HEALTHCARE SERVICES GROUP INC

Current report

Risks Related to Cybersecurity and Data Privacy

Current report

We have experienced cyber attacks and breaches, and may in the future experience cyber attacks and breaches which could cause operational disruptions, fraud or theft of sensitive information.

Current report

Aspects of our operations are reliant upon internet-based activities, such as ordering supplies and back-office functions such as accounting and transaction processing, making and accepting payments, processing payroll and other administrative functions. A significant disruption or failure of our information technology systems may have a significant impact on our operations, potentially resulting in service interruptions, security violations, regulatory compliance failures and other operational difficulties. In addition, any attack perpetrated against our information systems including through a system failure, security breach or disruption by malware or other damage, could similarly impact our operations and result in loss or misuse of information, litigation and potential liability. Further, like other companies, we have been subject to, and will continue to be subject to, cyber attacks and breaches and other vulnerabilities to data security incidents. For example, on October 9, 2024, we identified a cybersecurity incident, which involved unauthorized activity within some of our systems. The incident has not caused, and is not expected to cause, disruption of our business operations, although there can be no assurance thereof.

Current report

Although we have taken steps intended to mitigate the risks presented by potential cyber incidents, it is not possible to protect against every potential power loss, telecommunications failure, cybersecurity attack, data breach or similar event that may arise. Moreover, the safeguards we use are subject to human implementation and maintenance, technology evolutions and to other uncertainties. Any of these cyber incidents may result in a violation of applicable laws or regulations (including privacy and other laws), damage our reputation, cause a loss of customers and give rise to monetary fines and other penalties, which all could have an adverse effect on our financial condition, results of operations and liquidity.

Current report

While we maintain insurance coverage that may, subject to policy terms and conditions including deductibles, cover specific aspects of cyber risks, such insurance coverage may be insufficient to cover all losses. Third parties to whom we outsource certain of our functions are also subject to the risks outlined above. We review and assess the cybersecurity controls of our third-party service providers and vendors, as appropriate, and make changes to our business processes to manage these risks. Data breaches of such third parties could have an adverse effect on our financial condition, results of operations and liquidity.