JONES SODA CO. 10-K

ITEM 1B. UNRESOLVED STAFF COMMENTS. None. ITEM 1C. CYBERSECURITY The Company has not adopted any formal cybersecurity risk management program or formal processes for assessing, identifying, and managing material risks from cybersecurity threats. At the management level, our Chief Executive Officer and Chief Financial Officer are responsible for addressing cybersecurity incidents, while our full board of directors has oversight responsibility for the Company’s overall risk management, including cybersecurity risk, and has not delegated oversight authority for cybersecurity risks to any committee . In the event a cybersecurity incident occurs, the Company’s Chief Executive Officer and the Financial Officer are expected to inform our board of directors of the details of such incident as well as the measures taken in response to such incident. On September 8, 2025, Jones Soda experienced a disruption in its corporate environment which was the result of an encryption event due to a ransomware attack. The Company was able to recover its data from back-ups not affected by the encryption event and was fully operational with its systems within two weeks. All affected parties were notified of potential information related to the data breach affecting the Company’s employees. The Company has since switched IT managed services providers and have installed a higher level of security protecting the Company’s data. The Company believes that this event did not have material affect on our business strategy, results of operations, or financial condition. ITEM 2. PROPERTIES. We do not own any real property.