Company: ACCO
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0000950170-25-024931
Chunk: 113

Company: ACCO BRANDS Corp
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1A
Chunk 113
---
 or at all, and in advance of it impacting the Company, and any such impact could be material. Further, our costs to maintain and upgrade our security systems could increase significantly as cybersecurity threats increase.

Despite our efforts to secure and monitor our information technology systems, the possibility of intrusion, tampering, and theft cannot be eliminated entirely. We have from time to time experienced cybersecurity breaches, such as "phishing" attacks, business email compromises, employee or insider error, brute force attacks, unauthorized parties gaining access to our information technology systems, and similar incidents. To date, these incidents have not had a material impact on our business, but there can be no assurance that future incidents will not cause material impacts. The techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently and often are not recognized until launched against a target. Additionally, there can be no assurance that the actions we and our outsourced providers take will prevent a breach of, or attack on the information technology systems that support the day-to-day operation of our business or house our confidential, proprietary and personally identifiable information.

Any such intrusion, tampering or theft (and any resulting disclosure or use of confidential, proprietary or personally identifiable information) could compromise our network, the network or data center of a third-party hosting key operating systems or data, or to whom we have disclosed confidential, proprietary or personally identifiable information or a third-party cloud service provider. Any of these impacts could result in a disruption to our information technology infrastructure, interruption of our business operations, violation of applicable privacy and other laws or standards, a deficiency in our internal control over financial reporting, significant legal and financial exposure beyond the scope or limits of any insurance coverage (including legal claims and proceedings and regulatory enforcement actions and penalties), increased operating costs associated with remediation activities and a loss of confidence in our security measures, all of which could harm our reputation with our customers, end-users, employees and other stakeholders and materially adversely affect our business and results of operations. Contractual provisions with third parties, including cloud service providers, may limit our ability to recover these losses.

14

In the event a significant cybersecurity event is detected, we maintain disclosure controls and procedures that are designed to enable us to promptly analyze the impact on our business, respond expediently, appropriately and effectively and repair any damage caused by such incident, as well as consider whether such incident should be disclosed publicly. The Company also employs technology designed to detect potential incidents of intrusion, tampering and theft before they impact the Company, and we continue