Company: INFY
Filing Date: 2025-07-01
Form Type: 20-F
Source: 0000950170-25-091925
Chunk: 28

Company: Infosys Ltd
Filing Date: 2025-07-01
Form: 20-F
Item: Item 3
Chunk 28
---
 clients or others for breaching contractual confidentiality and security provisions or data protection laws. For example, in November 2023, certain systems of Infosys McCamish Systems LLC (“McCamish”), a subsidiary of Infosys BPM Limited (a wholly owned subsidiary of Infosys Limited), were encrypted by ransomware, resulting in the non-availability of certain applications and systems. Six actions were filed against McCamish arising out of this cybersecurity incident. All six actions have since been consolidated, and the consolidated class action complaint was filed on November 7, 2024, purportedly on behalf of all persons residing in the United States whose personally identifiable information was compromised in the incident, including all who were sent a notice of the incident. On March 13, 2025, McCamish and the plaintiffs engaged in mediation, resulting in an in-principle agreement that sets forth the terms of a proposed settlement of the class action lawsuits against McCamish, as well as seven class action lawsuits arising out of the incident that have been filed against McCamish’s customers. On May 9, 2025, McCamish and the plaintiffs entered into a definitive settlement agreement. The settlement is subject to preliminary and final court approval. If approved, the settlement will resolve all allegations made in the class action lawsuits without admission of any liability.

Laws and expectations relating to data protections continue to evolve in ways that may limit our access, use and disclosure of sensitive data, and may require increased expenditures by us or may dictate that we not offer certain types of services.
Given the hybrid working model, there is relatively higher potential for confidential data being exposed. We endeavor to strengthen and automate controls and educate our employees on how to secure the data and follow the best security practices, but non-material data breaches have occurred and the possibility of future data breaches (material or non-material) cannot be completely ruled out. This may lead to an adverse impact on our brand and financial condition and results of operations.

Our reputation could be at risk and we may be liable to our clients for damages caused by cybersecurity incidents.

The increase in sophistication and complexity of cyber-attacks, cybercrime and cyber insecurity have made the global cyber threat landscape highly volatile. Organizations across the world need to be vigilant to shield themselves from cybersecurity risks and the associated perils and challenges. We and our third-party service providers have in the past and may in the future be targets of cybersecurity attacks. For example, certain systems of McCamish, were encrypted by ransomware resulting in the non-availability