Company: GWW
Filing Date: 2025-02-20
Form Type: 10-K
Source: 0000277135-25-000010
Chunk: 21

Company: W.W. GRAINGER, INC.
Filing Date: 2025-02-20
Form: 10-K
Item: Item 1A
Chunk 21
---
Cybersecurity threats and incidents, including breaches of information systems security could damage Grainger’s reputation, disrupt operations, increase costs and/or decrease revenues.
Through Grainger’s sales and digital channels, as well as its ordinary course of business, Grainger collects and stores personally identifiable, confidential, proprietary and other information from customers, team members, suppliers, website visitors, and other entities or individuals so that they may, among other things, purchase products or services, enroll in promotional programs, register on Grainger’s websites or otherwise communicate or interact with Grainger. Moreover, Grainger’s operations routinely involve receiving, storing, processing and transmitting sensitive information pertaining to its business, customers, suppliers and team members, and other sensitive matters.
Cybersecurity threats are rapidly evolving and some of the means for obtaining access to information in digital and other storage media are becoming increasingly sophisticated. Each year, cybersecurity threat actors make numerous attempts to access the information stored in Grainger's information systems or Grainger's third-party business partners. Loss of customer, supplier, and team member information, intellectual property or other business information, or failure to comply with data privacy and security laws, or failure to maintain systems or software, could, for example, disrupt operations, damage Grainger’s reputation and expose Grainger to claims from customers, suppliers, financial institutions, regulators, payment card associations, team members and others, any of which could have a material adverse effect on Grainger, including its business strategy, financial condition and results of operations. If successful, cybersecurity incidents may expose Grainger to risk of loss or misuse of proprietary or confidential information or disruptions of business operations. 
Grainger's IT infrastructure also includes products and services provided by suppliers, vendors and other third-party business partners, and these third parties can experience cybersecurity threats, breaches, attacks, disruptions, and cybersecurity incidents that impact the security of systems and proprietary or confidential information. Moreover, Grainger shares information with these third parties in connection with the products and services they provide to the business. Although Grainger performs risk assessments on third parties where Grainger deems appropriate to learn about their security program, there is a risk that the confidentiality of data held or accessed by them may be compromised or their systems may be disrupted or interrupted by threat actors.
Moreover, Grainger, and its third-party business partners, may face cybersecurity threats and cybersecurity incidents which can include unauthorized access to information systems, business email compromise, viruses, malicious code, ransomware, denial-of-service attacks, and organized cyber-attacks. Cybersecurity incidents can