Company: HCKT
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0000950170-25-030037
Chunk: 12

Company: HACKETT GROUP, INC.
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1A
Chunk 12
---
 thereby exposing us to material adverse effects on our business, financial condition, results of operations and growth prospects. In order to address risks to our information systems, we continue to make investments in personnel, technologies and training. Data protection laws and regulations around the world often require “reasonable,” “appropriate” or “adequate” technical and organizational security measures, and the interpretation and application of those laws and regulations are often uncertain and evolving; there can be no assurance that our security measures will be deemed adequate, appropriate or reasonable by a regulator or court. Moreover, even security measures that are deemed appropriate, reasonable, and/or in accordance with applicable legal requirements may not be able to protect the information we maintain. A cybersecurity incident or other significant disruption impacting us or our third-party service providers could require a substantial level of financial resources to rectify and otherwise respond to, may be difficult to identify or address in a timely manner, and may divert management’s attention and require the expenditure of significant time and resources. Such cybersecurity incidents or other significant disruptions could result in claims, increased regulatory scrutiny, or investigations, and may cause us to incur substantial fines, penalties, or other liability and related legal and other costs. Any actual or perceived cybersecurity incident or significant disruption may also interfere with our ability to 

16

comply with financial reporting requirements and harm our reputation and market position, especially given that we handle sensitive customer information. Any of the foregoing matters could harm our operating results and financial condition.

While we have purchased cybersecurity insurance, there are no assurances that the coverage would be adequate in relation to any incurred losses. Moreover, as cyber-attacks increase in frequency and magnitude, we may be unable to obtain cybersecurity insurance in amounts and on terms we view as adequate for our operations.

A breach of our information technology and security systems could materially adversely affect our business.

We use information technology and security systems to protect proprietary and confidential information, including that of our customers, suppliers and employees. Denial of service or other attacks on, or accidental or willful security breaches or other unauthorized access to our facilities or information systems, unauthorized access to or acquisition of personal information, confidential information or other data we process or maintain, or viruses, loggers, or other malfeasant code, including ransomware, in our data or software, could compromise this information and otherwise disrupt our operations. The consequences of such loss, possible misuse of our proprietary and confidential information, or operational disruptions could include, among other things, unfavorable publicity, damage to our reputation, difficulty marketing our products, customer allegations of