HALLIBURTON CO

The statements in this section describe the known material risks to our business and should be considered carefully. The risk factor below updates our risk factors previously disclosed in our Annual Report on Form 10-K for the fiscal year ended December 31, 2023.

Our operations are subject to cyberattacks that could have a material adverse effect on our business, consolidated results of operations, and consolidated financial condition.

We are increasingly dependent on digital technologies and services to conduct our business. We use these technologies for internal and operational purposes, including data storage, processing, and transmissions, as well as in our interactions with customers and suppliers. Examples of these digital technologies include analytics, automation, and cloud services. Our digital technologies and services, and those of our customers and suppliers, are subject to the risk of cybersecurity incidents and, given the nature of such incidents, some can remain undetected for a period of time despite efforts to detect and respond to them in a timely manner. We routinely monitor our systems for cybersecurity threats and have processes in place to detect and remediate vulnerabilities. Nevertheless, we have experienced cybersecurity incidents and attempted breaches in the past, one of which resulted in an unauthorized third party gaining access to certain of our systems and exfiltrating information from those systems, which we previously disclosed in Form 8-Ks we filed with the Securities and Exchange Commission on August 23, 2024 and September 3, 2024. The incident caused disruptions and limitation of access to portions of our business applications supporting aspects of our operations and corporate functions, required us to incur significant costs, and required a significant amount of attention from management and our work force. We continue to face risks from potential litigation and regulatory actions related to this incident and may discover other impacts or new events, which may occur that could affect our business, reputation, consolidated results of operations, or consolidated financial condition.

Even if we successfully defend our own digital technologies and services, we also rely on our customers and suppliers, with whom we may share data and services, to protect their digital technologies and services from cybersecurity incidents.

If our systems, or our customers’ or suppliers’ systems, for protecting against cybersecurity incidents prove not to be sufficient, we could be adversely affected by, among other things: loss of or damage to intellectual property, proprietary or confidential information, or customer, supplier, or employee data; interruption of our business operations; and increased costs required to prevent, respond to, or mitigate cybersecurity incidents. These risks could harm our reputation and our relationships with our customers, employees, suppliers and other third parties, and may result in claims against us. In addition, laws and regulations governing cybersecurity incidents, data privacy, and the unauthorized disclosure of confidential or protected information pose increasingly complex compliance challenges, and failure to comply with these laws could result in penalties and legal liability. These risks could have a material adverse effect on our business, consolidated results of operations, and consolidated financial condition.