Company: AXS-PE
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001214816-25-000056
Chunk: 247

Company: AXIS CAPITAL HOLDINGS LTD
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1A
Chunk 247
---
 power outage, or a failure of one or more of our outsourcers' information technology, telecommunications or other systems and networks could significantly impair our ability to perform such functions on a timely basis. If sustained or repeated, such a business interruption, system failure or service denial could result in a deterioration of our ability to write and process business, provide customer service, pay claims in a timely manner or perform other necessary business functions. Our robust business continuity plan, which addresses the risk of such business interruption, system or network failure or service denial, with input from both internal and external stakeholders, may be inadequate and our systems and networks may still be impacted. Unauthorized access to our systems and networks, computer viruses, deceptive communications (such as phishing attacks), malware, hackers and other cybersecurity threats and external hazards, including catastrophe events, could expose us to data loss, damages, interruptions or delays in our business, remediation costs, claims, and damage to our reputation.

Any of these eventualities could result in a material and adverse effect on our business, results of operations and financial condition.

42

Like other global companies, we are regularly the target of attempted cyberattacks and other data security threats and must continuously monitor and develop our information technology systems, networks and infrastructure to prevent, detect, address and mitigate the risk of threats to our data, systems, and networks. These cyberattacks and other data security incidents have included, or may in the future include: viruses, malware or other malicious code, ransomware, software bugs, deceptive social engineering campaigns (also known as "phishing" or "spoofing"), credential stuffing, account takeovers, loss or theft of assets, employee errors or malfeasance, third-party errors or malfeasance, as well as system and network failures and other similar security events, which could result in the loss of, unauthorized access to or disclosure of, or the misuse or misappropriation of, confidential, personal, proprietary or other information. 

Over time, and particularly recently, the sophistication and frequency of these threats continues to increase, and may be difficult to detect for long periods of time. For example, cyberattacks may be conducted by organized groups and individuals with a wide range of motives and expertise, including organized criminal groups, “hacktivists,” terrorists, nation states, nation-state supported actors and others While administrative and technical controls, along with other preventive actions, may reduce the risk of cyberattacks and other data security incidents and protect our information technology, they may be insufficient to thwart cyberattacks and/or prevent