Waystar Holding Corp.

Previous wording

Our business, results of operations, prospects, and financial condition may be materially adversely affected by a number of factors, whether currently known or unknown, including those described in Part I, Item 1A "Risk Factors" of the 2025 Form 10-K. Except as set forth below, there have been no material changes to the risk factors disclosed in the 2025 Form 10-K.

Current wording

Our business, results of operations, prospects, and financial condition may be materially adversely affected by a number of factors, whether currently known or unknown, including those described in Part I, Item 1A "Risk Factors" of the 2025 Form 10-K, as updated by Part II, Item 1A “Risk Factors” of our Quarterly Report on Form 10-Q for the quarterly period ended June 30, 2026. Except as set forth below, there have been no material changes to the risk factors disclosed in the 2025 Form 10-K, as updated.

Previous wording

We and certain of our third-party providers have experienced cyber-attacks and other incidents, and we expect such attacks and incidents to continue in varying degrees in the future. For example, in early June 2026, we identified the unauthorized acquisition of point-in-time copies of source code, primarily used for testing purposes, from a cloud-based repository hosted by a third-party provider and the unauthorized acquisition of four files of inactive data from a single application, which had been written to cloud-based storage pending its scheduled destruction. The incident was promptly contained and did not involve any access to active production systems or client data being processed by any active Waystar products. The application-related data and, we believe, the subset of source code in the third-party code repository platform used for testing purposes prior to 2023 included PHI and personally identifiable information associated with fewer than 1% of Waystar clients. We immediately activated incident response procedures, initiated an investigation, engaged leading external cybersecurity experts, notified law enforcement, and took steps to contain, assess, and remediate the incident. We are also in the process of communicating with the relevant clients and will comply with any applicable legal obligations. The incident did not impact the operation of our software solutions, the ability of clients to access our cloud-based software platform, or any functions of our financial and operating reporting systems. While to date, we have no evidence that the affected information has been misused, the threat actor may use or disclose the information that was subject to unauthorized access and acquisition in a manner that adversely affects our business. We may also discover additional impacts of this or other incidents as part of that investigation. While our response efforts are ongoing, we believe this incident has not had, and is not reasonably likely to have, any material adverse effect on our operations or financial condition, and we expect that a portion of costs incurred relating to containing, investigating and remediating the incident will be reimbursed through insurance recoveries. Despite these expectations, there can be no assurances as to the ultimate impact of this incident, which may result in harm to our reputation and client relationships.

Current wording

We and certain of our third-party providers have experienced cyber-attacks and other incidents, and we expect such attacks and incidents to continue in varying degrees in the future. For example, in early June 2026, we identified the unauthorized acquisition of point-in-time copies of source code, primarily used for testing purposes, from a cloud-based repository hosted by a third-party provider and the unauthorized acquisition of four files of inactive data from a single application, which had been written to cloud-based storage pending its scheduled destruction. The incident was promptly contained and did not involve any access to active production systems or client data being processed by any active Waystar products. The application-related data and, we believe, the subset of source code in the third-party code repository platform used for testing purposes included PHI and personally identifiable information associated with fewer than 1% of Waystar clients. We immediately activated incident response procedures, initiated an investigation, engaged leading external cybersecurity experts, notified law enforcement, and took steps to contain, assess, and remediate the incident. We are also in the process of communicating with the relevant clients and will comply with any applicable legal obligations. The incident did not impact the operation of our software solutions, the ability of clients to access our cloud-based software platform, or any functions of our financial and operating reporting systems. While to date, we have no evidence that the affected information has been misused, the threat actor may use or disclose the information that was subject to unauthorized access and acquisition in a manner that adversely affects our business. We may also discover additional impacts of this or other incidents as part of that investigation. While our response efforts are ongoing, we believe this incident has not had, and is not reasonably likely to have, any material adverse effect on our operations or financial condition, and we expect that a portion of costs incurred relating to containing, investigating and remediating the incident will be reimbursed through insurance recoveries. Despite these expectations, there can be no assurances as to the ultimate impact of this incident, which may result in harm to our reputation and client relationships.