MGP INGREDIENTS INC 10-Q

ITEM 1A. RISK FACTORS Risk factors are described in “Item 1A. Risk Factors” of our Annual Report on Form 10-K for the year ended December 31, 2019. The following update, listed below, should be read in conjunction with the risk factors disclosed in our Form 10-K for the year ended December 31, 2019. A failure of one or more of our key information technology ("IT") systems, networks, processes, associated sites, or those of our service providers could have a negative impact on our business. We rely on IT systems, networks, and services, including internet sites, data hosting and processing facilities and tools, hardware (including laptops and mobile devices), software and technical applications and platforms, some of which are managed and hosted by third party vendors to assist us in the management of our business. The various uses of these IT systems, networks, and services include, but are not limited to: hosting our internal network and communication systems; enterprise resource planning; processing transactions; summarizing and reporting results of operations; business plans, and financial information; complying with regulatory, legal, or tax requirements; providing data security; and handling other processes necessary to manage our business. Any failure of our IT systems or those of our third party vendors could adversely impact our ability to operate. Routine maintenance or development of new IT systems may result in systems failures, which may have a material adverse effect on our business, financial condition, or results of operations. Increased IT security threats and more sophisticated cyber crime pose a potential risk to the security of our IT systems, networks, and services, as well as the confidentiality, availability, and integrity of our data. This could lead to outside parties having access to our privileged data or strategic information or information regarding our employees, suppliers or customers. Any breach of our data security systems or failure of our IT systems may have a material adverse impact on our business operations and financial results. If the IT systems, networks or service providers we rely upon fail to function properly, or if we or our third party vendors suffer a loss or disclosure of business or other sensitive information due to any number of causes, including power outages, computer and telecommunications failures, viruses, phishing attempts, cyber-attacks, malware and ransomware attacks, security breaches, natural disasters, and errors by employees, and the disaster recovery plans do not 29 effectively address these failures on a timely basis, we may suffer interruptions in our ability to manage operations and reputational, competitive, or business harm, which may have a material adverse effect on our business, financial condition, or results of operations. If our critical IT systems or back-up systems or those of our third party vendors were damaged or ceased to function properly, we might have to make a significant investment to repair or replace them. If a ransomware attack or other cybersecurity breach occurs, either internally or at our third-party technology service providers, it is possible we could be prevented from accessing our data which may cause interruptions or delays in our business, cause us to incur remediation costs or require us to pay ransom to a hacker which takes over our systems, or damage our reputation. In addition, such events could result in unauthorized disclosure of material confidential information, and we may suffer financial and reputational damage because of lost or misappropriated confidential information belonging to us or to our partners, our employees, customers, and suppliers. Additionally, we could be exposed to potential liability, litigation, governmental inquiries, investigations or regulatory enforcement actions and we could be subject to the payment of fines or other penalties, legal claims by our suppliers, customers or employees and significant remediation costs. Although we maintain insurance coverage for various cybersecurity risks, we may incur costs or financial losses that are either not insured against or not fully covered through our insurance. Despite the protections we had in place, in May 2020, we were affected by a ransomware attack that temporarily disrupted production at our Atchison facilities. Our financial information was not affected and there is no evidence that any sensitive or confidential company, supplier, customer or employee data was improperly accessed or extracted from our network. We estimate that the ransomware attack adversely impacted gross profit by $1,728, primarily as a result of the business interruption. We have insurance related to this event and are seeking to recover a portion, if not all, of any profit impact including the profit associated with any loss of revenue resulting from this event. Following the attack, we implemented a variety of measures to further enhance our cybersecurity protections and minimize the impact of any future attack. Cyber threats are constantly evolving however, and although we continually assess and improve our protections, there can be no guarantee that a future cyber event will not occur. The outbreak of the coronavirus ("COVID-19") has negatively impacted and could continue to negatively impact the global economy. In addition, the COVID-19 pandemic could continue to disrupt or otherwise negatively impact global credit markets and could disrupt or otherwise negatively impact our operations, including the demand for our products and our ability to produce and deliver our products. The significant outbreak of COVID-19 has resulted in a widespread health crisis, which has negatively impacted and could continue to negatively impact the global economy. In addition, the global and regional impact of the outbreak, including official or unofficial quarantines and governmental restrictions on activities taken in response to the outbreak, could have a negative impact on our operations, including voluntary or mandatory temporary closures of our facilities or offices; interruptions in our supply chain, which could impact the cost or availability of raw materials; disruptions or restrictions on our ability to travel or to market and distribute our products; reduced consumer demand for our products or those of our customers due to bar and restaurant closures or reduced consumer traffic in bars, restaurants and other locations where our products or those of our customers are sold; and labor shortages. More broadly, the outbreak could lead to an economic downturn that could affect future demand for our products and those of our customers. Furthermore, our facilities and those of our customers and suppliers have been required to comply with additional regulations and may be required to comply with new regulations imposed by state and local governments in response to the COVID-19 pandemic, including COVID-19 safety guidance for production and manufacturing facilities. Compliance with these measures, or new measures, may cause increases in the cost, or delays or reduction in the volume, of products produced at our facilities or those of our suppliers. The COVID-19 outbreak has disrupted credit markets, and may continue to disrupt or negatively impact credit markets, which could adversely affect the availability and cost of capital. Such impacts could limit our ability to fund our operations and satisfy our obligations. The response to COVID-19 has resulted in in social distancing, travel bans, temporary closures of businesses, shelter-in-place orders, and quarantines, among other measures. Although certain of the restrictions have begun, and may continue, to ease in some places, the ongoing COVID-19 pandemic has limited and may continue to limit access to our facilities, customers, management, support staff, professional advisors and our independent auditors. These factors, in turn, may not only impact our operations, financial condition and demand for our products but our overall ability to react timely to mitigate the impact of this ongoing event. Also, these measures may continue to hamper our efforts to comply with our filing obligations with the Securities and Exchange Commission. The extent and potential short and long-term impact of the ongoing COVID-19 outbreak on our operational and financial performance will continue to depend on future developments, including the duration, severity and spread of the virus, actions that may be taken by governmental authorities and the impact on our supply chain, customers, operations, workforce and the financial markets, all of which remain highly uncertain and cannot be predicted. These and other potential impacts of an 30 epidemic, pandemic or other health crisis, such as COVID-19, could therefore materially and adversely affect our business, financial condition and results of operations.