Company: SREA
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0001032208-25-000012
Chunk: 193

Company: SEMPRA
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1
Chunk 193
---
 and our collection and retention of personal, sensitive and confidential information, represent large-scale opportunities for attacks on, vulnerabilities in or other failures of our information systems, information and energy grid and infrastructure. Our digitalization and grid modernization efforts, including the networking of operational technology assets such as substations, continue to increase the potential vulnerabilities and points of failure in our information systems. We are also at risk of attacks on, vulnerabilities in or other failures of third-party vendors’ and/or regulators’ technologies and systems, depending on the level of access these vendors and agencies have to our information and systems. Viruses, ransomware, malware and other forms of cyber-attacks targeting utility systems and other energy infrastructure are continuously increasing in sophistication, magnitude and frequency, may not be recognized until launched against a target and may further escalate during periods of heightened geopolitical tensions. Accordingly, we may be unable to anticipate these techniques or to implement adequate preventative measures, making it impossible for us to eliminate this risk.

Our businesses also face challenges related to data governance, including the need to manage and secure large volumes of electronic data with the aim to meet regulatory requirements and create a foundation for the potential use of artificial intelligence tools. SDG&E and SoCalGas are increasingly required to disclose large amounts of data (including customer personal information and energy use data) to support state energy initiatives, increasing the risks of inadvertent disclosure or unauthorized access of sensitive information. Moreover, all our businesses operating in California (and in other states and countries that have similar laws) are subject to enhanced state privacy laws, which require companies that collect information about California residents to, among other things, disclose their data collection, use and sharing practices; allow consumers to opt out of certain data sharing with third parties; and assume liability for unauthorized disclosure of certain highly sensitive personal information.

Although we make significant investments in risk management, technology resiliency and information security measures for the protection of our systems and data, these measures could be insufficient or otherwise fail, particularly against attacks involving sophisticated adversaries, including nation-state actors, or outages involving key technology vendors. The costs and operational consequences of implementing, maintaining and enhancing these measures are significant and expected to increase to address evolving cyber risks. We often rely on third-party vendors to deploy new technologies and maintain and update our systems (including providing security updates), and these third parties may not have adequate risk management, technology resiliency and information security measures with respect to their systems or may fail to timely provide and install software updates. Although we have not experienced a material breach of our information