Company: PBH
Filing Date: 2025-05-09
Form Type: 10-K
Source: 0001295947-25-000017
Chunk: 35

Company: Prestige Consumer Healthcare Inc.
Filing Date: 2025-05-09
Form: 10-K
Item: Item 1A
Chunk 35
---
 of our suppliers and customers have been, and likely will continue to be, subject to malware, computer viruses, computer hacking, attempted acts of data theft, phishing, other cyber-attacks and employee error or malfeasance related to information technology systems.  We do not believe that any of these attacks or events has had a material adverse impact on our business, but future attacks could result in a serious information security breach and have a material adverse impact on our business, results of operations or financial condition. 

Increased information technology security threats and more sophisticated computer crime, including advanced persistent threats, pose a potential risk to the security of the information technology systems, networks and services of the Company, its customers and business partners, as well as the confidentiality, availability and integrity of the data of the Company, its customers and business partners. As a result, the Company's information technology systems, networks or service providers could be damaged or cease to function properly or the Company could suffer a loss or disclosure of business, personal or stakeholder information, due to any number of causes, including system disruptions, catastrophic events, power outages, cyber-attacks and security breaches. To help guard against these possibilities, the Company provides quarterly employee security training and maintains a compliance program with updated security policies to help evaluate and address potential threats and attacks. The Company has also conducted regular security audits by an outside firm based on the National Institute of Standards and Technology ("NIST") standards to address any potential service interruptions or vulnerabilities. Management regularly reports to the Company’s Board on information security risks and audit results. The Company has implemented a comprehensive Cybersecurity Incident Response Plan designed to promptly identify, assess, and respond to potential cybersecurity threats and incidents.  This plan includes a structured escalation matrix that defines incident severity levels and corresponding response protocols.  In accordance with the plan, material cybersecurity matters are escalated to the Audit Committee of the Board of Directors.  Further, the Company has implemented continuity and recovery plans in the event of a disruption. However, if these plans do not provide effective protection, the Company may suffer interruptions in its ability to manage or conduct its operations, including in all of the Company’s functions described above, which may adversely affect its business and results of operations. The Company maintains security risk insurance in the event of a cybersecurity breach or incident; however, the coverage may not be sufficient to cover all losses. The Company may need to expend additional resources in the future to continue to protect against, or to address problems caused by, any business interruptions or data security breaches. 

Any breach