Gannett (GCI) Risk Factors

We made an election in 2017 to treat one of our international subsidiaries as a disregarded entity for U.S. federal income tax purposes, which resulted in worthless stock and bad debt deductions of $100.9 million, yielding a tax benefit of $32.5 million. The Internal Revenue Service ("IRS") is auditing these tax deductions, and as such, the audit could result in the reversal of all or part of the income tax benefit. To account for this uncertainty, a reserve of $11.3 million was established to reduce the benefit to an estimated realizable value of $21.2 million. While we believe this represents our best estimate of the benefit to be realized upon final acceptance of our tax return, the IRS could reject or reduce the amount of tax benefit related to these deductions. If the IRS rejects or reduces the amount of this income tax benefit, we may have to pay additional cash income taxes, which could materially and adversely affect our results of operations, financial condition, and cash flows. We cannot guarantee what the ultimate outcome or amount of the benefit we receive, if any, will be.

Our information systems, both online and on-premise, store and process confidential subscriber and other user data, such as names, email addresses, phone numbers, addresses, and other personal information. Therefore, maintaining our network and identity security is critical. In addition, we rely on the technology, systems, and services provided by third-party vendors and outsourced service providers (including cloud-based service providers) for a variety of operations, including encryption and authentication technology, employee email, domain name registration, content delivery to customers, administrative functions (including payroll processing and certain finance and accounting functions), technology functions (including application development and technology support functions) and other operations. We regularly face risks related to cybersecurity incidents and threats, including attempts by malicious actors, which may be external or internal threat actors, to breach our security and compromise our information technology systems. Because we are a news reporting organization, these risks also include attempts by attackers to manipulate or misrepresent our news reporting. Attackers may use a blend of technology and social engineering techniques (including denial of service attacks, phishing attempts intended to induce our employees and users to disclose information or unwittingly provide access to systems or data, and other techniques) to disrupt service or exfiltrate data. Cybersecurity incidents and threats are constantly evolving, increasing the difficulty of detecting and successfully defending against them. We and the third parties with which we work may be more vulnerable to the risk from activities of this nature as a result of operational changes such as significant increases in remote work. To date, no cybersecurity incidents or threats have had, either individually or in the aggregate, a material adverse effect on our business, financial condition, or results of operations. In addition, our systems, and those of the third parties with which we work and on which we rely, may be vulnerable to interruption or damage that can result from the effects of natural disasters or climate change (such as increased storm severity and flooding); fires; power, systems or internet outages; acts of terrorism; pandemics; or other similar events. We have implemented controls and taken other preventative measures designed to strengthen our systems against such cybersecurity incidents and threats, including measures designed to reduce the impact of a security breach at our third-party vendors and outsourced service providers. Efforts to prevent hackers from disrupting our service or otherwise accessing our systems are expensive to develop, implement and maintain. These efforts require ongoing monitoring and updating as technologies change and efforts to overcome security measures become more sophisticated and may limit the functionality of or otherwise negatively impact our products, services, and systems. Although the costs of the controls and other measures we have taken to date have not had a material effect on our financial condition, results of operations or liquidity, the costs and effort to respond to a cybersecurity incident or threat and/or to mitigate any security vulnerabilities that may be identified in the future could be significant. Additionally, we depend on the security of our third-party service providers and business partners. Unauthorized use of or inappropriate access to our, or our third-party service providers' or business partners' networks, computer systems and services could potentially jeopardize the security of confidential information of our customers or users, including payment card (credit or debit) information. Because the techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently and often are not recognized until launched against a target, we or our third-party service providers or business partners may be unable to anticipate these techniques or to implement adequate preventative measures. Non-technical means, such as actions or omissions by an employee or contractor, can also result in a data breach or other cybersecurity incident. A party that is able to circumvent our security measures could misappropriate our proprietary information or the information of our vendors, business partners, customers or users, cause interruption in our operations, or damage our computers or those of our vendors, business partners, customers or users. As a result of any such breaches or incidents, vendors, business partners, customers, users or other third parties may assert claims of liability against us and these activities may subject us to governmental fines or penalties, legal claims, adversely impact our reputation, and interfere with our ability to provide our products and services, all of which may have an adverse effect on our business, financial condition, and results of operations. The coverage and limits of our insurance policies may not be adequate to reimburse us for losses caused by security breaches or other cybersecurity incidents. A significant number of our customers authorize us to bill their payment card accounts directly for all amounts charged by us. These customers provide payment card information and other personally identifiable information which, depending on the particular payment plan, may be maintained to facilitate future payment card transactions. Under payment card rules and our contracts with our card processors, if there is a breach of payment card information that we store, we could be liable to the banks that issue the payment cards for their related expenses and penalties. In addition, if we fail to follow payment card industry data security standards, even if there is no compromise of customer information, we could incur significant fines or lose our ability to give our customers the option of using payment cards. If we were unable to accept payment cards, our business would be seriously harmed. There can be no assurance that any security measures we, or our third-party service providers, take will be effective in preventing a data breach. We may need to expend significant resources to protect against security breaches or to address problems caused by breaches. If an actual or perceived breach of our security occurs, the perception of the effectiveness of our security measures could be harmed and we could lose customers or users. Failure to protect confidential customer data or to provide customers with adequate notice of our privacy policies could also subject us to liabilities imposed by international or United States federal and state regulatory agencies or courts. We could also be subject to evolving international, federal and state laws that impose data breach notification requirements, specific data security obligations, or other customer privacy-related requirements. Our failure to comply with any of these laws or regulations may have an adverse effect on our business, financial condition, and results of operations.

In recent years, we have experienced significant increases in the cost of employee benefits because of economic factors beyond our control, including increases in health care costs. Some of these factors may continue to put upward pressure on the cost of providing medical benefits. Although we have actively sought to control increases in these costs, there can be no assurance that we will succeed in limiting cost increases and continued upward pressure could reduce the profitability of our businesses.

Our DMS segment substantially utilizes online media acquired from third parties, particularly Google, Facebook, and Microsoft, which account for a large majority of all U.S. internet searches and traffic. These companies, and the other companies with which we do business, have no obligation to conduct business with us, and may decide at any time and for any reason to significantly curtail or inhibit our ability to do business with them. Additionally, any of these companies may make significant changes to their respective business models, policies, systems, plans or ownership, and those changes could impair or inhibit the manner in which they sell their advertising units or otherwise conduct their business with us. For example, new privacy controls and tracking transparency frameworks that have been implemented or may be implemented in the future, by platforms such as Facebook, Google, and Apple would limit our ability to access and use data from consumers through those platforms, which we rely on for digital advertising and marketing. Any such controls or transparency frameworks may impair our ability to market to consumers. Any new developments or rumors of developments regarding business practices at companies that affect the online advertising industry may materially and adversely affect our products or services, or create perceptions with our clients that our ability to compete in the online marketing industry has been impaired.