Company: CLX
Filing Date: 2025-08-08
Form Type: 10-K
Source: 0000021076-25-000039
Chunk: 32

Company: CLOROX CO /DE/
Filing Date: 2025-08-08
Form: 10-K
Item: Item 1A
Chunk 32
---
 migration, the potential instability of the new system and cost overruns. If such systems are not successfully upgraded or replaced in a timely manner, system outages, disruptions or delays, or other issues may arise. If a new system does not function properly or is not adequately supported by third-party service providers and processes, it could adversely affect the Company’s business and operations, which, in turn, could adversely impact the Company’s results of operations and cash flows.

The IT/OT systems of the Company, its customers, business partners, suppliers, and third-party providers have been, and will continue to be, subject to cyber-threats such as computer viruses or other malicious codes, security breaches, ransomware, unauthorized access attempts, business email compromise, data encryption or exfiltration, cyber extortion, denial of service attacks, phishing, deepfakes, social engineering, unintentional or malicious actions of employees or contractors, hacking and other cyberattacks attempting to exploit vulnerabilities by hackers, criminal groups, nation-states and nation-state-sponsored organizations and social-activist organizations. The Company experienced a cyberattack in August 2023 and may continue to experience an increase in the number of such attacks, which may result in unauthorized access, disclosure and misuse of customer, employee, vendor, Company, or consumer information, including personal consumer information obtained through online and e-commerce sales, and online activities, including promotions, rebates and customer loyalty programs, as well as increased costs related to the Company’s involvement in investigations or notifications conducted by the Company’s business partners. The rapid evolution and increased adoption of emerging technologies, such as artificial intelligence, may also increase the frequency and magnitude of cyberattacks on the Company and amplify its cybersecurity risks. In addition, while the Company has purchased cybersecurity insurance, costs related to a cyberattack may exceed the amount of insurance coverage or be excluded under the terms of its cybersecurity insurance policy. The Company may be unable to obtain cybersecurity insurance in amounts and on terms the Company views as appropriate for its operations.

The security efforts of the Company and its third-party providers may not prevent or timely detect future attacks and resulting breaches or breakdowns of its databases or systems. These attacks may also be difficult to detect for periods of time and, even if detected, the nature and extent of the incident may not be immediately clear and an investigation into an incident could take a significant amount of time to complete. These factors may inhibit the Company’s ability to provide rapid, complete, and reliable information about the cybersecurity incident to customers, counterparties, and regulators, as well