BRANDYWINE REALTY TRUST

Previous report

We have experienced, and may again experience a, data security breach that may cause damage to our business and reputation.

Previous report

In the ordinary course of our business, we maintain sensitive data, including our proprietary financial information, business information and the information of our tenants and business partners, in our data centers and on our networks. Security breaches or disruptions, mainly through cyber-attack or cyber intrusion, including by computer hackers, foreign governments and cyber terrorists, have generally increased in number, intensity and sophistication. Notwithstanding the security measures undertaken, our information technology has been, and may in the future be, vulnerable to attacks or breaches. One such event occurred on May 1, 2024 when we detected unauthorized occurrences by a third party on portions of our information technology systems that consisted of the third party’s unauthorized access to, and deployment of encryption to, a portion of our internal corporation information technology systems and the exfiltration of certain files, including files containing personal information. There can be no assurance that our security efforts and measures will be effective or that attempted security breaches or disruptions would not be successful or damaging. Protected information, networks, systems and facilities remain vulnerable because the techniques used in such attempted security breaches evolve and may not be recognized or detected until launched against a target. Accordingly, we may be unable to anticipate these techniques or implement adequate security barriers or other preventative measures.

Previous report

Data security breaches, including the one noted above, have in the past, and may in the future, result in one or more of the following harms:

Previous report

•disrupt the proper functioning of our networks and systems and therefore our operations and/or those of our tenants;

Previous report

•subject us to claims and lawsuits for breach of contract, damages, credits, penalties, or other agreements; and/or

Previous report

While we maintain insurance coverage that may, subject to policy terms and conditions including deductibles, cover specific aspects of cyber risks, such insurance coverage may be insufficient to cover all losses.

Previous report

Third parties to whom we outsource certain of our functions are also subject to the risks outlined above. We review and assess the cybersecurity controls of our third-party service providers and vendors, as appropriate, and make changes to our business processes to manage these risks. Data breaches and/or the insolvency of such third parties and vendors may result in us incurring costs and may have other negative consequences.