Company: JACK
Filing Date: 2025-11-19
Form Type: 10-K
Source: 0000807882-25-000072
Chunk: 46

Company: JACK IN THE BOX INC
Filing Date: 2025-11-19
Form: 10-K
Item: Item 1A
Chunk 46
---
 for vendors that require access to our restaurant networks. We also have business continuity plans that attempt to anticipate and mitigate failures. However, we cannot control or prevent every cybersecurity risk.

A material failure or interruption of service, or a breach in the security of our computer systems caused by malware, ransomware or other attack, could cause reduced efficiency in operations, or other business interruptions; could negatively impact delivery of food to restaurants, or financial functions such as vendor payment, employee payroll and scheduling, franchise operations reporting, or our ability to receive customer payments through our POS or other systems, or could result in the loss or misappropriation of customer or employee data. Such events could negatively impact cash flows or require significant capital investment to rectify; result in damage to our business or reputation or loss of consumer or employee confidence; and lead to potential costs, fines, and litigation. Damage to our business or reputation or loss of consumer confidence may also result from any failure by our franchisees to implement standard computer systems and information technology, as we are dependent on our franchisees to adopt appropriate safeguards. These risks may be magnified by increased and changing regulations. The costs of compliance and risk mitigation planning, including increased investment in technology or personnel in order to protect valuable business or consumer information, have increased significantly in recent years, and may also negatively impact our financial results.

Restaurants and other retailers have faced, and we could in the future become subject to, claims for purportedly fraudulent transactions arising out of the actual or alleged theft of credit or debit card information or the loss of personally identifiable information, and we may also be subject to lawsuits or other proceedings in the future relating to these types of incidents. Any such proceedings could distract our management from running our business and cause us to incur significant unplanned losses and expenses. Consumer perception of our brands could also be negatively affected by these events, which could further adversely affect our financial results.

We collect and maintain personal information about our employees and our guests and are seeking to provide our guests with new digital experiences. These digital experiences will require us to integrate into our POS systems to allow for capabilities like mobile order and pay, third party delivery, and digital menu boards. The collection and use of personal information are regulated at the federal and state levels; such regulations include the California Consumer Privacy Act. We increasingly rely on cloud computing and other technologies that result in third parties holding various customer, employee, and franchisee information on our behalf. There has been an increase over the past several years in the frequency and sophistication of attempts to compromise the