ASML Holding (0M42) Risk Analysis

We rely on the accuracy, availability and security of our information technology systems. Despite the measures that we have implemented, including those related to cybersecurity, our systems could be breached or damaged by computer viruses and systems attacks, natural or man-made incidents, disasters or unauthorized physical or electronic access. We are experiencing an increasing number of cyberattacks on our information technology systems as well as the information technology systems of our suppliers, customers and other service providers, whose systems we do not control. These attacks include malicious software (malware), attempts to gain unauthorized access to data, and other electronic security breaches of our information technology systems. They also include the information technology systems of our suppliers, customers and other service providers that have led and could lead, for us, our customers, suppliers or other business partners - including R&D partners - to disruptions in critical systems, unauthorized release, misappropriation, corruption or loss of data or confidential information (including confidential information relating to our customers, employees and suppliers). Further, we depend on our employees and the employees of our suppliers to appropriately handle confidential and sensitive data and deploy our IT resources in a safe and secure manner that does not expose our network systems to security breaches or the loss of data. However, there is always a risk that inadvertent disclosure or actions or internal malfeasance by our employees or those of our suppliers could result in a loss of data or a breach or interruption of our IT systems. In addition, any system failure, accident or security breach could result in business disruption, theft of our intellectual property, trade secrets (including our proprietary technology), unauthorized access to, or disclosure of, customer, personnel, supplier or other confidential information, corruption of our data or of our systems, reputational damage or litigation. Furthermore, computer viruses or other malware may harm our systems and software and could be inadvertently transmitted to our customers' systems and operations, which could result in loss of customers, litigation, government investigation and proceedings that could expose us to civil or criminal liabilities and significant management attention and resources to remedy the damages that result. We may also be required to incur significant costs to protect against or repair the damage caused by these disruptions or security breaches in the future, including, for example, rebuilding internal systems, implementing additional threat protection measures, providing modifications to our products and services, defending against litigation, responding to regulatory inquiries or actions, paying damages, or taking other remedial steps with respect to third parties. Further, remediation efforts may not be successful and could result in interruptions, delays or cessation of service, unfavorable publicity, damage to our reputation, customer allegations of breach-of-contract, possible litigation, and loss of existing or potential customers that may impede our sales or other critical functions. Cybersecurity threats are constantly evolving. We remain potentially vulnerable to additional known or yet unknown threats, as in some instances, we, our customers, and our suppliers may be unaware of an incident or its magnitude and effects. We also face the risk that we expose our customers to cybersecurity attacks through the systems we deliver to our customers, including in the form of malware or other types of attacks as described above, which could harm our customers. Furthermore, the COVID-19 pandemic has increased the level of remote working within our organization, which increases the risks of cybersecurity incidents. ASML visibility and importance for the semiconductor industry keeps on growing. There is a risk that this may lead to actions that may adversely impact the security of ASML or the safety of its employees. In addition, processes and systems may not be able to adequately support the growth. From time to time, we implement updates to our information technology systems and software, which can disrupt or shutdown our information technology systems. We may not be able to successfully launch and integrate these new systems as planned without disruption to our operations. For example, we are currently implementing a new ERP system and infrastructure (ONE program). As a result of this system implementation or otherwise, we have and could continue to experience disruptions in our operations. In 2021, we experienced delays of operations after the launch of a new logistics center, which resulted in a delay in production of some products.