Company: NGVC
Filing Date: 2025-12-11
Form Type: 10-K
Source: 0001437749-25-037556
Chunk: 18

Company: Natural Grocers by Vitamin Cottage, Inc.
Filing Date: 2025-12-11
Form: 10-K
Item: Item 1A
Chunk 18
---
 internal and external security breaches, denial of service attacks and other disruptive problems caused by hackers. If we were to experience difficulties maintaining or operating existing systems or implementing new systems, or were subject to a significant security breach or attack, we could incur significant losses due to disruptions in our operations.

In addition, we receive and maintain certain personal information about our customers and Crew members. Our use of this information is regulated by applicable law. Privacy and information security laws and regulations change, and compliance with updates may result in cost increases due to necessary systems changes and the development of new administrative processes.

Although we have implemented procedures to protect our information, we cannot be certain that our security systems will successfully defend against rapidly evolving, increasingly sophisticated cyber-attacks as they become more difficult to detect and defend against. Our continued investment in our information technology systems may not effectively insulate us from potential attacks, breaches or disruptions to our business operations. If our security and information systems are breached or compromised, or if our Crew members fail to comply with applicable laws and regulations, and personal or other confidential information is obtained by unauthorized persons or used inappropriately, it could interrupt our business, resulting in a slowdown of our normal business activities or limitations on our ability to process credit card transactions, and could adversely affect our reputation, ability to compete in the food retail marketplace, financial condition and results of operations. Additionally, a data security breach could subject us to litigation, customer demands for indemnification for third party claims and/or the imposition of penalties, fines or other assessments. In such event, our liability could exceed our insurance coverage or our ability to pay. In addition, a data security breach could require that we expend significant amounts to remediate the breach, including changes in our information security systems.

In recent years, we have implemented numerous additional security protocols in order to further enhance security, including the installation of EMV (Europay, Mastercard and Visa), or chip and PIN, and point-to-point encryption on our point-of-sale terminals at all our stores. However, there can be no assurance that data security breaches will not occur in the future, or that any such data security breach will be detected in a timely manner.

Claims under our self-insurance program may differ from our estimates, which could negatively impact our results of operations.

We currently maintain insurance customary for businesses of our size and type using a combination of insurance and self-insurance plans to provide for the potential liabilities for workers’ compensation, general liability, professional liability, property insurance, director and officers’ liability insurance, cyber