Company: AWK
Filing Date: 2025-02-19
Form Type: 10-K
Source: 0001410636-25-000022
Chunk: 81

Company: American Water Works Company, Inc.
Filing Date: 2025-02-19
Form: 10-K
Item: Item 1A
Chunk 81
---
 subject us to significant litigation, liability and costs, as well as adversely impact our reputation with customers and regulators, among others.

We have obtained insurance to provide coverage for a portion of the losses and damages that may result from a physical attack, cyber attack or a security breach, but such insurance is subject to a number of exclusions and may not cover the total loss or damage caused by an attack or a breach. We have incurred, and may continue to incur, certain expenses related to the October 2024 cybersecurity incident, and we maintain a cybersecurity insurance policy as part of our overall insurance program. However, adequate insurance may not be available at rates that we believe are reasonable, and the costs of responding to and recovering from a physical attack, cyber attack or security breach incident may not, in whole or in part, be covered by insurance or recoverable in rates. See Item 1A—Risk Factors Risks Related to our Industry and Business Operations—We may sustain losses that exceed or are excluded from our insurance coverage or for which we are self-insured, below for more information.

Our business is subject to complex and evolving federal, state and local laws and regulations regarding consumer privacy and the protection or transfer of data relating to individuals, which could result in, among other things, public disclosure of incidents, private or governmental claims or litigation against us, changes to our business practices, monetary penalties, reputational harm and increased cost of operations.

Laws and regulations are changing and increasing rapidly with respect to data and consumer privacy, security and protection. We are subject to an increasing number of complex and continually evolving data and consumer privacy, security and protection laws and regulations administered by various federal, state and local governments, including, for example, the California Privacy Rights Act, together with its amendments and implementing regulations, the Virginia Consumer Data Protection Act and the Cyber Incident Reporting for Critical Infrastructure Act of 2022. New laws and regulations may require us to disclose incidents to authorities, regulators and/or the public, when we otherwise may not have been required to disclose such incidents under previous laws and regulations, and such disclosures could negatively and materially impact our reputation, customers, employees, suppliers and other third parties. Federal and state governments have also adopted or are proposing other limitations on, or requirements regarding, the collection, distribution, use, security and storage of personally identifiable information. In addition, the Federal Trade Commission and state attorneys general are applying federal and state consumer protection laws to impose standards on the collection, use and dissemination of data. Moreover, we expect that current