Company: SOJE
Filing Date: 2025-02-20
Form Type: 10-K
Source: 0000092122-25-000018
Chunk: 2015

Company: SOUTHERN CO
Filing Date: 2025-02-20
Form: 10-K
Item: Item 1
Chunk 2015
---
 distribute or store natural gas, or otherwise operate its facilities, in the most efficient manner or at all. Transmission and distribution infrastructure can be vulnerable to physical attack because it is often unmanned, widely dispersed, and located in isolated areas. The risk of physical attack may escalate during periods of heightened geopolitical tensions. In addition, physical attacks against third-party providers could have a similar effect on the Southern Company system.

Despite the implementation of robust security measures, all assets are potentially vulnerable to disability, failure, or unauthorized access due to human error, natural disaster, technological failure, or internal or external physical attack. If assets were to fail, be physically damaged, or be breached and were not restored in a timely manner, the affected Subsidiary Registrant may be unable to fulfill critical business functions. Insurance may not be adequate to cover any associated losses.

An information security incident, including a cybersecurity breach, or the failure of, or inability to remotely access, one or more key technology systems, networks, or processes could impact the ability of the Registrants to operate.

The Subsidiary Registrants operate in highly regulated industries that require the continued operation of sophisticated technology systems and network infrastructure, which are part of interconnected systems. Because of the critical nature of the infrastructure and the technology systems' inherent vulnerability to disability or failure due to hacking, virus, denial of service, ransomware, act of war or terrorism, or other type of data security breach, the Registrants face a heightened risk of cyberattack. In addition, the increased use of smartphones, tablets, and other wireless devices, as well as remote working arrangements, may also increase the Registrants' data security risks. Portions of the Registrants' system data, architecture, and other materials may also be disclosed, either intentionally or unintentionally, to third parties and the public by regulators, employees, contractors, and vendors. This system information may be used by malicious actors to understand the Registrants' systems to prepare for a cyberattack. In addition, unpatched software or network vulnerabilities, including those resulting from the use of end-of-life operating systems, could be leveraged by an attacker.

Cyber actors, including those associated with foreign governments, have attacked and threatened to attack energy infrastructure. Various regulators have increasingly stressed that these attacks, including ransomware attacks, and attacks targeting utility systems and other critical infrastructure, are growing in sophistication, magnitude, and frequency. In particular, certain actors, such as nation-state and state-sponsored actors, can deploy significant resources and employ sophisticated methods to plan and carry