforeseen developments in related contingencies such as litigation and other regulatory proceedings could adversely affect Grainger's financial condition, profitability, reputation, and cash flows.
Grainger’s business is subject to legislative, legal, and regulatory risks and conditions specific to the countries in which it operates. In addition to Grainger’s U.S. operations, which in 2024 generated approximately 82% of its consolidated net sales, Grainger operates its business principally through wholly owned subsidiaries in Canada, Mexico, and the U.K., and its majority-owned subsidiary in Japan.
The wide array of laws, regulations and standards in each jurisdiction where Grainger operates, include, but are not limited to, advertising, marketing and internet regulations (including the use of proprietary or third-party “cookies” in connection with Grainger’s eCommerce platforms), anti-bribery and corruption laws, competition and antitrust regulations, data protection (including, because Grainger accepts credit cards, the Payment Card Industry Data Security Standard), data privacy (including in the U.S., the California Consumer Privacy Act and Privacy Rights Act, in Japan, the Act on Protection of Personal Information, and in the European Union, the General Data Protection Regulation) and cybersecurity requirements (including protection of information and incident responses), environmental protection laws, currency exchange controls and cash repatriation restrictions, health and safety laws, import and export compliance (including the U.S. Commerce Department’s Export Administration Regulations, trade sanctions promulgated by the Office of Foreign Asset Control and anti-money laundering regulations), intellectual property laws, labor laws