Company: TTMI
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0000950170-25-024839
Chunk: 79

Company: TTM TECHNOLOGIES INC
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1A
Chunk 79
---
 unfavorable publicity, governmental inquiry and oversight, difficulty in marketing our services, allegations by our customers that we have not performed our contractual obligations, loss of customers, litigation by affected parties, and possible financial obligations for damages related to the theft or misuse of such information, any of which could have a material adverse effect on our business, financial condition, and results of operations. In addition, some of our employees work remotely, including while traveling for business, which increases our cybersecurity risk, creates data accessibility concerns, and makes us more susceptible to security breaches or business disruptions.

In addition, threat actors are also increasingly using tools and techniques that circumvent controls, evade detection, and remove forensic evidence, which means that we and others may be unable to anticipate, detect, deflect, contain, or recover from cybersecurity incidents in a timely or effective manner. As AI capabilities improve and are increasingly adopted, we may see cybersecurity incidents created through AI. These attacks could be crafted with an AI tool to directly attack IT systems with increased speed and/or efficiency than a human threat actor or create more effective phishing emails. In addition, the cybersecurity threat could be introduced from the result of our or our customers and business partners incorporating the output of an AI tool that includes a threat, such as introducing malicious code by incorporating AI generated source code. Our information systems, as well as those of our customers and business partners, may be subject to unauthorized access by hackers or breached due to operator error, malfeasance, or other system disruptions.

Privacy, information security, and data protection laws, rules, and regulations could affect or limit how we collect and use personal information, increase our costs, and adversely affect our business opportunities.

Many U.S. and foreign laws and regulations, including those promulgated by the SEC, require companies to provide notice of cybersecurity incidents involving certain types of personal data or unauthorized access to, or interference with, our information systems to the public, certain individuals, the media, government authorities, or other third parties. Certain of these laws and regulations include notice or disclosure obligations contingent upon the result of complex analyses, including in some cases a determination of materiality. The nature of cybersecurity incidents can make it difficult to quickly and comprehensively assess an incident's overall impact to our business, and we may make errors in our assessments. If we are unable to appropriately assess a cybersecurity incident in the context of required analyses then we could face compliance issues under these laws and regulations, and we could be subject to lawsuits, regulatory fines or investigations, or other liabilities, any or all of which