Company: COST
Filing Date: 2025-10-08
Form Type: 10-K
Source: 0000909832-25-000101
Chunk: 30

Company: COSTCO WHOLESALE CORP /NEW
Filing Date: 2025-10-08
Form: 10-K
Item: Item 1A
Chunk 30
---
 our warehouses, and sell products to our members. Given the high volume of transactions we process, it is important that we build strong resiliency to lessen disruption from events such as power outages, computer and telecommunications failures, viruses, internal or external security breaches and other cybersecurity incidents, errors by employees, extreme weather, and catastrophic events. Any debilitating failure of our critical IT systems, data centers and backup systems would require significant investments in resources to restore services and may cause serious impairment in our business operations, including loss of business services, increased cost of moving merchandise and failure to provide service to our members. We are currently making substantial investments in technology and IT projects, including maintaining and enhancing our digital resiliency, and failure or delay in these projects could be costly and harmful to our business. Failure to deliver IT projects efficiently and effectively could result in the loss of our competitive position and adversely impact our financial condition and results of operations. Insufficient IT capacity could also impact our capacity for timely, complete and accurate financial and non-financial reporting required by law.

We are required to maintain the privacy and security of personal and business information amidst multiplying threat landscapes and in compliance with increasing privacy and data protection regulations globally. Failure to do so could damage our business, including our reputation with members, suppliers and employees, cause us to incur substantial additional costs, and become subject to litigation and regulatory action.

Increased security threats and more sophisticated cyber misconduct pose a risk to our systems, networks, products and services. We rely upon IT systems and networks, some of which are managed by or belong to third parties, including suppliers, partners, vendors, and service providers. Additionally, we collect, store and process sensitive information relating to our business, members, employees, and other third parties. Operating these IT systems and networks and processing and maintaining this data in a secure manner, are critical to our business operations and strategy. Remote work has also expanded possible attack surfaces. Attempts to gain unauthorized access to systems, networks and data, both ours and third parties with whom we work, are increasing in frequency and sophistication, and in some cases, these attempts are successful. Cybersecurity attacks may range from random attempts to coordinated and targeted attacks, including sophisticated computer crimes and advanced persistent threats. Phishing attacks have emerged as particularly prominent, including as vectors for ransomware attacks, which have increased in breadth and frequency. While we train our employees as part of our security efforts, that training cannot be completely effective. These threats pose a risk to the security of our systems and networks and the confidentiality,