PG&E Corp

The Utility’s operational networks and information technology systems could be impacted by a cyber incident, cybersecurity breach, or physical attack.

The Utility’s electricity and natural gas systems rely on a complex, interconnected network of generation, transmission, distribution, control, and communication technologies, which can be damaged by natural events such as severe weather or seismic events and by malicious events, such as physical and cyber attacks. Nationally, there has been an increase in physical attacks on substations. Physical attacks targeting the Utility’s physical assets or personnel could cause damage, disrupt operations, or cause injuries. Cyber attacks targeting utility systems are significant and are continuing to increase in sophistication, magnitude, and frequency. Any failure, interruption, or decrease in the functionality of the Utility’s operational networks could cause harm to the public or employees, significantly disrupt operations, negatively impact the Utility’s ability to safely generate, transport, deliver and store energy and gas or otherwise operate in a safe and efficient manner or at all, and damage the Utility’s assets or operations or those of third parties.

The Utility also relies on complex information technology systems that allow it to create, collect, use, disclose, store, and otherwise process sensitive information, including the Utility’s financial information, customer energy usage and billing information, and personal information regarding customers, employees and their dependents, contractors, and other individuals, and portions of such sensitive information may be required to be encrypted by the Utility. In addition, the Utility is increasingly being required to disclose large amounts of data (including customer energy usage and personal information regarding customers) to support changes to California’s electricity market related to grid modernization and customer choice. The Utility often relies on third-party vendors to host, maintain, modify, and update its systems (including providing security updates), and to provide other services to the Utility or the Utility’s customers. These third-party vendors could cease to exist, fail to adopt and implement adequate processes to protect the Utility’s systems and information, fail to provide timely software updates (and even if timely provided, there could be a delay in the installation of the updates), fail to detect security vulnerabilities, or experience security incidents or inadequate security measures. Any such incidents or disruptions in the Utility’s information technology systems could impact the Utility’s ability to track or collect revenues and to maintain effective internal controls over financial reporting.

PG&E Corporation and the Utility face various cybersecurity threats, including attempts to gain unauthorized access to their systems and networks, denial-of-service attacks, threats to their information technology infrastructure, ransomware and phishing attacks, and attempts to gain unauthorized access to confidential or sensitive information about the Utility, customers and employees. These threats come from a variety of highly organized actors, including nation-state actors. PG&E Corporation, the Utility and their third-party vendors have been subject to, and will likely continue to be subject to, threats, breaches and attempts to gain unauthorized access to the Utility’s information technology systems or confidential or sensitive data (including information about customers and employees), or to disrupt the Utility’s operations. Additionally, artificial intelligence, including generative artificial intelligence, may be used to facilitate or perpetrate these cybersecurity threats, and PG&E Corporation’s and the Utility’s use of generative artificial intelligence (and use by their vendors and agents) may subject them to data privacy, legal, and security risks. The Utility may not be able to prevent unauthorized access to its operational networks, information technology systems or data, or the disruption of its operations. Such events could subject the Utility to significant expenses, claims by customers or third parties, government inquiries, penalties for violation of applicable privacy laws, investigations, lawsuits, and regulatory actions and could result in material fines, penalties, loss of customers, and harm to PG&E Corporation’s and the Utility’s reputation, any of which could have a material effect on PG&E Corporation’s and the Utility’s business strategy, financial condition, or results of operations. For more information, see Item 1C. Cybersecurity.

The Utility maintains cyber liability insurance that covers certain losses and damages caused by cyber incidents, but adequate insurance may not continue to be available at rates the Utility believes are reasonable, or the costs of responding to and recovering from a cyber incident may not be covered by insurance or recoverable through rates.