Company: PCG-PB
Filing Date: 2025-02-13
Form Type: 10-K
Source: 0001004980-25-000010
Chunk: 265

Company: PG&E Corp
Filing Date: 2025-02-13
Form: 10-K
Item: Item 1A
Chunk 265
---
’s assets or operations or those of third parties.

The Utility also relies on complex information technology systems that allow it to create, collect, use, disclose, store, and otherwise process sensitive information, including the Utility’s financial information, customer energy usage and billing information, and personal information regarding customers, employees and their dependents, contractors, and other individuals, and portions of such sensitive information may be required to be encrypted by the Utility.  In addition, the Utility is increasingly being required to disclose large amounts of data (including customer energy usage and personal information regarding customers) to support changes to California’s electricity market related to grid modernization and customer choice.  The Utility often relies on third-party vendors to host, maintain, modify, and update its systems (including providing security updates), and to provide other services to the Utility or the Utility’s customers.  These third-party vendors could cease to exist, fail to adopt and implement adequate processes to protect the Utility’s systems and information, fail to provide timely software updates (and even if timely provided, there could be a delay in the installation of the updates), fail to detect security vulnerabilities, or experience security incidents or inadequate security measures.  Any such incidents or disruptions in the Utility’s information technology systems could impact the Utility’s ability to track or collect revenues and to maintain effective internal controls over financial reporting.

PG&E Corporation and the Utility face various cybersecurity threats, including attempts to gain unauthorized access to their systems and networks, denial-of-service attacks, threats to their information technology infrastructure, ransomware and phishing attacks, and attempts to gain unauthorized access to confidential or sensitive information about the Utility, customers and employees.  These threats come from a variety of highly organized actors, including nation-state actors.  PG&E Corporation, the Utility and their third-party vendors have been subject to, and will likely continue to be subject to, threats, breaches and attempts to gain unauthorized access to the Utility’s information technology systems or confidential or sensitive data (including information about customers and employees), or to disrupt the Utility’s operations.  Additionally, artificial intelligence, including generative artificial intelligence, may be used to facilitate or perpetrate these cybersecurity threats, and PG&E Corporation’s and the Utility’s use of generative artificial intelligence (and use by their vendors and agents) may subject them to data privacy, legal, and security risks.  The Utility may not be able to prevent unauthorized access to its operational networks, information technology systems or data, or the disruption of its operations.  Such events could subject the Utility to significant expenses,