Company: VIST
Filing Date: 2025-04-09
Form Type: 20-F
Source: 0001193125-25-076856
Chunk: 23

Company: Vista Energy, S.A.B. de C.V.
Filing Date: 2025-04-09
Form: 20-F
Item: Item 3
Chunk 23
---
 areas of the Vaca Muerta occupied by indigenous communities. However, self-identification by indigenous communities in the region has historically been fluid, and this circumstance may change over time. In such cases, the Company may be required to enhance its engagement with indigenous communities and develop a dedicated engagement policy in accordance with Argentine law on prior consultation and International Labour Organization ( ILO) Convention No. 169 on Indigenous and Tribal Peoples. Failure to adequately address these matters could expose us to additional regulatory, legal or reputational risks.

Our industry has become increasingly dependent on digital technologies to carry out daily operations and is subject to increasing cybersecurity threats.

As dependence on digital technologies has increased, cyber incidents, including deliberate attacks or unintentional events have also increased worldwide. Even if we have implemented, and continue to implement, a cybersecurity plan (See “ Item 16K - Cybersecurity”), the technologies, systems, and networks that we have implemented, or may implement in the future, and those of our service providers, may be the object of cyberattacks or failures to the security of information systems, which could lead to interruptions in critical industrial systems, the unauthorized disclosure of confidential or protected information, data corruption, other interruptions of, or disruptions to, our operations. In addition, certain cyber incidents, such as the advanced persistent threat, may not be detected for

Table of Contents

a prolonged period of time. Although we have adopted a Cybersecurity Policy that serves as an umbrella for our cybersecurity risk management standards and procedures to safeguard information and protect our systems, we cannot assure you that cyber incidents will not happen in the future and that our operations and/or our financial performance will not be affected.

Information security risks have generally increased in recent years as a result of the proliferation of new technologies and the increased sophistication and activities of cyber-attacks. We depend on digital technology, including information systems to process financial and operating data, analyze seismic and drilling information and oil and gas reserves estimates. We have increasingly connected equipment and systems to the Internet. Because of the critical nature of their infrastructure and the increased accessibility enabled through connection to the Internet, they may face a heightened risk of cyber-attack. In the event of such an attack, they could have our oilfield operations disrupted, property damaged, and customer information stolen, experience substantial loss of revenues, response costs and other financial loss; and be subject to increased litigation and damage to their reputation. A cyber-attack could adversely affect our business, results of operations and financial condition. See “ Item 16K - Cybersecurity.”

Risks