Company: HUM
Filing Date: 2025-02-20
Form Type: 10-K
Source: 0000049071-25-000007
Chunk: 127

Company: HUMANA INC
Filing Date: 2025-02-20
Form: 10-K
Item: Item 1A
Chunk 127
---
 threats, or that such an attack will not be material to our business, in the future. Further, because the techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently and are increasing in sophistication, in part due to use of evolving AI/ML technologies (including generative AI), and because our businesses are changing as well, we may be unable to anticipate these techniques and threats, detect data security incidents or implement adequate preventive measures. A cybersecurity attack may penetrate our layered security controls and lead to the misappropriation of or compromise of protected personal information or proprietary or confidential information, create system disruptions, cause shutdowns, or deploy viruses, ransomware, and other malicious software programs that attack our systems or those of our third-party service providers. A cybersecurity attack that bypasses our information technology systems, or the security of our third-party service providers, could materially affect us due to the theft, destruction, loss, misappropriation or release of confidential information or intellectual property, operational or business delays resulting from the disruption of our IT systems, extortion attempts, or negative publicity resulting in reputation or brand damage with our members, customers, providers, and other stakeholders.

23

The costs to detect, prevent, eliminate or address cybersecurity threats and vulnerabilities before or after an incident could be substantial. Our remediation efforts may not be successful and could result in interruptions, delays, or cessation of service, and loss of existing or potential members. In addition, breaches of our security measures or the security measures of third-party service providers, and the unauthorized dissemination of protected personal information or proprietary or confidential information about us or our customers or other third-parties, can expose our associates' or customers’ private information and result in the risk of financial or medical identity theft, or expose us or other third-parties to a risk of loss or misuse of this information, result in significant regulatory fines or penalties, litigation and potential liability for us, damage our brand and reputation, or otherwise harm our business.

We are involved in various legal actions and governmental and internal investigations, any of which, if resolved unfavorably to us, could result in substantial monetary damages or changes in our business practices. Increased litigation and negative publicity could increase our cost of doing business.

We are or may become a party to a variety of legal actions that affect our business, including breach of contract actions, employment compensation and other labor and employment practice suits, employee benefit claims, stockholder suits and other securities laws claims, intellectual and other property claims, and tort claims.

In addition,