Cybersecurity threats to the energy market infrastructure are increasing in sophistication, magnitude and frequency, particularly with the regularity of virtual operations. Because of the inherent vulnerability of infrastructure and technology and operational systems to disability or failure due to hacking, viruses, malicious or destructive code, phishing and other social engineering attacks, denial of service attacks, ransomware, acts of war or terrorism, or other cybersecurity incidents, we face increased risk of cyberattack. We rely on information and operational technology systems and network infrastructure to operate our generation and T&D systems. We also store sensitive data, intellectual property and proprietary or personally identifiable information regarding our business, infrastructure, employees, shareholders, customers and vendors on our IT systems and conduct power marketing and hedging activities. In addition, the operation of our business is dependent upon the IT systems of third parties, including our vendors, regulators, RTOs and ISOs, among others. Our and third-party operational and IT systems and products may be vulnerable to cybersecurity attacks involving fraud, malice or oversight on the part of our employees, other insiders or third parties, whether domestic or foreign sources. Further, new types of cyberattacks, whether directed at our own infrastructure and technology and operational systems or that of third parties, may be generated or enhanced through the use of Artificial Intelligence (AI). A successful cybersecurity attack may result in unauthorized use of our systems to cause disruptions at a third party. Cybersecurity risks to our operations include:
- disruption of the operation of our assets, the fuel supply chain, the power grid and gas T&D,- theft of confidential company, employee, shareholder, vendor or customer information, and critical energy infrastructure information, which may cause us to be in breach of certain covenants and contractual or legal obligations and pose risk to our system and our customers,- general business system and process interruption or compromise, including preventing us from servicing our customers, collecting revenues or the ability to record, process and/or report financial information correctly, and - breaches of vendors' infrastructures where our confidential information is stored.
We and our third-party vendors have been and will continue to be subject to cybersecurity attacks, including but not limited to ransomware, denial of service, business email compromises, and malware attacks. To date, there has been no material impact or reasonably likely material impact on our business strategy, results of operations or financial condition from these attacks or other cybersecurity incidents, including as a result of prior cybersecurity incidents. However, we may be unable to prevent all such attacks in the future from having such a material impact as such attacks continue to increase in sophistication and frequency. If a significant cybersecurity event or breach occurs within our company or with one of our material vendors, we could be exposed to significant loss of revenue, material repair costs to intellectual and physical property, significant fines and penalties if determined that we were in non-compliance with existing laws and regulations, significant litigation costs, increased costs to finance our businesses, negative publicity, damage to our reputation and loss of confidence from our customers, regulators, investors, vendors and employees. The misappropriation, corruption or loss of personally identifiable information and other confidential data from us or one of our vendors could lead to significant breach notification expenses, mitigation expenses such as credit monitoring, and legal and regulatory fines and penalties. Moreover, new or updated security laws or regulations, including laws and regulations that respond to evolving application of AI, or unforeseen threat sources could require changes in current measures taken by us and our business operations, which could result in increased costs and adversely affect our financial statements. Similarly, a significant cybersecurity event or breach experienced by a competitor, regulatory authority, RTO, ISO, or vendor could also materially impact our business and results of operations via enhanced legal and regulatory requirements. The amount and scope of insurance we maintain against losses that result from cybersecurity incidents may not be sufficient to cover losses or adequately compensate for resulting business disruptions. For a discussion of state and federal cybersecurity regulatory requirements and information regarding our cybersecurity program, see Item 1C. Cybersecurity.