Company: COST
Filing Date: 2025-10-08
Form Type: 10-K
Source: 0000909832-25-000101
Chunk: 31

Company: COSTCO WHOLESALE CORP /NEW
Filing Date: 2025-10-08
Form: 10-K
Item: Item 1A
Chunk 31
---
 integrity, and availability of our data. Our IT systems and networks, or those managed by third parties such as cloud providers or suppliers that otherwise host or have access to confidential information, periodically have vulnerabilities, which may go unnoticed for a period of time. Our logging capabilities, or the logging capabilities of third parties, are also not always complete or sufficiently detailed, affecting our ability to fully investigate and understand the scope of security events. While our cybersecurity and compliance efforts seek to mitigate such risks, there can be no guarantee that the actions and controls we and our third-party service providers have implemented and are implementing, will be sufficient to protect our systems, information or other property.

The potential impacts of a cybersecurity attack include reputational damage, litigation, government enforcement actions, penalties, disruption to systems and operations, unauthorized release of confidential or otherwise protected information, corruption of data, diminution in the value of our investment in IT systems and increased cybersecurity protection and remediation costs. This could adversely affect our competitiveness, results of operations and financial condition and, critically in light of our business model, loss of member confidence. Further, the insurance coverage we maintain and indemnification arrangements with third parties may be inadequate to cover claims, costs, and liabilities relating to 

11

cybersecurity incidents. In addition, data we collect, store and process is subject to a variety of U.S. and international laws and regulations (such as the European Union General Data Protection Regulation, California Consumer Privacy Act, Health Insurance Portability and Accountability Act, and China's Personal Information Protection Act), evolving rules concerning artificial intelligence, and other privacy and cybersecurity laws and restrictions on use of member information that may also impair our ability to utilize data, consistent with member consents and preferences, which may carry significant potential penalties for noncompliance.

We are subject to payment-related risks.

We accept payments using a variety of methods, including select credit and debit cards, cash and checks, co-brand cardholder rebates, Executive member 2% reward certificates, and our shop card. As we offer new payment options to our members, we may be subject to additional rules, regulations, compliance requirements, and higher fraud losses. For certain payment methods, we pay interchange and other related acceptance fees, along with additional transaction processing fees. We rely on third parties to provide payment transaction processing services for credit and debit cards and our shop card. It could disrupt our business if these parties become unwilling or unable to provide these services to us. We are also subject to fee increases by these service providers.

We must comply with