Valvoline relies on its information technology systems, including systems which are managed or provided by third-party service providers, to conduct its business. The Company's point-of-sale platforms for company-operated and franchisee retail stores could be subject to cybersecurity threats, service outages, or data breaches, such as the July 2024 software update by CrowdStrike Holdings, Inc., a cybersecurity technology company, which caused a global information technology outage. This incident required temporary manual processes to maintain operations. Although it was brief and did not have a material impact to business, Valvoline's business was adversely impacted by the outage and slowed service. Similar software-induced interruptions or any security breach involving the point-of-sale or other systems within the Valvoline network could harm business operations, result in a loss of consumer confidence, or cause costs to be incurred associated with data recovery, investigation, remediation, and data breach notification obligations required under data privacy laws, which can be significant and vary by jurisdiction.
Despite employee training and other measures to mitigate them, cybersecurity threats to its information technology systems, and those of its third-party service providers, are increasing and becoming more advanced and cyber incidents have occurred and could occur as a result of unauthorized access, business email compromise, viruses, malicious code, ransomware, phishing, organized cyber-attacks, social engineering, break-ins, and security breaches due to error or misconduct by its employees, contractors or third-party service providers. The cyber incidents that have occurred have not resulted in a material loss to Valvoline; however, a material breach of or failure of Valvoline's information technology systems, including systems in which data is stored or may be transferred across third-party platforms, could lead to the loss and destruction of trade secrets, confidential information, proprietary data, intellectual property, customer and supplier data, and employee personal information, and could disrupt business operations which could adversely affect Valvoline's relationships with business partners and harm its brands, reputation and financial results.
Valvoline's customer and vendor data may include names, addresses, phone numbers, email addresses and payment account information, among other information. Depending on the nature of the data that is compromised, Valvoline may also have obligations to notify individuals, regulators, law enforcement or payment companies about the incident and may need to provide some form of remedy. Valvoline could also face fines and penalties should it fail to adequately notify affected parties pursuant to new and evolving privacy laws in various jurisdictions in which it does business, as outlined in greater detail in the "Regulatory, legal, and financial risks" section below.
Valvoline is continuing to expand, upgrade and develop its information technology capabilities, including, the Company's core ERP system. If the Company is unable to adequately transition its information technology organization's skills and capabilities rapidly enough, including the ability to capitalize on the advancements in Artificial Intelligence software and platforms, it may not effectively support the modernization of Valvoline's technology architecture and environment. This could hinder Valvoline's ability to keep pace with its growth and digital initiatives for the consumer-oriented, data driven, mobility enabled nature of the business. Consequently, this might inhibit Valvoline's ability to meet stakeholder needs and preferences.