American Water (AWK) Risk Analysis

Municipalities and other government subdivisions have historically been involved in the provision of water and wastewater services in the United States, and organized efforts may arise from time to time in one or more of the service areas in which our Regulated Businesses operate to convert our assets to public ownership and operation through exercise of the governmental power of eminent domain, or another similar authorized process. A municipality, other government subdivision or a citizen group may seek to acquire our assets through eminent domain or such other process, either directly or indirectly as a result of a citizen petition. For example, on December 15, 2023, the MPWMD filed eminent domain litigation against Cal Am in Monterey County Superior Court with respect to the Monterey system assets and the case is pending. See Item 3-Legal Proceedings-Proposed Acquisition of Monterey System Assets - Potential Condemnation for additional information regarding this matter. Furthermore, the law in certain jurisdictions in which our Regulated Businesses operate provides for eminent domain rights allowing private property owners to file a lawsuit to seek just compensation against a public utility, if the public utility's infrastructure has been determined to be a substantial cause of damage to that property. In these actions, the plaintiff would not have to prove that the public utility acted negligently. In California, lawsuits have been filed in connection with large-scale natural events such as wildfires. Some of these lawsuits have included allegations that infrastructure of certain utilities triggered the natural event that resulted in damage to the property. In some cases, the PUC has disallowed recovery in rates of losses incurred by these utilities as a result of such lawsuits. Contesting an exercise of condemnation, eminent domain or other similar process, or responding to a citizen petition, may result in costly legal proceedings and may divert the attention of management. Moreover, our efforts to resist the condemnation, eminent domain or other process may not be successful, which may require us to sell the operations at issue in a condemnation proceeding or to pay a private property owner compensation for the property damage suffered. If a municipality or other government subdivision succeeds in acquiring the assets of one or more of our Regulated Businesses through eminent domain or other process, there is a risk that we will not receive adequate compensation for the business, that we will not be able to keep the compensation, or that we will not be able to divest the business without incurring significant charges. Any of these outcomes may have a material adverse effect on our business, results of operations, financial condition, cash flows and liquidity.

MSG enters into contracts with the U.S. government for the operation and maintenance of water and wastewater systems, which contracts may be terminated, in whole or in part, prior to the end of the 50-year term for convenience of the U.S. government or as a result of default or non-performance by the subsidiary performing the contract. In addition, the contract price for each of these military contracts is typically subject to either an annual economic price adjustment, or a price redetermination two years after commencement of operations and every three years thereafter. Any early contract termination or unfavorable annual economic price adjustment or price redetermination could adversely affect our financial condition, results of operations and cash flows. Moreover, entering into contracts with the U.S. government subjects us to a number of operational and compliance risks, including dependence on the level of government spending and compliance with and changes in governmental procurement and security (including cybersecurity) regulations. We are subject to potential government investigations of our business practices and compliance with government procurement, security and cybersecurity regulations, which are complex, and compliance with these regulations can be expensive and burdensome. If we were charged with wrongdoing as a result of an investigation, we could be suspended or debarred from bidding on or receiving awards of new contracts with the U.S. government or our existing contracts could be terminated, which could have a material adverse effect on our results of operations and cash flows.

A significant part of our long-term strategic plan focuses on safety, operational excellence, cost and expense efficiency (including O&M expense efficiency), water quality and affordability, asset and capital management and the customer experience. For example, we have made and plan to continue to make significant investments in developing, deploying, integrating, enhancing and maintaining customer-facing technologies, applications to support field service and customer service operations, water source monitoring technologies, meter data management and analytics, and intelligent automation technologies. There can be no assurance that we will be successful in designing, developing, deploying, integrating or maintaining these new technologies. Because these efforts can be long-term in nature, these new technologies may be more costly or time-consuming than expected to design, develop, integrate and complete and may not ultimately deliver the expected or desired benefits upon completion. While we have and will continue to seek to recover costs and earn a return on capital expenditures with respect to the costs and expenses of development and deployment of these new technologies in our Regulated Businesses, there can be no assurance that we will be able to do so in every instance or at all, and our inability to do so may adversely affect our ability to achieve intended cost and expense, including O&M expense, efficiencies or other key performance results and, ultimately, could materially and adversely impact our business, financial condition, results of operations and cash flows.

As owners and operators of critical infrastructure, we face a heightened risk of physical attack and cyber attacks from internal or external sources, including nation-state cyber actors. Our water and wastewater systems have been, and may in the future be, vulnerable to disability or failures as a result of physical or cyber attacks, acts of war or terrorism, vandalism and other causes. By way of example, on October 3, 2024, we identified unauthorized activity within our information technology computer networks and systems, which we determined to be the result of a cybersecurity incident. See Item 7-Management's Discussion and Analysis of Financial Condition and Results of Operations-Other Matters-Cybersecurity Incident, for more information regarding this incident. Our operational and information technology systems are also vulnerable to unauthorized external or internal access, due to hacking, viruses, social engineering attacks, acts of violence, war or terrorism, and other causes. Unauthorized access to confidential information located or stored on these systems could negatively and materially impact our reputation, customers, employees, suppliers and other third parties. Such unauthorized access could be caused through, among other causes, failure to follow established policies and procedures on the part of our employees, agents, vendors, suppliers, contractors or other third parties. Further, third parties, including vendors, suppliers and contractors, who perform certain services for us or administer and maintain our networks and sensitive information, have been, and may in the future be, targets of cyber attacks and unauthorized access to their operational or information technology systems, and any cyber incident affecting our third-party business partners could significantly disrupt our operations. While we believe that we have appropriate security measures and safeguards to protect our operational and information technology systems, the recent cybersecurity incident that we experienced in October 2024 demonstrated that those protections alone may not prevent a cyber attack, and we cannot guarantee that such protections will be completely successful in preventing or mitigating a future cyber attack. The Company has completed its investigation into the scope, nature and impact of the cybersecurity incident and determined the incident did not have a material effect on the Company or its financial condition or results of operations; however, the Company remains subject to various risks as a result of this incident, including those related to litigation, governmental and regulatory scrutiny, including from putative class action lawsuits that have been filed in connection with the recent incident. See Item 3-Legal Proceedings-Cybersecurity Incident Class Action Lawsuits. Future cybersecurity events could cause our operations to be disrupted, property to be damaged, and customer and other confidential information to be lost or stolen; we could experience substantial loss of revenues, response costs and other financial loss; we would likely suffer a loss or redirection of management time, attention and resources from our regular business operations; we may be subject to increased regulatory requirements; our ability to comply with environmental standards and to continue to provide reliable service to our customers may be impacted; we would likely experience litigation and other claims against us; and we may suffer damage to our reputation, any of which could have a negative impact on our business, financial condition, results of operations and cash flows. Applicable laws and regulations or contracts may require us to report cybersecurity events or breaches of securely maintained confidential data, which may cause us to incur costs related to legal claims or proceedings and regulatory fines or penalties. These types of events, and their resulting impacts, either to our facilities or assets, those of third parties, or the industry in general, may also cause us to incur additional security and insurance related costs. In addition, in the ordinary course of business, we collect and retain sensitive information, including personally identifiable information, about our customers and employees. In many cases, we outsource administration of certain functions to vendors that have been and will continue to be targets of cyber attacks. Any theft, loss or fraudulent use of customer, employee or proprietary data as a result of a cyber attack on us or a vendor, supplier, contractor or other third-party business partner could also subject us to significant litigation, liability and costs, as well as adversely impact our reputation with customers and regulators, among others. We have obtained insurance to provide coverage for a portion of the losses and damages that may result from a physical attack, cyber attack or a security breach, but such insurance is subject to a number of exclusions and may not cover the total loss or damage caused by an attack or a breach. We have incurred, and may continue to incur, certain expenses related to the October 2024 cybersecurity incident, and we maintain a cybersecurity insurance policy as part of our overall insurance program. However, adequate insurance may not be available at rates that we believe are reasonable, and the costs of responding to and recovering from a physical attack, cyber attack or security breach incident may not, in whole or in part, be covered by insurance or recoverable in rates. See Item 1A-Risk Factors Risks Related to our Industry and Business Operations-We may sustain losses that exceed or are excluded from our insurance coverage or for which we are self-insured, below for more information.

Our business and operations have a large direct and indirect customer base and, as a result, we are exposed to public criticism regarding, among other things, the reliability of water service, wastewater and related or ancillary services, the quality of water provided, and the amount, timeliness, content, accuracy and format of bills that are provided for such services. Adverse publicity and negative consumer sentiment arising out of our operations may render legislatures and other governing bodies, PUCs and other regulatory authorities, and government officials less likely to view us in a favorable light, and may cause us to be susceptible to less favorable legislative, regulatory and economic outcomes, as well as increased regulatory investigations or other oversight and more stringent regulatory or economic requirements. Unfavorable regulatory and economic outcomes may include negative investigative conclusions and/or findings, the enactment of more stringent laws and regulations governing our operations and less favorable economic terms in our long-term contracts related to MSG, as well as fines, penalties or other sanctions or requirements. The imposition of any of the foregoing could have a material negative impact on us and our financial condition, results of operations and cash flows.

The performance of the capital markets affects the values of the assets that are held in trust to satisfy significant future obligations under our pension and postretirement benefit plans. The value of these assets is subject to market fluctuations and volatility, which may cause investment returns to fall below our projected return rates. A decline in the market value of our pension and postretirement benefit plan assets as of the measurement date or a change in the projection of the future return on plan assets can increase the funding requirements under our pension and postretirement benefit plans. Additionally, our pension and postretirement benefit plan liabilities are sensitive to changes in interest rates. Interest rates have experienced volatility and are subject to potential further adjustments based on the actions of the U.S. Federal Reserve, and others. If interest rates are lower at the current measurement date than the prior measurement date, our liabilities would increase, potentially increasing benefit expense and funding requirements. Further, changes in assumptions, such as increases in life expectancy assumptions and increasing trends in health care costs may also increase our funding requirements. Future increases in pension and other postretirement costs as a result of reduced plan assets may not be fully recoverable in rates, in which case our results of operations and financial position could be negatively affected. In addition, market factors can affect assumptions we use in determining funding requirements with respect to our pension and postretirement plans. For example, a relatively modest change in our assumptions regarding discount rates can materially affect our calculation of funding requirements. To the extent that the discount rate used in our assumptions is reduced, our benefit obligations could be materially increased, which could adversely affect our financial position, results of operations and cash flows.