Risks from cybersecurity and physical threats to energy infrastructures are increasing. Threat actors, including sophisticated nation-state actors and criminal groups, exploit potential vulnerabilities in the electric and natural gas utility industry, grid infrastructure, and other energy infrastructures. Attacks and disruptions, which could involve physical, cyber, and hybrid targeting of physical and cyber assets, are increasingly sophisticated and dynamic. The increased implementation of, and reliance on, information technologies and networks to manage business operations, including the operation of technical systems, as well as the Registrants' use of numerous vendors and suppliers, create additional points of vulnerability that could be, and in certain instances have been, exploited by malicious threat actors. Several U.S. government agencies have warned that the energy sector and its supply chains are subject to increasing risks of physical attacks, ransomware attacks and cybersecurity threats, and that the risks may escalate during periods of heightened geopolitical tensions. In addition, the rapid evolution and increased adoption of artificial intelligence technologies may intensify the Registrants' cybersecurity risks.
A security breach of the Registrants' physical assets or information systems or those of the Registrants' competitors, vendors, business partners and interconnected entities (including RTOs and ISOs) could materially impact Registrants by, among other things, impairing the availability of electricity and gas distributed by Registrants and/or the reliability of transmission and distribution systems, damaging grid infrastructure, interrupting critical business functions, impairing the availability of vendor services and materials that the Registrants rely on to maintain their operations, or by leading to the theft or inappropriate release of certain types of information, including critical infrastructure information, system data and architecture, sensitive customer, vendor, or employee data, or other confidential data. While Registrants and some of the Registrants' vendors have experienced cybersecurity incidents, such incidents have not, to Registrants' knowledge, resulted in material impact to any of the Registrants to date.
If a material physical or cybersecurity breach or disruption were to occur, the Registrants' reputation could be negatively affected, customer confidence in the Registrants could be diminished and the Registrants could be subject to legal claims, regulatory exposure, loss of revenues, and increased costs, including infrastructure repairs or operations shutdown, all of which could materially affect the Registrants' financial condition and materially damage their business reputation. Moreover, the amount and scope of insurance maintained against losses resulting from any such security breaches or disruptions may not be sufficient to cover losses or otherwise adequately compensate for any resulting business disruptions. The continued increase in Federal and state regulatory requirements related to cybersecurity and evolving threat actor-capabilities could require changes to measures currently undertaken by the Registrants or to their business operations and could adversely affect their consolidated financial statements.