Company: GHC
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0000104889-25-000022
Chunk: 214

Company: Graham Holdings Co
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1A
Chunk 214
---
, and may not be detected until after an incident has occurred. These techniques include using artificial intelligence, including generative AI to enhance their attacks, which may increase our cybersecurity risk. Although the Company and the third-party service providers seek to maintain their respective systems effectively and to 

39

successfully address the risk of compromise of the integrity, security and consistent operations of these systems, such efforts may not be successful. As a result, the Company or its service providers could experience errors, interruptions, delays or cessations of service in key portions of the Company’s information technology infrastructure, which could significantly disrupt its operations, including manufacturing production delays, and be costly, time-consuming and resource-intensive to remedy. Any security breach or unauthorized access also could result in a misappropriation of the Company’s proprietary information or the proprietary information of the Company’s users, customers or partners, which could result in significant legal and financial exposure and damage to the Company’s reputation. If an actual or perceived breach of the Company’s security occurs, or if the Company’s consumer-facing sites become the subject of external attacks that affect or disrupt service or availability, the market perception of the effectiveness of the Company’s security measures could be harmed and the Company could lose users, customers, advertisers or partners, all of which could have a material adverse effect on the Company’s business, financial condition and results of operations. Any security breach at a company providing services to the Company or the Company’s users, including third-party payment processors, could have similar effects and the Company may not be fully indemnified for the costs it may incur as a result of any such breach. To the extent that such vulnerabilities require remediation, such remedial measures could require significant resources and may not be implemented before such vulnerabilities are exploited. As the cybersecurity landscape evolves, the Company may also find it necessary to make significant further investments to protect data and infrastructure, including continuing to evaluate control changes and investments needed to support an increased remote workforce. Any of these events could have a material adverse effect on the Company’s businesses and results of operations. Sustained or repeated system failures or security breaches that interrupt the Company’s ability to process information in a timely manner or that result in a breach of proprietary or personal information could have a material adverse effect on the Company’s operations and reputation. In addition, minor incidents, even if dealt with promptly, could lead to severe legal, financial and reputational issues, such as investigations by authorities, enforcement, lawsuits and negative publicity, and a collection of incidents, though not considered material individually at the