Company: ATO
Filing Date: 2025-11-14
Form Type: 10-K
Source: 0000731802-25-000056
Chunk: 24

Company: ATMOS ENERGY CORP
Filing Date: 2025-11-14
Form: 10-K
Item: Item 1A
Chunk 24
---
 logistics, management reporting, and external financial reporting. The failure of these or other similarly important technologies, or the Company’s inability to have these technologies supported, updated, expanded, or integrated into other technologies, could hinder its business operations and adversely impact its financial condition and results of operations.

Although the Company has, when possible, developed alternative sources of technology and built redundancy into its computer networks and tools, there can be no assurance that these efforts would protect against all potential issues related to the loss of any such technologies.

Cyber-attacks or acts of cyber-terrorism could disrupt our business operations and information technology systems or result in the loss or exposure of confidential or sensitive customer, employee or Company information.

Our business operations and information technology systems may be vulnerable to an attack by individuals or organizations intending to disrupt our business operations and information technology systems. Disruption of those systems could adversely impact our ability to safely deliver natural gas to our customers, operate our pipeline and storage systems, or serve our customers timely. Further, any attack on our technology systems that would result in the unauthorized release of confidential or sensitive data could have a material adverse effect on our business reputation, increase our costs, and expose us to material legal claims and liability. The Company has implemented policies, procedures, and controls to identify, protect, detect, and respond to cyberattacks or acts of terrorism. However, these measures may be insufficient or become ineffective, and there are no assurances that cybersecurity breaches or acts of terrorism will not impact our business operations and strategy, results of operations, and financial condition in the future. Even though we have insurance coverage in place for many of these cyber-related risks, if such an attack or act of terrorism were to occur, our operations and financial results could be adversely affected to the extent not fully covered by such insurance coverage.

Compliance with and changes in cybersecurity requirements have a cost and operational impact on our business, and failure to comply with such laws and regulations could adversely impact our reputation, results of operations, financial condition, and/or cash flows.

16

As cyber-attacks are becoming more sophisticated, U.S. government warnings have indicated that critical infrastructure assets, including pipeline infrastructure, may be specifically targeted by certain groups. In recent years, the U.S. government has issued directives that require critical pipeline owners to comply with mandatory reporting measures, designate a cybersecurity coordinator, provide vulnerability assessments, and ensure compliance with certain cybersecurity requirements. Such directives or other requirements may require expenditure of significant additional resources to respond to cyber-attacks, to continue to modify or enhance protective measures, or