Company: GWW
Filing Date: 2025-02-20
Form Type: 10-K
Source: 0000277135-25-000010
Chunk: 22

Company: W.W. GRAINGER, INC.
Filing Date: 2025-02-20
Form: 10-K
Item: Item 1A
Chunk 22
---
 also include team member failures, fraud, phishing or other social engineering attempts or other methods to cause confidential information, payments, account access or access credentials, or other data to be transmitted to an unintended recipient. Cybersecurity threat actors also may attempt to exploit vulnerabilities in software that is commonly used by companies in cloud-based services and bundled software. If successful, those attempting to penetrate Grainger’s or its third-party business partners’ information systems may misappropriate intellectual property or personally identifiable, credit card, confidential, proprietary or other sensitive customer, supplier, team member or business information, or cause systems disruption. Further, cybersecurity threats or cybersecurity incidents that impact Grainger’s systems, or those of its third-party business partners, could have a material adverse effect on Grainger, including its business strategy, financial condition and results of operations, including major disruptions to business operations, alteration or corruption of data or systems, costs related to remediation or the payment of ransom, and litigation including individual claims or consumer class actions, commercial litigation, administrative, and civil or criminal investigations or actions, regulatory intervention and sanctions or fines, investigation and remediation costs and possible prolonged negative publicity. While many of Grainger's agreements with these third parties include indemnification provisions, Grainger may not be able to recover sufficiently, or at all, under such provisions to adequately offset any losses it may incur.
In addition, a Grainger team member, contractor or other third party with whom Grainger does business may attempt to circumvent security measures or otherwise access Grainger’s information. Grainger’s systems are integrated with customer systems and a breach of Grainger's systems could be used as an attempt to gain illicit access to customer systems and information. There can be no assurance that any future incidents will not be material to Grainger's business, operations or financial condition. 
Techniques used to obtain unauthorized access or to sabotage systems change frequently and may not be recognized until they are launched against a target. Grainger may be unable to anticipate these techniques or implement preventative measures. Further, security measures and efforts may not be effective in each instance and may be subject to human error or failures. Any breach of Grainger’s security measures or any breach, error or 
 19

malfeasance by its third-party business partners could cause Grainger to incur significant costs to protect any customers, suppliers, team members and other parties whose information is compromised. Such a breach could also cause Grainger to make changes to its information systems and administrative processes to address security issues. Although Grainger maintains insurance coverage that may