ADI · ANALOG DEVICES INC

They also can result from the malicious or accidental acts of our employees, contractors or third-party providers. Unauthorized access to, or a security breach of, our systems or those of our third-party service providers or strategic partners could disrupt our operations. As occurred in the June 2026 incident, such events can result in the exfiltration of data from our systems and could expose our proprietary information or that of our employees, contractors, partners, customers, suppliers or other third parties to misappropriation or misuse. In the event of a cybersecurity attack or incident such as the June 2026 incident, we may become subject to litigation and regulatory action, lose existing or potential customers, suffer reputational damage and incur other financial losses. We have incurred and expect to continue to incur costs in connection with our response to and remediation of cybersecurity incidents, and such costs and operational consequences may be significant. The continuing and evolving threat of cyberattacks has resulted in increased regulatory focus which requires us to invest significant additional resources to comply with evolving cybersecurity regulations. In addition, in 2023, the SEC adopted rules requiring an issuer to disclose whether a cybersecurity incident was determined to be "material," within four business days of such determination. Making such determinations is complex, requires a number of assumptions based on several factors, and must be made while investigations may still be ongoing and the full scope of an incident may not yet be known. The SEC may not agree with our determinations regarding the materiality of cybersecurity incidents, which could result in fines, civil litigation or damage to our reputation. In addition, certain incidents may require us to notify affected parties and applicable regulators in accordance with applicable law, and we may face regulatory scrutiny regarding the timeliness or adequacy of such notifications.