Company: EXEEZ
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0000895126-25-000021
Chunk: 210

Company: EXPAND ENERGY Corp
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1A
Chunk 210
---
 data, our business may be harmed.

Cybersecurity threats present a large and growing risk to our business, as the energy industry has become increasingly dependent on digital technologies to conduct day-to-day operations, including certain exploration, development and production activities. For example, we depend on sophisticated information technology (“IT”) and operational technology (“OT”) to estimate quantities of natural gas, oil and NGL reserves, process and record financial and operating data, analyze seismic and drilling information, and communicate with our customers, employees and third-party partners. In addition, many third-party providers directly or indirectly provide us products and services across an array of internal and external functions that enable us to conduct, monitor and/or protect our business, systems and data assets. In addition, in the ordinary course of business, we and our service providers collect, process, transmit, and store proprietary and confidential data, including personal information.  

We have been, and we and our customers, business partners, and counterparties may become, the subject of cyber-attacks on our and their internal IT and OT systems and through those of third parties. Any such cyber-attacks or information security breach could have a material adverse effect on our revenues and increase our operating and capital costs, as well as disrupt our business plans and negatively impact our reputation and operations. As an energy company, we expect to continue to be a target for such attacks in the future from nation-state sponsored foreign actors and other attackers. We face evolving cybersecurity risks that threaten the confidentiality, integrity 

36

and availability of our digital technologies and business data, including malicious attacks by third parties or insiders, social engineering/phishing and human error, as well as bugs, misconfigurations of hardware or software and other vulnerabilities that may exist in our or our third-party providers’ systems or technologies. Unauthorized access to our seismic data, reserves information, customer or employee data or other proprietary or commercially sensitive information could lead to data corruption, communication interruption, or other disruptions in our exploration or production operations or planned business transactions, any of which could have a material adverse impact on our results of operations. If our information technology systems cease to function properly or our cybersecurity is breached or otherwise insufficient, we could suffer disruptions to our normal operations, which may include disruptions to our drilling, completion, production and corporate functions. There can also be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and data. A cyber-attack, or the perception thereof,