Company: ALIT
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0001809104-25-000062
Chunk: 299

Company: Alight, Inc. / Delaware
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1A
Chunk 299
---
 interruption in doing so.

Improper access to, misappropriation, destruction or disclosure of confidential, personal or proprietary data as a result of employee or vendor malfeasance or cyber-attacks could result in financial loss, regulatory scrutiny, legal liability or harm to our reputation.

One of our significant responsibilities is to maintain the security, including cybersecurity, and privacy of our employees’ and clients’ confidential and proprietary information and the confidential information about clients’ employees’ health, financial and wellbeing information and other personally identifiable information. However, all information technology systems are potentially vulnerable to damage or interruption from a variety of sources, including but not limited to cyber-attacks, computer viruses, malware, hacking, fraudulent use attempts, “ransomware” and phishing attacks and security breaches. Our systems are also subject to compromise from internal threats such as improper action by employees, vendors and other third parties with otherwise legitimate access to our systems. Despite our efforts, from time-to-time, we and our third-party vendors experience attacks and other cyber-threats to our systems and networks and have from time-to-time experienced cyber security incidents such as computer viruses, unauthorized parties gaining access to our information technology systems and similar matters, which to date have not had a material impact on our business. These attacks can seek to exploit, among other things, known or unknown vulnerabilities in technology included in our information systems or those of third-party providers. Because the techniques used to obtain unauthorized access are constantly changing and becoming increasingly more sophisticated and often are not recognized until launched against a target, we or our third-party providers may be unable to anticipate these techniques or implement sufficient preventative measures. If we, or our third-party providers, are unable to efficiently manage the vulnerability of our systems and effectively maintain and upgrade our system safeguards, we may incur unexpected costs and certain of our systems may become more vulnerable to unauthorized access. For example, there has been a stark increase in new financial fraud schemes akin to ransomware attacks on large companies whereby a cybercriminal installs a type of malicious software, or malware, that prevents a user or enterprise from accessing computer files, systems, or networks and demands payment of a ransom for their return. Cyber criminals may also attempt to fraudulently induce employees, clients or other users of our systems to disclose sensitive information in order to gain access to our data or that of our clients or users. In addition, while we have certain standards for all vendors that provide us services, our vendors, and in turn, their own service providers, have experienced and in the future may continue to become subject