Company: SOJE
Filing Date: 2025-02-20
Form Type: 10-K
Source: 0000092122-25-000018
Chunk: 4254

Company: SOUTHERN CO
Filing Date: 2025-02-20
Form: 10-K
Item: Item 1A
Chunk 4254
---
 technology systems, financial fraud, and disruption of remote access across the Southern Company system, there has been no material impact on the Registrants or 

I-18

    Table of Contents                                Index to Financial Statements

their operations from these attacks. However, the Registrants cannot guarantee that security efforts will have the maturity to detect or prevent breaches, operational incidents, or other breakdowns of technology systems and network infrastructure, especially in the event the Registrants are targeted by a sophisticated attacker with significant resources, such as a nation-state or state-sponsored actor. As artificial intelligence continues to evolve, new technologies and increased computing power could lead to new attack techniques and more sophisticated attacks. Further, the Registrants do not have security visibility into all operational technology communications and processes, do not maintain completely exhaustive inventories of assets and applications, and do not centrally manage or monitor all technologies, applications, and environments, which could negatively affect preparation for, investigation of, or response to an information security incident. Accordingly, the Registrants cannot provide any assurance that information security incidents will not have a material adverse effect in the future.

In addition, in the ordinary course of business, Southern Company and its subsidiaries collect and retain sensitive information, including personally identifiable information about customers, employees, and stockholders, and other confidential information. In some cases, administration of certain functions may be outsourced to third-party service providers. Malicious actors may target these providers, as well as other vendors, to disrupt or compromise services and products. Such third-party vendors have been increasingly used as attack vectors in efforts to target critical infrastructure, including that of the Registrants. The Registrants cannot fully assess the security maturity of all third-party vendors and such vendors could fail to establish adequate risk management and information security measures with respect to their systems and/or could fail to timely notify the Registrants of an information security incident.

Internal or external cyberattacks may have wide-reaching impacts due to incomplete segmentation among network assets and/or reliance of segmented networks on a disrupted network, inhibit the affected Registrant's ability to fulfill critical business functions, including energy delivery service failures, compromise sensitive and other data, violate privacy laws, and lead to customer dissatisfaction. Any cyber breach or theft, damage, or improper disclosure of sensitive electronic data may also subject the affected Registrant to penalties and claims from regulators or other third parties. Any violations of applicable laws and regulations could lead to material losses, both financial and reputational. Insurance may not be adequate to cover any associated losses, and there is no assurance that such