PENNANTPARK INVESTMENT CORP

Current report

We are subject to risks associated with cybersecurity and cyber incidents.

Current report

Our internal computer systems and infrastructure and those of our Investment Adviser, strategic collaborators, vendors, contractors, consultants or regulators with whom we share confidential, protected or sensitive data or information, or upon which our business relies, are vulnerable to damage from computer viruses, unauthorized access, misuse, natural disasters, terrorism, cybersecurity threats, war and telecommunication and electrical failures, as well as security compromises or breaches, which may compromise our systems, infrastructure, data or that of those with whom we share such data or information or upon which our business relies, or lead to data compromise, misuse, misappropriation or leakage. We may experience, and from time to time have experienced, cyber attacks on our information technology systems and infrastructure by threat actors of all types (including nation states, criminal enterprises, individual actors or advanced persistent threat groups, among others). In addition to extracting sensitive information, such attacks could include the deployment of harmful malware, ransomware, digital extortion, business email compromises and denial-of-service attacks, social engineering (including phishing attacks) and other means to affect server reliability and threaten the confidentiality, integrity and availability of information, systems or infrastructure.

Current report

As our reliance on technology has increased, so have the risks posed to our information systems, both internal and those provided by our Investment Adviser and other third-parties. We, along with our Investment Adviser, have implemented processes, procedures and internal controls to help mitigate cybersecurity risks and cyber-attacks, but these measures, as well as our increased awareness of the nature and extent of the risk of a cyber attack, may be ineffective and do not guarantee that a cyber attack will not occur or that our financial results, operations or confidential information will not be negatively impacted by such an attack. Further, our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages or claims related to our privacy and data security obligations. Further, although we maintain cyber liability insurance, this insurance may not provide adequate coverage against potential liabilities related to any experienced cybersecurity attack or breach.

Current report

Furthermore, cybersecurity continues to be a priority for regulators around the world, and some jurisdictions have enacted laws requiring companies to notify individuals and/or regulators of data security breaches involving certain types of personal information. If we fail to comply with the relevant laws and regulations, we could suffer financial losses, a disruption of our businesses, liability to investors, regulatory intervention or reputational damage.