Company: AWK
Filing Date: 2025-02-19
Form Type: 10-K
Source: 0001410636-25-000022
Chunk: 80

Company: American Water Works Company, Inc.
Filing Date: 2025-02-19
Form: 10-K
Item: Item 1A
Chunk 80
---
 future be, targets of cyber attacks and unauthorized access to their operational or information technology systems, and any cyber incident affecting our third-party business partners could significantly disrupt our operations.

While we believe that we have appropriate security measures and safeguards to protect our operational and information technology systems, the recent cybersecurity incident that we experienced in October 2024 demonstrated that those protections alone may not prevent a cyber attack, and we cannot guarantee that such protections will be completely successful in preventing or mitigating a future cyber attack. The Company has completed its investigation into the scope, nature and impact of the cybersecurity incident and determined the incident did not have a material effect on the Company or its financial condition or results of operations; however, the Company remains subject to various risks as a result of this incident, including those related to litigation, governmental and regulatory scrutiny, including from putative class action lawsuits that have been filed in connection with the recent incident. See Item 3—Legal Proceedings—Cybersecurity Incident Class Action Lawsuits.

28

Future cybersecurity events could cause our operations to be disrupted, property to be damaged, and customer and other confidential information to be lost or stolen; we could experience substantial loss of revenues, response costs and other financial loss; we would likely suffer a loss or redirection of management time, attention and resources from our regular business operations; we may be subject to increased regulatory requirements; our ability to comply with environmental standards and to continue to provide reliable service to our customers may be impacted; we would likely experience litigation and other claims against us; and we may suffer damage to our reputation, any of which could have a negative impact on our business, financial condition, results of operations and cash flows. Applicable laws and regulations or contracts may require us to report cybersecurity events or breaches of securely maintained confidential data, which may cause us to incur costs related to legal claims or proceedings and regulatory fines or penalties. These types of events, and their resulting impacts, either to our facilities or assets, those of third parties, or the industry in general, may also cause us to incur additional security and insurance related costs. In addition, in the ordinary course of business, we collect and retain sensitive information, including personally identifiable information, about our customers and employees. In many cases, we outsource administration of certain functions to vendors that have been and will continue to be targets of cyber attacks. Any theft, loss or fraudulent use of customer, employee or proprietary data as a result of a cyber attack on us or a vendor, supplier, contractor or other third-party business partner could also