Mueller Water delays 10-K due to previously announced cybersecurity incident

In a regulatory filing, Mueller Water Products said that, as previously announced on October 28, Mueller Water Products identified a cybersecurity incident impacting certain internal operational and information technology systems. “Based on the information reviewed to date, the company believes the unauthorized activity has been contained. All of the company’s facilities are operational and have substantially returned to normalized operations. This cybersecurity incident consisted of unauthorized access and deployment of ransomware by a third party to a portion of the company’s internal information infrastructure. The incident caused disruptions and limitation of access to portions of the company’s business applications supporting aspects of the company’s operations and corporate functions, which limited the company’s ability to take orders and ship products. The company has largely restored the impacted applications and systems, and continues to execute business continuity and restoration plans for the remaining impacted applications and systems. This cybersecurity incident disrupted access to certain systems and information required for the company’s financial reporting. After restoring access to such systems and information, the company has focused on verifying its data and completing its fiscal 2023 processes. Due to the timing of the incident, the company will be delayed in filing its Annual Report on Form 10-K for the year ended September 30, 2023. However, the company currently expects to report its fiscal fourth quarter and fiscal 2023 results and file its Form 10-K no later than December 14, 2023, which is within the Rule 12b-25 period available to the company for its Form 10-K. When the company has greater certainty on the timing of the completion of its financial close and reporting processes, the company will make an announcement related to the timing of its fourth quarter and fiscal 2023 earnings release and conference call. The company also identified a separate cybersecurity incident, which primarily related to a system that was end of life and was already in the process of being replaced in the ordinary course of business. The company’s investigation and remediation efforts remain ongoing, including the analysis of data accessed, exfiltrated or otherwise impacted in connection with the cybersecurity incidents. The company continues to evaluate the business, financial and related impacts of the cybersecurity incidents,” the filing stated.