New York Times (NYT) Risk Analysis

Our operations depend on our ability to protect our information systems against interruption, breach or other damage. Our systems store and process confidential subscriber, user, employee and other sensitive personal and Company data. In addition, we rely on the technology, systems and services provided by third-party vendors (including cloud-based service providers) for a variety of operations, including encryption and authentication technology, employee email, domain name registration, content delivery, administrative functions (including payroll processing and certain finance and accounting functions) and other operations. We regularly face attempts to breach our security and compromise our information technology systems from a broad range of actors. These actors, whether internal or external to the Company, may use a blend of technology and social engineering techniques (including denial of service attacks, ransomware, phishing or business email compromise attempts intended to induce our employees, business affiliates and users to disclose information or unwittingly provide access to systems or data, and other techniques) to disrupt service, exfiltrate data or otherwise interfere with our business. Information security threats are constantly evolving in sophistication and volume and attackers may use generative AI and machine learning to launch more automated, targeted, sophisticated and coordinated attacks against targets, potentially increasing the difficulty of detecting and successfully defending against them. A successful breach could occur and persist for an extended period of time before being detected. We and the third parties with which we work may be more vulnerable to the risk from activities of this nature as a result of factors such as the high-profile nature of the Company's business operations and the various jurisdictions in which we and our third-party providers operate; the use of generative AI tools; remote and hybrid working; employee use of personal devices, which may not have the same level of protection as Company devices and networks; and use of legacy software systems. Cybersecurity vulnerabilities can also arise from human error, fraud or malice on the part of our employees, other insiders or third parties, or from technology or product enhancements or the migration of information and data to new technology platforms, systems or applications. From time to time, we experience security incidents and other network and information systems disruptions. To date, no incidents have had a material adverse effect on our business, financial condition or results of operations. However, there is no assurance that incidents or disruptions will not have a material adverse effect in the future. There is also no guarantee that a series of related issues may not be determined to be material at a later date in the aggregate, even if they may not be material individually at the time of their occurrence. In addition, our systems, and those of the third parties with which we work and on which we rely, may be vulnerable to interruption or damage that can result from the effects of power, systems or connectivity outages; natural disasters (including increased storm severity and flooding), which may occur more frequently or with more severity as a result of climate change; fires; human error, fraud or malice; public health conditions; acts of terrorism; or other similar events. We have implemented controls and taken other preventative measures designed to strengthen our systems and to improve the resiliency of our business against such incidents and attacks, including measures designed to reduce the impact of a security incident at our third-party vendors. These efforts are expensive to develop, implement and maintain; require ongoing monitoring and updating as technologies change and as efforts to overcome security measures become more sophisticated; and may limit the functionality of or otherwise negatively impact our products, services and systems. Although the costs of the controls and other measures we have taken to date have not had a material effect on our financial condition, results of operations or liquidity, the costs and effort to respond to and recover from a security incident and/or to mitigate any security vulnerabilities that may be identified in the future could be significant. Additionally, any contractual protections with our third-party vendors, including our right to indemnification, if any at all, may be limited or insufficient to prevent a negative impact on our business from a security incident. There can also be no assurance that the actions, measures and controls we have implemented will be effective or that they will be sufficient to prevent a future security incident or other disruption, and our disaster recovery planning cannot account for all eventualities. Such an event could result in a disruption of our services; improper access, use, alteration or disclosure of personal data or other confidential information; loss of information; or theft or misuse of our intellectual property. In addition, if we experience or are perceived to experience a security incident, or are perceived to fail to respond appropriately to any security incident that we may experience, it could divert management's attention; require us to expend resources to investigate, respond to and recover from such a security incident or defend against further attacks; subject us to litigation, regulatory or other government inquiries or investigations and/or liability; harm our reputation; or otherwise adversely affect our business, financial condition or results of operations. While we maintain cyber risk insurance, the costs relating to certain kinds of security incidents could be substantial, and our insurance may not be sufficient to cover losses related to any future incidents involving our data or systems, and we cannot be certain our insurance coverage will continue to be available to us on commercially reasonable terms (if at all) or that any insurer will not deny coverage as to any future claim.