CARRIAGE SERVICES INC
For the period ended Dec 31, 2025. Filed Feb 26, 2026.
View on SEC.govAbout this filing
A company's yearly report to the SEC, with audited financial statements. It is the fullest account a company gives of its business, its finances and the risks it sees.
FY2025 · Filed Feb 26, 2026
What changed in Risk Factors?
Read the current filingPrevious report: 10-K
Period ended 2024-12-31; filed 2025-02-28.
0001016281-25-000045
Item 1A. Risk FactorsCurrent report: 10-K
Period ended 2025-12-31; filed 2026-02-26.
0001016281-26-000021
Item 1A. Risk FactorsThe baseline is this issuer’s latest earlier reporting period of the same form that was filed before the current report. A previous 10-Q is a different quarter, not a year-over-year comparison. Amendments are excluded.
Compared 107 previous paragraphs and 110 current paragraphs.
88 unchanged; 17 reworded; 5 added; 2 removed; 0 previous and 0 current paragraphs rearranged.
Tables are not compared: 1 previous and 1 current tables excluded. Dates, whitespace, punctuation and numbering changes are ignored; changes to financial figures remain significant.
A changed paragraph is not evidence that risk increased or decreased. An unchanged paragraph does not establish that risk stayed the same.
Added paragraphs (5)
Current report
For example, on July 4, 2025, the One Big Beautiful Bill Act (“OBBBA”) was signed into law. The OBBBA made several key provisions of the Tax Cuts and Jobs Act of 2017 permanent, including 100% bonus depreciation, the immediate expensing of domestic research costs, and the introduction of a favorable modification to the business interest expense limitation. Together, these changes accelerate the timing of certain tax deductions in the current period that allow for reductions in cash taxes. The Company adopted the relevant provisions during the third quarter of 2025 and determined that the OBBBA did not have a material effect on the Company's financial statements.
Current report
We rely significantly on information technology systems, software, or information security practices and those of our business partners or third-party providers, and any failure, inadequacy, interruption or security lapse of that technology, including any cybersecurity incidents or our actual or perceived failure to comply with any related regulatory requirements, could lead to adverse business consequences.
Current report
We have incorporated, and may continue incorporating, traditional and generative artificial intelligence (“AI”) solutions into certain of our information systems and operations with the intent to enhance efficiency and effectiveness, and these solutions may become important in our operations over time. For example, we have incorporated AI and generative AI to automate certain manual administrative processes and increase productivity within our sale terms. The continued evolution and use of this technology, including cloud-based computing and AI, creates opportunities for the potential loss or misuse of personal data that was collected, used, stored, or transferred in our business operations and systems, and flaws, breaches or malfunctions in these systems could lead to operational disruptions, data loss, including for example unintentional dissemination or intentional destruction of confidential information stored in our or our third party providers’ systems, or erroneous decision-making, which may result in significantly increased business and security costs, reputational damage, administrative penalties, or costs related to defending legal claims. AI technologies may be costly and require significant resources to either license from third-parties or develop, which may be difficult to integrate, launch, and manage, if at all, and require periodic upgrades. There is also a risk that we may not have access to technology or qualified personnel resources to adequately incorporate or adopt ongoing advancements into any AI technologies, including access to the licensing of key intellectual property from third parties. Our competitors or other third parties may incorporate AI into their products more quickly or more successfully than us, which could impair our ability to compete effectively and adversely affect our results of operations. The legal and regulatory landscape and industry standards surrounding AI technologies are rapidly evolving and remains uncertain, and compliance may impose significant operational costs and may limit our ability or require significant resources to develop, deploy, use or maintain AI technologies.
Current report
In addition, our information technology systems require an ongoing commitment of significant resources to maintain, protect, and enhance existing systems and develop new systems. This enables us to keep pace with continuing changes in information processing technology, evolving legal and regulatory standards, the increasing need to protect employee and customer information, changes in the techniques used to obtain unauthorized access to data and information systems, and the information technology needs associated with our evolving products. There can be no assurance that our efforts (including, but not limited to, consolidating, protecting, upgrading, and expanding our systems and capabilities, continuing to build security into the design of our products, and developing new systems to keep pace with continuing changes in information processing technology, including, but not limited to, AI technologies) will be successful or that additional systems issues will not arise in the future. For additional information regarding the Company’s cybersecurity risk management, strategy, and governance, refer to Item 1C. Cybersecurity.
Removed paragraphs (2)
Previous report
For example, on August 16, 2022, the Inflation Reduction Act of 2022 (the “IRA”) was signed into law which includes a tax and spending package that introduced several tax-related provisions, including a 15% corporate alternative minimum tax on corporations that have an average of $1 billion adjusted financial statement income over a consecutive three-year period and a 1% excise tax on certain corporate stock repurchases. The impact of these provisions became effective for our Company beginning on January 1, 2023. We have reviewed and assessed the provisions of the IRA, and we do not currently believe that the IRA will have a material impact on our business, operating results, and financial condition. We will continue to evaluate the impact of the IRA, along with any other new or revised tax laws or regulations, as such information becomes available.
Reworded paragraphs (17)
Previous wording
We have implemented our Standards Operating Model to improve and better measure performance in our funeral and cemetery operations. We developed these standards, which are updated from time to time, according to criteria, each with a different weighting, designed around market share, high-value services and operational and financial metrics. We also incentivize our Managing Partners by giving them the opportunity to earn a fixed percentage of the field-level earnings before interest, taxes, depreciation and amortization based upon the number and weighting of the standards achieved. Our expectation is that, over time, the Standards Operating Model will result in improving field-level margins, market share, customer satisfaction and overall financial performance, but there is no assurance that these goals will be met. Failure to successfully implement our Standards Operating Model in our funeral and cemetery operations could have a material adverse effect on our financial condition, results of operations and cash flows.
Current wording
We have implemented our Standards Operating Model to improve and better measure performance in our funeral and cemetery operations. We developed these standards, which are updated from time to time, according to criteria, each with a different weighting, designed around market share, high-value services and operational and financial metrics. We also incentivize our Managing Partners by giving them the opportunity to earn a fixed percentage of the field-level earnings before interest, taxes, depreciation and amortization based upon the number and weighting of the standards achieved. Our expectation is that, over time, the Standards Operating Model will result in improved field-level margins, market share, customer satisfaction and overall financial performance, but there is no assurance that these goals will be met. Failure to successfully implement our Standards Operating Model in our funeral and cemetery operations could have a material adverse effect on our financial condition, results of operations, and cash flows.
Previous wording
There is no assurance that we will be able to continue to identify acquisition candidates that meet our criteria or that we will be able to reach terms with identified candidates for transactions that are acceptable to us, and even if we do, we may not be able to successfully complete the transaction or integrate the new business into our existing business. We intend to apply standards established under our strategic acquisition framework to evaluate acquisition candidates, and there is no assurance that we will continue to be successful in doing so or that we will find attractive candidates that satisfy these standards. Due in part to the presence of competitors who have been in certain markets longer than we have, such acquisitions or investments may be more difficult or expensive than we anticipate.
Current wording
There is no assurance that we will be able to continue to identify acquisition candidates that meet our criteria or that we will be able to reach terms with identified candidates for transactions that are acceptable to us, and even if we do, we may not be able to close the transaction or successfully integrate the new business into our existing portfolio.
Previous wording
As part of our growth strategy, we periodically review our businesses which may no longer be aligned with our strategic business plan and long-term objectives and, as a result of these reviews of our businesses, we may pursue additional divestitures. From time to time, we engage in discussions with third parties about potential divestitures of one or more of our businesses that, if fully consummated, could result in the divestiture of a material amount of assets and contribution to our results of operations that have historically contributed to our results of operations. Divestitures pose risks and challenges that could negatively impact our business, including disputes with buyers or potential impairment charges. For example, when we decide to sell a business, we may be unable to do so on our terms and within our anticipated time-frame, and even after reaching a definitive agreement to sell a business, the sale may be subject to satisfaction of pre-closing conditions, which may not be satisfied, as well as regulatory and governmental approvals, which may prevent us from completing a transaction on acceptable terms. If we do not realize the expected benefits of any divestiture transaction, our financial condition, results of operations, and cash flows could be materially adversely affected.
Current wording
As part of our growth strategy, we periodically review our businesses which may no longer be aligned with our strategic business plan and long-term objectives and, as a result of these reviews of our businesses, we may pursue additional divestitures. From time to time, we engage in discussions with third parties about potential divestitures of one or more of our businesses that, if fully consummated, could result in the divestiture of a material amount of assets that have historically contributed to our results of operations. Divestitures pose risks and challenges that could negatively impact our business, including disputes with buyers or potential impairment charges. For example, when we decide to sell a business, we may be unable to do so on our terms and within our anticipated time-frame, and even after reaching a definitive agreement to sell a business, the sale may be subject to satisfaction of pre-closing conditions, which may not be satisfied, as well as regulatory and governmental approvals, which may prevent us from completing a transaction on acceptable terms. If we do not realize the expected benefits of any divestiture transaction, our financial condition, results of operations, and cash flows could be materially adversely affected.
Previous wording
The funeral and cemetery industry is characterized by a large number of locally owned, independent operations in the United States and a large number of operations owned by publicly and privately held funeral home and cemetery consolidators. To compete successfully, our funeral service locations and cemeteries must maintain good reputations and high professional standards, as well as offer attractive products and services at competitive prices. In addition, we must market ourselves in such a manner as to distinguish us from our competitors. We have historically experienced price competition from independent and publicly held funeral service and cemetery operators, monument dealers, casket retailers, low-cost providers, and other nontraditional providers of merchandise and services. If we are unable to successfully compete, our financial condition, results of operations, and cash flows could be materially adversely affected.
Current wording
The funeral and cemetery industry is characterized by a large number of locally owned, independent operations in the U.S. and a large number of operations owned by publicly and privately held funeral home and cemetery consolidators. To compete successfully, our funeral service locations and cemeteries must maintain good reputations and high professional standards, as well as offer attractive products and services at competitive prices. In addition, we must market ourselves in such a manner as to distinguish us from our competitors. We have historically experienced price competition from independent and publicly held funeral service and cemetery operators, monument dealers, casket retailers, low-cost providers, and other nontraditional providers of merchandise and services. If we are unable to successfully compete, our financial condition, results of operations, and cash flows could be materially adversely affected.
Previous wording
Increasing death benefits related to preneed funeral contracts funded through life insurance contracts may not cover future increases in the cost of providing a price-guaranteed funeral service.
Current wording
Increasing death benefits related to preneed funeral contracts funded through life insurance policies may not cover future increases in the cost of providing a price-guaranteed funeral service.
Previous wording
We sell price-guaranteed preneed funeral contracts through various programs providing for future funeral services at prices prevailing when the agreements are signed. For preneed funeral contracts funded through life insurance contracts, we receive in cash a general agency commission from the third-party insurance company. Additionally, there is an increasing death benefit associated with the contract that may vary over the contract life. There is no guarantee that the increasing death benefit will cover future increases in the cost of providing a price-guaranteed funeral service, and any such excess cost could be materially adverse to our future cash flows, revenue, and operating margins.
Current wording
We sell price-guaranteed preneed funeral contracts through various programs providing for future funeral services at prices prevailing when the agreements are signed. For preneed funeral contracts funded through life insurance policies, we receive in cash a general agency commission from the third-party insurance company. Additionally, there is an increasing death benefit associated with the contract that may vary over the contract life. There is no guarantee that the increasing death benefit will cover future increases in the cost of providing a price-guaranteed funeral service, and any such excess cost could be materially adverse to our future cash flows, revenue, and operating margins.
Previous wording
We make judgments regarding the utilization of existing income tax credits and the potential tax effects of various financial transactions and results of operations to estimate our obligations to taxing authorities. We are also subject to regular reviews, examinations, and audits by the Internal Revenue Service (“IRS”) and other taxing authorities with respect to our taxes. Uncertain tax positions may arise where tax laws or regulations may allow for alternative interpretations, where the timing of recognition of income is subject to judgement, or where the IRS or other taxing authorities issue subsequent guidance or take positions on audits that differ from our interpretations and assumptions. Our tax obligations include, for example, income, franchise, real estate, sales and use, and employment-related taxes and the judgments we make include reserves for potential adverse outcomes regarding our tax positions. Although we believe we have accurately estimated our tax obligations, uncertainty of interpretation by various tax authorities and the possibility that there are issues that have not been recognized by management could each result in additional tax obligations. For example, if a taxing authority disagrees with the positions we have taken, we could face additional tax liability, including interest and penalties. We believe that our tax obligations reflect the anticipated outcome of known uncertain tax positions in conformity with ASC Topic 740 Income Taxes. In addition, our effective tax rate could be adversely affected by changes in the mix of earnings in states with different statutory tax rates, changes in the valuation of deferred tax assets and liabilities, changes in tax laws and regulations, or changes in our interpretations of tax laws. Changes in federal, state, or local tax laws, adverse tax audit results, or adverse tax rulings on positions taken could have a material adverse effect on the results of our operations, financial condition, or cash flows.
Current wording
We make judgments regarding the utilization of existing income tax credits and the potential tax effects of various financial transactions and results of operations to estimate our obligations to taxing authorities. We are also subject to regular reviews, examinations, and audits by the Internal Revenue Service (“IRS”) and other taxing authorities with respect to our taxes. Uncertain tax positions may arise where tax laws or regulations may allow for alternative interpretations, where the timing of recognition of income is subject to judgement, or where the IRS or other taxing authorities issue subsequent guidance or take positions on audits that differ from our interpretations and assumptions. Our tax obligations include, for example, income, franchise, real estate, sales and use, and employment-related taxes and the judgments we make include reserves for potential adverse outcomes regarding our tax positions. Although we believe we have accurately estimated our tax obligations, uncertainty of interpretation by various tax authorities and the possibility that there are issues that have not been recognized by management could each result in additional tax obligations. For example, if a taxing authority disagrees with the positions we have taken, we could face additional tax liability, including interest and penalties. We believe that our tax obligations reflect the anticipated outcome of known uncertain tax positions in conformity with ASC Topic 740 Income Taxes. In addition, our effective tax rate could be adversely affected by changes in the mix of earnings in states with different statutory tax rates, changes in the valuation of deferred tax assets and liabilities, changes in tax laws and regulations, changes to our business structure or operations, including acquisitions or divestitures, or changes in our interpretations of tax laws. Changes in federal, state, or local tax laws, adverse tax audit results, or adverse tax rulings on positions taken could have a material adverse effect on the results of our operations, financial condition, or cash flows.
Previous wording
New tax laws or regulations could be enacted at any time, and existing tax laws or regulations could be interpreted, amended, or applied in a manner that has a material effect on us, which could materially impact our business and financial condition.
Current wording
We may be subject to additional tax liabilities and penalties resulting from new tax legislation or regulations, which could be enacted at any time, and changes to existing tax laws or regulations, which could be interpreted, amended, or applied in a manner that has a material effect on us, which could materially impact our business and financial condition.
Previous wording
Declines in the number of deaths could cause atneed sales of funeral and cemetery services, property and merchandise to decline, which could decrease revenue. Although the United States Bureau of the Census estimates that the number of deaths in the United States will increase in the future, longer life spans could reduce the rate of deaths. In addition, changes in the number of deaths can vary among local markets and from quarter to quarter, and variations in the number of deaths in our markets or from quarter to quarter are not predictable. For example, our business can be affected by seasonal fluctuations in the death rate, with number of deaths generally higher during the winter months due to the higher incidences of death from influenza and pneumonia as compared to other periods of the year. Seasonal fluctuations in the death rate may be further affected by epidemics and pandemics, including any new or emerging public health threats. These unexpected fluctuations may not only increase death rates during the affected period, like we saw with the recent COVID-19 pandemic, but also may subsequently decrease death rates following the affected period as a result of an acceleration of death rates. As a result, we are unable to predict or forecast the duration or variation ofthe current death rate with any certainty, including the potential impact of epidemics and pandemics on the death rate, includingany new or emerging public health threats. Any future variations of the death rate may cause our revenue to fluctuate and our results of operations to lack predictability.
Current wording
Declines in the number of deaths could cause atneed sales of funeral and cemetery services, property and merchandise to decline, which could decrease revenue. Although the U.S. Bureau of the Census estimates that the number of deaths in the U.S. will increase in the future, longer life spans could reduce the rate of deaths. In addition, changes in the number of deaths can vary among local markets and from quarter to quarter, and variations in the number of deaths in our markets or from quarter to quarter are not predictable. For example, our business can be affected by seasonal fluctuations in the death rate, with number of deaths generally higher during the winter months due to the higher incidences of death from influenza and pneumonia as compared to other periods of the year. Seasonal fluctuations in the death rate may be further affected by epidemics and pandemics, including any new or emerging public health threats. These unexpected fluctuations may not only increase death rates during the affected period, but also may subsequently decrease death rates following the affected period as a result of an acceleration of death rates. As a result, we are unable to predict or forecast the duration or variation ofthe current death rate with any certainty, including the potential impact of epidemics and pandemics on the death rate, includingany new or emerging public health threats. Any future variations of the death rate may cause our revenue to fluctuate and our results of operations to lack predictability.
Previous wording
The increasing number of cremations in the United States could cause revenue to decline because we could lose market share to firms specializing in cremations and because our average revenue for cremations is lower than that for traditional burials.
Current wording
The increasing number of cremations in the U.S. could cause revenue to decline because we could lose market share to firms specializing in cremations and because our average revenue for cremations is lower than that for traditional burials.
Previous wording
Our traditional cemetery and funeral service operations face competition from the increasing number of cremations in the United States. Industry studies indicate that the percentage of cremations has increased every year, and this trend is expected to continue into the future. The trend toward cremation could cause cemeteries and traditional funeral homes to lose market share and revenue to firms specializing in cremations. Additionally, our average revenue for cremations is lower than that for traditional burials. If we are unable to continue to expand our cremation memorialization products and services, and cremations remain or increase as a significant percentage of our services, our financial condition, results of operations, and cash flows could be materially adversely affected.
Current wording
Our traditional cemetery and funeral service operations face competition from the increasing number of cremations in the U.S.. Industry studies indicate that the percentage of cremations has increased every year, and this trend is expected to continue into the future. The trend toward cremation could cause cemeteries and traditional funeral homes to lose market share and revenue to firms specializing in cremations. Additionally, our average revenue for cremations is lower than that for traditional burials. If we are unable to continue to expand our cremation memorialization products and services, and cremations remain or increase as a significant percentage of our services, our financial condition, results of operations, and cash flows could be materially adversely affected.
Previous wording
Our indebtedness requires significant interest and principal payments. As of December 31, 2024, we had $542.5 million of total debt (excluding debt issuance costs, debt discounts and lease obligations), consisting of $5.5 million of acquisition debt (consisting of deferred purchase price and promissory notes payable to sellers of businesses and real property we purchased), $400.0 million of our Senior Notes and $137.0 million of outstanding borrowings under our Credit Facility, with $110.8 million of availability under our Credit Facility after giving effect to $2.2 million of outstanding letters of credit.
Current wording
Our indebtedness requires significant interest and principal payments. As of December 31, 2025, we had $532.9 million of total debt (excluding debt issuance costs, debt discounts and lease obligations), consisting of $6.2 million of acquisition debt (consisting of deferred purchase price and promissory notes payable to sellers of businesses and real property we purchased), $400.0 million of our Senior Notes and $126.7 million of outstanding borrowings under our Credit Facility, with $121.1 million of availability under our Credit Facility after giving effect to $2.2 million of outstanding letters of credit.
Previous wording
Changes in U.S. foreign trade policies could lead to the imposition of additional trade barriers and tariffs on the foreign import of certain materials and products. For example, effective February 4, 2025, the U.S. government implemented an additional tariff on goods being imported from China and announced additional tariffs for goods imported into the United States from Mexico and Canada beginning in March 2025. We cannot predict what additional changes to trade policy will be made by the presidential administration or Congress, including whether existing tariff policies will be maintained or modified, what products may be subject to such policies or whether the entry into new bilateral or multilateral trade agreements will occur, nor can we predict the effects that any such changes would have on our business. However, such steps, if adopted, could result in additional inflationary pressures on the U.S. economy and increase the costs of goods we offer our customers and may negatively impact the supply chain on which we depend to supply merchandise to our funeral home and cemetery locations. Although we may take measures to mitigate the effects of these impacts, if these measures are not effective, there can be no assurance that such changes in U.S. trade policy or in laws and policies governing foreign trade would not materially and adversely affect our business, financial condition, results of operations and liquidity.
Current wording
Changes in U.S. foreign trade policies could lead to the imposition of additional trade barriers and tariffs on the foreign import of certain materials and products. For example, effective August 1, 2025, the U.S. adopted new and increased tariffs on countries and specific goods, subject to evolving exemptions. In October 2025, the U.S. government announced a series of new and expanded tariffs on imports from China and other countries, including a 100% tariff on certain categories of goods and increased duties. While these measures were scheduled to take effect beginning November 1, 2025, the U.S. government announced on October 30, 2025 a temporary pause on the implementation of these tariffs, along with China agreeing to pause the implementation of certain retaliatory measures scheduled to take effect in response. These actions have caused substantial uncertainty and volatility in financial markets and may result in additional retaliatory measures or costs on U.S. goods. We cannot predict what additional changes to trade policy will be made by the presidential administration or Congress, including whether existing tariff policies will be maintained or modified, what products may be subject to such policies or whether the entry into new bilateral or multilateral trade agreements will occur, nor can we predict the effects that any such changes would have on our business. However, such steps, if adopted, could result in additional inflationary pressures on the U.S. economy and increase the costs of goods we offer our customers and may negatively impact the supply chain on which we depend to supply merchandise to our funeral home and cemetery locations. Although we may take measures to mitigate the effects of these impacts, if these measures are not effective, there can be no assurance that such changes in U.S. trade policy or in laws and policies governing foreign trade would not materially and adversely affect our business, financial condition, results of operations and liquidity.
Previous wording
Based on the results of our annual goodwill and intangible assets impairment test we performed as of August 31, 2024 and our annual review of long-lived assets and leases at December 31, 2024, we determined that there were factors that would indicate the need to perform an additional quantitative impairment test for tradenames for certain funeral home businesses. As a result of this additional quantitative impairment test, we recorded an impairment to the tradenames of certain funeral home businesses of $0.6 million, as the carrying amount of these tradenames exceeded their fair value. We concluded that there were no impairments of our goodwill or other long-lived assets and leases.
Current wording
Based on the results of our annual goodwill and intangible assets impairment test we performed as of August 31, 2025 and our annual review of long-lived assets and leases as of December 31, 2025, we concluded that there were no impairments of our goodwill, intangible assets or other long-lived assets and leases.
Previous wording
In the ordinary course of our business, we receive certain personal information, in both physical and electronic formats, about our customers, their loved ones, our employees, and our vendors. We maintain security measures and data backup systems to protect, store, and prevent unauthorized access to such information, which we are continually assessing and updating, as necessary. For example, following our previously disclosed ransomware attack to our information technology system in January 2021, we have since implemented additional and enhanced security measures to our overall cyber-security posture to mitigate, to the extent possible, future cyberattacks and other similar threats. These measures include, for example, the addition of an advanced security operations center providing proactive threat protection, cloud-based firewall protection across all locations and endpoint protection. While we determined, based on our assessment of the information known to us, that the January 2021 ransomware incident did not have, nor do we expect it will have, a material impact on our business, operations or financial results, if we fail to protect our own information from any future breaches in data security, we could experience significant costs and expenses as well as damage to our reputation. Moreover, it is possible that computer hackers and others (through increasingly sophisticated cyberattacks or by other means) might circumvent our security measures in the future and obtain the personal information of customers, their loved ones, our employees or our vendors.
Current wording
In the ordinary course of our business, we receive certain personal information, in both physical and electronic formats, about our customers, their loved ones, our employees, and our vendors. We maintain security measures and data backup systems to protect, store, and prevent unauthorized access to such information, which we are continually assessing and updating, as necessary. Additionally, we take steps to secure our information systems and software and any access provided by our business partners or third-party service providers, including our computer systems, intranet and internet sites, email and other telecommunications and data networks. However, the security measures we have implemented may not be effective and our systems may be vulnerable to theft, loss, damage, and interruption from a number of potential sources and events, including unauthorized access or security breaches, data privacy breaches, natural or man-made disasters, cyber-attacks, computer viruses, malware, phishing, denial of service attacks, power loss, or other disruptive events. Information technology security threats have been increasing in frequency and sophistication. Cyber-attacks may be random, coordinated, or targeted, including sophisticated computer crime threats. For example, following our previously disclosed ransomware attack to our information technology system in January 2021, we have since implemented additional and enhanced security measures to our overall cyber-security posture to mitigate, to the extent possible, future cyberattacks and other similar threats. These measures include, for example, the addition of an advanced security operations center providing proactive threat protection, cloud-based firewall protection across all locations and endpoint protection. While we determined, based on our assessment of the information known to us, that the January 2021 ransomware incident did not have, nor do we expect it will have, a material impact on our business, operations or financial results, if we fail to protect our own information from any future breaches in data security, we could experience significant costs and expenses as well as damage to our reputation. Moreover, it is possible that computer hackers and others (through increasingly sophisticated cyberattacks or by other means) might circumvent our security measures in the future and obtain the personal information of customers, their loved ones, our employees or our vendors.
Previous wording
In addition, we maintain insurance coverage for various cybersecurity risks, which covered substantially all of the costs associated with our January 2021 ransomware attack, but it is possible that such insurance coverage may not fully insure all future costs or losses associated with other cybersecurity incidents. As the sophistication and frequency of attacks increase, our information technology security costs, including cybersecurity insurance, which are significant, may rise.
Current wording
In addition, we maintain insurance coverage for various cybersecurity risks, which covered substantially all the costs associated with our January 2021 ransomware attack, but it is possible that such insurance coverage may not fully insure all future costs or losses associated with other cybersecurity incidents. As the sophistication and frequency of attacks increase, our information technology security costs, including cybersecurity insurance, which are significant, may rise.
Previous wording
Additionally, legislation relating to cybersecurity threats could impose additional requirements on our operations. Various state governments, notably California, New York, Nevada and Virginia, have enacted or enhanced data privacy regulations, and other state governments are considering establishing similar or stronger protections. These regulations impose certain obligations for securing, and potentially removing, specified personal information in our systems, and for apprising individuals of the information we have collected about them. We have incurred costs in an effort to comply with these data privacy risks and requirements, and our costs may increase significantly as risks become increasingly complex or if new or changing requirements are enacted, and based on how individuals exercise their rights. For example, in November 2020, California voters approved Proposition 24 (Consumer Personal Information Law and Agency Initiative), which went into effect as of January 1, 2023 and has increased the data privacy requirements for our business. Despite our efforts, any noncompliance could result in our incurring substantial penalties and reputational damage.
Current wording
Additionally, legislation relating to cybersecurity threats could impose additional requirements on our operations. Various state governments, notably California, New York, Nevada and Virginia, have enacted or enhanced data privacy regulations, including data breach notification requirements, consumer protection laws, and personal data privacy laws, and other state governments are considering establishing similar or stronger protections. These regulations impose certain obligations for securing, and potentially removing, specified personal information in our systems, and for apprising individuals of the information we have collected about them. We have incurred costs in an effort to comply with these data privacy risks and requirements, and our costs may increase significantly as risks become increasingly complex or if new or changing requirements are enacted, and based on how individuals exercise their rights. For example, in June 2018, the State of California enacted the California Consumer Privacy Act of 2018 (“CCPA”), which took effect on January 1, 2023, and expanded consumer rights related to sharing of personal data, granted additional personal-data rights to consumers, removed the exceptions for business-to-business and employment data, and removed the 30-day window to cure alleged noncompliance before being subject to administrative enforcement. With respect to CCPA and CPRA, both have increased the data privacy requirements and costs for our business. Despite our efforts, any noncompliance could result in our incurring substantial penalties and reputational damage.