CHEESECAKE FACTORY INC

Previous wording

In order to leverage our internal resources and information technology infrastructure, and to support our business continuity and disaster recovery planning efforts, we rely on third-party vendors to provide some of our essential business processes. For example, we rely on a network of third-party distribution warehouses to deliver ingredients and other materials to our restaurants. In some instances, these processes rely on technology and may be outsourced to the vendor in their entirety and in other instances we utilize these vendors’ externally-hosted business applications. Our vendors’ systems have experienced cybersecurity incidents, including credential stuffing attacks in which compromised user credentials were used to breach the systems, and are vulnerable to a variety of risks, including, without limitation, theft, casualties such as fire, power loss, telecommunications failure or other catastrophic events, as well as from internal and external cybersecurity threats, including from diverse threat actors, such as state-sponsored organizations, opportunistic hackers and hacktivists, as well as through diverse attack vectors, such as malfeasance by insiders, human or technological error, malicious code embedded in open-source software, or misconfigurations, “bugs” or other vulnerabilities in commercial software that is integrated into our (or our suppliers’ or service providers’) network infrastructure, products or services, security breaches, denial of service attacks, viruses, worms, malware, ransomware, social engineering/phishing, breaches of the algorithms used to encrypt and protect data and other malicious, or disruptive or unauthorized events that jeopardize the confidentiality, integrity or availability of information systems or information residing therein, including confidential information and personal information (each, a “Cybersecurity Incident” and collectively, “Cybersecurity Incidents”). For example, in July 2024, we experienced disruptions to our information technology systems as part of the CrowdStrike software update that resulted in global information technology outages, including disruptions to our ability to process customer payments at certain of our restaurants. While we experienced this disruption for a limited period of time, the incident did not have a significant impact on our business. We also rely on third party services to effectively operate our restaurants including, for example, gift card distribution and transaction processing services, point-of-sale system services, online ordering services and food delivery services, and our Cheesecake Rewards TM program. We derive substantial revenue from these aspects of our business, which could suffer in the event of any factor that adversely impacts our vendors’ ability to provide such services. Such factors include, without limitation, loss of, or significant change in contractual terms of, key vendor contracts, vendor or processor failures, technology failures, c…

Excerpt shortened here; the source contains the full paragraph.

Current wording

In order to leverage our internal resources and information technology infrastructure, and to support our business continuity and disaster recovery planning efforts, we rely on third-party vendors to provide some of our essential business processes. For example, we rely on a network of third-party distribution warehouses to deliver ingredients and other materials to our restaurants. In some instances, these processes rely on technology and may be outsourced to the vendor in their entirety and in other instances we utilize these vendors’ externally-hosted business applications. Our vendors’ systems have experienced cybersecurity incidents, including credential stuffing attacks in which compromised user credentials were used to breach the systems, and are vulnerable to a variety of risks, including, without limitation, theft, casualties such as fire, power loss, telecommunications failure or other catastrophic events, as well as from internal and external cybersecurity threats, including from diverse threat actors, such as state-sponsored organizations, opportunistic hackers and hacktivists, as well as through diverse attack vectors, such as malfeasance by insiders, human or technological error, malicious code embedded in open-source software, or misconfigurations, “bugs” or other vulnerabilities in commercial software that is integrated into our (or our suppliers’ or service providers’) network infrastructure, products or services, security breaches, denial of service attacks, viruses, worms, malware, ransomware, social engineering/phishing, breaches of the algorithms used to encrypt and protect data and other malicious, or disruptive or unauthorized events that jeopardize the confidentiality, integrity or availability of information systems or information residing therein, including confidential information and personal information (each, a “Cybersecurity Incident” and collectively, “Cybersecurity Incidents”). For example, in July 2024, we experienced disruptions to our information technology systems as part of the CrowdStrike software update that resulted in global information technology outages, including disruptions to our ability to process customer payments at certain of our restaurants. While we experienced this disruption for a limited period of time, the incident did not have a significant impact on our business. We also rely on third party services to effectively operate our restaurants including, for example, gift card distribution and transaction processing services, point-of-sale system services, online ordering services and food delivery services, and our Cheesecake Rewards® program. We derive substantial revenue from these aspects of our business, which could suffer in the event of any factor that adversely impacts our vendors’ ability to provide such services. Such factors include, without limitation, loss of, or significant change in contractual terms of, key vendor contracts, vendor or processor failures, technology failures, cha…

Excerpt shortened here; the source contains the full paragraph.