Item 1B. Unresolved Staff Comments
Item 1B. Unresolved Staff Comments
None.
Item 1C. Cybersecurity
The following discussion of our cybersecurity program reflects conditions as of December 31, 2025, including significant enhancements implemented in response to the August 2025 cybersecurity incident described below.
On August 16, 2025, the Company was the subject of a targeted ransomware incident affecting certain internal IT systems. Upon discovering the incident, the Company promptly activated its response protocols and implemented containment measures, including proactively shutting down most operating systems globally to manage the safety of the overall global systems environment. The Company engaged leading cybersecurity experts to support system recovery and conduct a comprehensive forensic investigation. The investigation determined that the attack originated through a vulnerability in a commercially available third-party firewall service provider and was not specifically targeted at Data I/O. By September 2025, the incident had been completely contained and remediated, all global systems were restored, and the Company does not believe it has any remaining risk exposure from the incident. The remediation and associated professional fees resulted in approximately $388,000 of one-time costs, primarily recorded in the third quarter of 2025. The incident was reported on Form 8-K filed with the SEC on August 21, 2025.
As an outcome of the incident, the Company’s IT systems and cybersecurity posture were strengthened, with improved corporate processes and enhanced security infrastructure. Remediation actions included enhancements to system access controls, improved network segmentation, migration of critical systems to cloud-based solutions, and expanded monitoring and review procedures. See “Risk Factors - Cybersecurity incidents could result in loss of revenue, business disruptions, remediation costs, legal claims and proceedings, regulatory actions, reporting delays, increased insurance costs, or damage to the Company’s reputation which could adversely impact or operations and financial results.”
CYBERSECURITY GOVERNANCE
The Company’s Board of Directors has oversight responsibility for our strategic and operational risks. The Audit Committee of the Board of Directors is responsible for board-level oversight of cybersecurity risk. The cybersecurity program is managed by our outsourced IT infrastructure team with oversight and coordination by our CFO, Charles DiBona, who reports directly to our CEO.
During the third quarter of 2025, in connection with the appointment of Charles DiBona as Chief Financial Officer, the Company formalized CFO oversight of the cybersecurity program. Following the August 2025 ransomware incident, the Audit Committee increased the frequency of cybersecurity reporting and the Company enhanced its incident response protocols. The cybersecurity program is managed by the Company’s new outsourced IT infrastructure team, which provides 24/7 monitoring and response capabilities, with oversight and coordination by the CFO, who reports directly to the CEO. The Audit Committee receives regular updates on cybersecurity matters, including threat assessments, incident response activities, and the status of remediation efforts.
CYBERSECURITY RISK MANAGEMENT AND STRATEGY
The Company’s cybersecurity risk management program is integrated into its overall enterprise risk management framework. Following the August 2025 ransomware incident, the Company significantly enhanced its cybersecurity risk management processes. These enhancements included: patching the third-party firewall service provider through which the attack originated and evaluating replacement providers; implementing improved network segmentation and access controls; expanding endpoint detection and response capabilities; enhancing backup and disaster recovery procedures; conducting comprehensive vulnerability assessments across all IT systems; and providing additional cybersecurity awareness training to all employees. The Company also engaged independent cybersecurity consultants to review and validate the effectiveness of its enhanced security posture. As of September 30, 2025, all remediation activities had been completed and all global systems had been restored to full operational status. The Company continues to assess and adapt its cybersecurity risk management practices to address evolving threats.
22
Table of Contents