Company: CI
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0001739940-25-000009
Chunk: 9

Company: Cigna Group
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1A
Chunk 9
---
 reputational harm, loss of revenue or other damages.

Our business depends on our clients' and customers' willingness to entrust us with their health-related and other PII, including PHI, that is subject to privacy, security or data breach notification laws. Computer networks or systems may be vulnerable to intrusion, computer viruses or malware, programming errors, attacks by third parties or similar disruptive problems. We have been, and will likely continue to be, the target of computer viruses or other malicious codes, unauthorized access, cyberattacks or other computer-related penetrations. There have been, and will continue to be, large-scale cyberattacks within the health service industry. For example, Change Healthcare, a health technology company owned by UnitedHealth Group and a service provider for certain of our pharmacy benefit management services, was the victim of a ransomware attack in February 2024, which resulted in limited disruption of certain of our services and necessitated security validations for certain systems before we reconnected with Change Healthcare to resume such services. Additionally, hardware, software or applications we develop or procure from third parties may contain defects in design, manufacturer defects or other problems that could unexpectedly compromise information technology. Human or technological error has and could in the future result in, for example, unauthorized access to and acquisition, disclosure, modification, misuse, loss or destruction of company, customer, or other third-party data or systems; theft of sensitive, regulated or confidential data, including PII and intellectual property; the loss of access to critical data or systems through ransomware, destructive attacks or other means; and business delays, service or system disruptions, or denials of service.

As we increase the amount of PII that we store and share digitally, our exposure to unauthorized uses and disclosures and data privacy and related cybersecurity risks increases, including the risk of undetected attacks, damage, loss, or unauthorized access or acquisition or misappropriation of proprietary or personal information. The cost of attempting to protect against these risks also increases. The health care data ecosystem is complex and requires data exchange with vendors, business partners, health care professionals, the government and others. If disruptions, data disclosures, security incidents or breaches are not detected quickly, their effect could be compounded. We have dedicated significant resources to implement privacy and security technologies, processes and procedures to protect PII and provide employee awareness training around phishing, malware and other cyber risks; however, there are no assurances that such measures will be effective against all types of security incidents. 

Cybersecurity threats are rapidly evolving, and those threats and