Company: ELV
Filing Date: 2025-02-20
Form Type: 10-K
Source: 0001156039-25-000010
Chunk: 39

Company: Elevance Health, Inc.
Filing Date: 2025-02-20
Form: 10-K
Item: Item 1A
Chunk 39
---
 software or applications we develop or procure from third parties may contain defects in design, manufacturer defects or other problems that could unexpectedly compromise information security. In addition, because the techniques used to obtain unauthorized access, disable, disrupt or degrade service or sabotage systems change frequently, are becoming increasingly sophisticated (in part due to the use of evolving technologies), and may not immediately produce signs of intrusion, we may be unable to anticipate these techniques and threats, timely discover or counter them or implement adequate preventative measures. Viruses, worms, malicious software programs or other unauthorized methods of acquiring data may be used to attack our systems or otherwise exploit any security vulnerabilities which may cause system disruptions or shutdowns, or may cause personal, proprietary or confidential information to be disclosed, misappropriated or compromised. We have business continuation and resiliency plans which are maintained, updated and tested regularly in an effort to successfully contain and remediate potential disruptions or cyber events, but there is no guarantee that such efforts will be effective. If those efforts are not effective, the functionality of our information technology systems or those of third parties could be interrupted. Cybersecurity and the continued development and enhancement of our controls, processes and practices designed to protect our systems, computers, software, data and networks from attack, damage and unauthorized access remain a priority for us.

We have been, and may in the future be, subject to litigation and governmental investigations related to cyber-attacks, privacy incidents and security breaches. Any such future litigation or governmental investigation could divert the attention of management from the operation of our business, result in reputational damage and have a material adverse impact on our business, cash flows, financial condition, and results of operations. Moreover, our programs to detect, contain, and respond to data security incidents as well as contingency plans and insurance coverage for potential liabilities of this nature may not be sufficient to cover all claims and liabilities.

Noncompliance with any privacy, security or data protection laws and regulations, or any security breach, cyber-attack or cybersecurity breach, and any incident involving the misappropriation, exfiltration, theft, loss or other unauthorized disclosure or use of, or access to, sensitive or confidential information, whether by us or by one of our third-party service providers or their vendors, previously have and could in the future require us to expend significant resources to continue to modify or enhance our protective measures and to remediate any damage. In addition, this could negatively affect our operations, cause system disruptions, damage our reputation, cause membership losses and contract breaches, expose us or our members