Company: EXEEZ
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0000895126-25-000021
Chunk: 211

Company: EXPAND ENERGY Corp
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1A
Chunk 211
---
 involving our information systems and related infrastructure, or that of our business associates or third-party providers, could result in supply chain disruptions that delay or prevent the transportation and marketing of our production, non-compliance leading to regulatory fines or penalties, loss or disclosure of, damage to, our or any of our customer’s or supplier’s data or confidential information that could harm our business by damaging our reputation, subjecting us to potential financial or legal liability and requiring us to incur significant costs, including expensive and time-consuming costs to repair or restore our systems and data or to take other remedial steps, disproportionate attention of management, or damage to our reputation. Additionally, rapidly evolving laws and regulations governing cybersecurity pose increasingly complex compliance obligations and technical challenges, and failure to comply with these obligations, including incident notification requirements, could result in legal claims or proceedings (such as class actions), regulatory investigations and enforcement actions, fines and penalties and negative reputational impacts that could cause us to lose existing or future customers.

In the event of a cyber-attack, we may be required by federal and state laws or regulations to provide notification to regulators or individuals. For example, the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) was signed into law on March 15, 2022. CIRCIA mandates that all owners and operators of critical infrastructure report cyber incidents to the U.S. Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) within 72 hours and ransomware payments within 24 hours. These new requirements will become effective once CISA promulgates rules pursuant to the CIRCIA. CISA issued a notice of proposed rulemaking on April 4, 2024 and is required to issue a final rule within 18 months of issuing the proposed rule. 

Both the frequency and magnitude of cyberattacks is expected to increase as attackers are becoming more sophisticated. As a result, we may be unable to anticipate, detect, prevent, investigate or contain future attacks, particularly as the methodologies utilized by attackers change frequently or are not recognized until launched, and we may be unable to investigate or remediate incidents because attackers are increasingly using techniques and tools designed to circumvent controls, to avoid detection and to remove or obfuscate forensic evidence. Further, global remote working dynamics for our customers, employees and third-party providers present additional risk that threat actors may seek to engage in social engineering (for example, phishing) and to exploit vulnerabilities in corporate and non-corporate networks. As cyber-attacks continue to evolve, including the prevalence of