Company: DTK
Filing Date: 2025-02-13
Form Type: 10-K
Source: 0000936340-25-000065
Chunk: 94

Company: DTE ENERGY CO
Filing Date: 2025-02-13
Form: 10-K
Item: Item 1A
Chunk 94
---
ants' operations, and could harm the Registrants' operating results.

Information security risks have increased in recent years as a result of the proliferation of new technologies and the increased sophistication and frequency of cyberattacks, and data security breaches.  The Registrants' industry requires the continued operation of sophisticated information and control technology systems and network infrastructure.  All of the Registrants' technology systems are vulnerable to disability or failures due to cyber incidents, physical security threats, acts of war or terrorism, and other causes, as well as loss of operational control of the Registrants' electric generation and distribution assets and, DTE Energy's gas distribution assets.  The Registrants have experienced, and expect to continue to be subject to, cybersecurity threats and incidents.  If the Registrants' information technology systems were to fail and they were unable to recover in a timely way, the Registrants may be unable to fulfill critical business functions, which could have a material adverse effect on the Registrants' business, operating results, and financial condition.

Suppliers, vendors, contractors, and information technology providers have access to systems that support the Registrants’ operations and maintain customer and employee data.  A breach of these third-party systems could adversely affect the business as if it was a breach of our own system.  Also, because the Registrants’ generation and distribution systems are part of an interconnected system, a disruption caused by a cyber incident at another utility, electric generator, system operator, or commodity supplier could also adversely affect the Registrants’ businesses, operating results, and financial condition.

In addition, the Registrants' generation plants and electrical distribution facilities may be targets of physical security threats or terrorist activities that could disrupt the Registrants' ability to produce or distribute some portion of their products.  The Registrants have increased security as a result of past events and may be required by regulators or by the future threat environment to make investments in security that the Registrants cannot currently predict.

Failure to maintain the security of personally identifiable information could adversely affect the Registrants.  In connection with the Registrants' businesses, they collect and retain personally identifiable information of their customers, shareholders, and employees.  Customers, shareholders, and employees expect that the Registrants will adequately protect their personal information.  The regulatory environment surrounding information security and privacy is increasingly demanding.  A significant theft, loss, or fraudulent use of customer, shareholder, employee, or Registrant data by cybercrime or otherwise, could adversely impact the Registrants' reputation, and could result in significant costs,