Company: SYY
Filing Date: 2025-08-22
Form Type: 10-K
Source: 0000096021-25-000099
Chunk: 106

Company: SYSCO CORP
Filing Date: 2025-08-22
Form: 10-K
Item: Item 1A
Chunk 106
---
 viruses, theft and inadvertent release of information. In the normal course of business, we and our third-party providers experience cybersecurity threats and incidents of varying degrees from time-to-time, including ransomware, ransom-related extortion, and phishing attacks, as well as distributed denial of service attacks and the theft of data. Cyber threats are constantly evolving, are becoming more sophisticated and frequent, including through the introduction of viruses and malware (such as ransomware) and the use of artificial intelligence by the threat actors, and are being made by groups and individuals with a wide range of expertise and motives, and this increases the difficulty of detecting and successfully defending against them. For example, in March 2023, Sysco became aware of a cybersecurity event perpetrated by a threat actor believed to have begun earlier that year. Immediately upon detection, Sysco initiated an investigation, with the assistance of cybersecurity and forensics professionals, determining that the threat actor had extracted certain company data, including data relating to operation of the business, customers, employees and personal data. This data extraction did not impact Sysco’s operational systems and related business functions, and its service to customers continued uninterrupted. Sysco also notified federal law enforcement and provided other required notifications. To date, cybersecurity incidents have not had a material impact on our financial condition, results of operations or liquidity. However, there is no assurance that there will not be a material adverse effect in the future, especially if, for example, the amount of insurance coverage we maintain is not sufficient to cover claims or liabilities relating to an incident.  

Potential consequences of a future material cybersecurity incident include: business disruption; disruption to systems; theft, destruction, loss, corruption, misappropriation or unauthorized release of sensitive and/or confidential information or 

17

intellectual property (including personal information in violation of one or more privacy laws); loss of revenue; reputational and brand damage; and potential liability, including litigation or other legal actions against us or the imposition by governmental authorities of penalties, fines, fees or liabilities, which, in turn, could cause us to incur significantly increased cybersecurity protection and remediation costs and the loss of customers. In addition, if our suppliers or customers experience such a breach or unauthorized disclosure or system failure, their businesses could be disrupted or otherwise negatively affected. This may result in a disruption in our supply chain or reduced customer orders, which would adversely affect our business operations. We have also outsourced several information technology support services and administrative functions to third-party service providers, including cloud-based service providers, and may outsource