1 unchanged sentence
CYBERSECURITY
−Removed: (a) Definitions (extracted from 17 CFR 229.106)
−Removed: The Company has adopted the definitions present in 17 CFR 229.106 for the following cybersecurity terms:
−Removed: • Cybersecurity Incident :
−Removed: An unauthorized occurrence, or a series of related unauthorized occurrences, on or conducted through information systems that jeopardizes the confidentiality, integrity, or availability of information systems or any information residing therein.
−Removed: • Cybersecurity Threat:
−Removed: A cybersecurity threat as any potential unauthorized occurrence on or conducted through its information systems that may adversely affect the confidentiality, integrity, or availability of information systems or any information residing therein.
−Removed: • Information Systems :
−Removed: Electronic information resources owned or used by the organization, including physical or virtual infrastructure controlled by such information resources, or components thereof, organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information to maintain or support its operations.
−Removed: (b) Risk Management and Strategy
+Added: RISK MANAGEMENT AND STRATEGY
Processes for Assessing, Identifying, and Managing Cybersecurity Risks
−Removed: The Company has established processes to assess, identify, and manage material risks arising from cybersecurity threats.
+Added: The Company has established processes to assess, identify, and manage material risks arising from cybersecurity threats (as defined in Item 106(a) of Regulation S-K).
These processes are integrated into the Company's' overall risk management system.
1 unchanged sentence
• The addition of an experienced Chief Information Security Officer ("CISO") with over 25 years of experience to lead the IT Cybersecurity and Compliance team.
−Removed: • Yearly risk assessment designed to help identify material cybersecurity risks to our Information Systems and Data.
−Removed: • A security incident response team that is responsible for managing our cybersecurity risk, security controls, response, and reporting cybersecurity incidents.
+Added: • Yearly risk assessment designed to help identify material cybersecurity risks to our information systems (as defined in Item 106(a) of Regulation S-K) and data.
+Added: • A security incident response team that is responsible for managing our cybersecurity risk, security controls, response, and reporting cybersecurity incide nts (as defined in Item 106(a) of Regulation S-K).
• A cyber and data security incident response plan with policies and procedures for identifying, managing, and recovering from cybersecurity incidents, including escalating tiers of notification and reporting depending on an incident's nature and severity.
8 unchanged sentences
Material Effects of Cybersecurity Threats
−Removed: The Company consistently identifies and evaluates cybersecurity threats that could significantly impact our business strategy, financial condition, and operational results.
−Removed: As of fiscal 2024 year-end, no significant cybersecurity threats or incidents have materially impacted our strategy or operational results.
+Added: On February 3, 2025, we experienced a systems outage caused by a cybersecurity attack by threat actors who unlawfully accessed our network, encrypted critical applications, and exfiltrated certain files (herein defined as the "Cyber Incident").
+Added: Upon discovery, we promptly activated our incident response plan, engaging both internal teams and third-party cybersecurity experts.
+Added: During the year ended September 28, 2025, we incurred $10.5 million loss of cash flows related to the Cyber Incident.
+Added: Approximately $3.7 million of this was incurred expenses that are recognized in "Restructuring and Other" in the Consolidated Statements of (Loss) Income and Comprehensive (Loss) Income.
+Added: We have filed insurance claims for the remaining $6.8 million to cover business interruption and other costs.
+Added: Incident remains under legal and forensic investigation, including evaluation of the extent and potential risk related to unauthorized access to sensitive data.
+Added: The incident had a significant negative impact on our 2025 operating results.
+Added: Various revenue lines were impacted, certain operating expenses were higher than they were prior to the incident, and many projects underway were significantly delayed.
For a description of the risks related to cybersecurity that may materially affect us and how they may do so, see the “Risk Factors—Risks Related to Cybersecurity” section of this Report.
−Removed: (c) Governance
Board of Directors Oversight
−Removed: The Board of Directors plays a crucial role in overseeing the Company's management of cybersecurity risks.
+Added: The Board of Directors plays a crucial role in overseeing our management of cybersecurity risks.
The Audit and Risk Management Committee is specifically tasked with this responsibility, and it regularly reports to our Board regarding its activities, including those related to cybersecurity risk management.
−Removed: Our Board also receives periodic briefings from management on our cybersecurity risk management program, including presentations on cybersecurity topics from our Chief Transformation Officer, Chief Information Officer, internal information security team, and third-party experts.
−Removed: These briefings cover the current threat landscape, ongoing cybersecurity initiatives, and the Company's response to significant incidents.
+Added: Our Board also receives periodic briefings from management on our cybersecurity risk management program, including presentations on cybersecurity topics from our Chief Information Officer, internal information security team, and third-party experts.
+Added: These briefings cover the current threat landscape, ongoing cybersecurity initiatives, and our response to significant incidents.
Management’s Role in Cybersecurity Risk Management
2 unchanged sentences
• Responsible Positions/Committees:
−Removed: The Chief Transformation Officer, Chief Information Officer, and Chief Information Security Officer are responsible for assessing and managing cybersecurity risks.
+Added: The Chief Information Officer, and Chief Information Security Officer are responsible for assessing and managing cybersecurity risks.
The individuals in these roles possess extensive expertise in cybersecurity.
−Removed: Specifically, the Chief Transformation Officer has over 30 years of experience in extensive technology and executive leadership experience across diverse industries, the Chief Information Officer has over 25 years in Information Technology across multiple industries, and the Chief Information Security Officer has over 25 years in Security, Risk, Audit, and Compliance across various sectors, including both public and private.
+Added: Specifically, the Chief Information Officer has over 25 years in Information Technology across multiple industries, and the Chief Information Security Officer has over 25 years in Security, Risk, Audit, and Compliance across various sectors, including both public and private.
• Monitoring and Response Processes:
3 unchanged sentences
Information about cybersecurity risks is regularly reported to the Board of Directors or its relevant committee.
−Removed: This reporting includes updates on the Company's cybersecurity risk profile, significant incidents, and the effectiveness of mitigation strategies.
+Added: This reporting includes updates on our cybersecurity risk profile, significant incidents, and the effectiveness of mitigation strategies.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.