20 unchanged sentences
We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.
−Removed: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.
+Added: We recently reported that we experienced a cybersecurity incident involving unauthorized access to an employee’s cloud-based storage account that may have resulted in access to certain personally identifiable information and protected health information of individuals, which we publicly disclosed in January 2026.
+Added: In response, we initiated an investigation, engaged third-party cybersecurity specialists, secured the impacted account, notified law enforcement authorities, and are conducting a review of the potentially affected data.
+Added: The event remains under investigation, and we continue to assess the scope and potential impacts of the incident, including any regulatory, legal, or financial implications.
+Added: While we have taken mitigation steps, there can be no assurance that similar incidents will not occur in the future or that additional impacts from this or related incidents will not be identified .
For additional information regarding risks from cybersecurity threats, please refer to Item 1A, “Risk Factors,” in this annual report on Form 10-K.
8 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.