Company: ADP
Filing Date: 2025-08-06
Form Type: 10-K
Source: 0000008670-25-000037
Chunk: 27

Company: AUTOMATIC DATA PROCESSING INC
Filing Date: 2025-08-06
Form: 10-K
Item: Item 1A
Chunk 27
---
, and other methods of deceit, including using stolen identities to obtain employment with us or our authorized third parties as well as phishing and other social engineering techniques whereby attackers use end-user behaviors to distribute computer viruses and malware into our systems, our authorized third parties’ systems or otherwise compromise the confidentiality, integrity or availability of data or our systems. As these threats continue to evolve and increase (including due to the use of AI), we continue to invest significant resources, and may be required to invest significant additional resources, to modify and enhance our cybersecurity controls and to investigate and remediate any security vulnerabilities. In addition, as we become increasingly interconnected with our authorized third parties, the security risk of our networks and the larger ecosystem in which we operate is heightened. While our operating environments are designed to safeguard and protect confidential personal and business information, we do not have the ability to monitor the systems, personnel or physical facilities of, or the implementation or effectiveness of any safeguards by, our clients or our authorized third parties and, in any event, unauthorized parties have circumvented in the past, and may in the future be able to circumvent, those security measures. Information or system access obtained by unauthorized parties (which could include our personnel) resulting from successful attacks against our clients or our authorized third parties may, in turn, be used to attack and compromise our information technology systems, or result in production downtimes and operational disruptions that could have a material adverse effect on our business, results of operations or financial condition. Further, while we perform due diligence prior to acquisitions and take actions to safeguard the businesses that we acquire, these businesses may not have invested as significantly as we do in security and technology and may be more susceptible to 

19

cybersecurity incidents, which may make us more vulnerable to cybersecurity incidents as well.We have been, and expect we will continue to be, the subject of cybersecurity attacks, including unauthorized intrusion, malicious software infiltration, network disruption, denial of service, corruption of data, ransomware attack, insider threats, and theft of sensitive information (including our intellectual property). Although none of the cybersecurity incidents that we have identified to date have materially affected us, including our business strategy, operations, results of operations, or financial condition, we continue to face significant known and unknown cybersecurity threats. In the future, a cybersecurity attack, unauthorized intrusion, malicious software infiltration, network disruption, denial of service, corruption of data, ransomware attack, theft of non-public or other sensitive information, or similar act by an unauthorized party (which could include our personnel) with