20 unchanged sentences
if deemed appropriate, reporting by our CISO to the Company’s Management and its Disclosure Committee, comprised of multi-disciplinary senior leaders across the organization, including representatives of our accounting, human resources, finance, information technology and legal functions, and consultation with internal and external legal counsel, for further review and determination of the scope and materiality of the incident or incidents, including whether public disclosure is appropriate or required;
−Removed: informing the Audit Committee of our Board of significant or material cybersecurity incidents, as appropriate.
+Added: informing the Audit Committee and the Technology Risk Committee (which was formed in October 2025) of our Board of significant or material cybersecurity incidents, as appropriate.
All incidents are documented and recorded and catalogued for further review by the CISO and their team.
2 unchanged sentences
We have faced—and in the future may face—sophisticated attacks, including attacks referred to as advanced persistent threats, which are cyberattacks aimed at compromising our intellectual property and other commercially sensitive information, such as the source code and game assets for our software or confidential customer or employee information, which may remain undetected for prolonged periods of time.
−Removed: In September 2022, we experienced a network intrusion in which an unauthorized third party illegally accessed and downloaded confidential information from Rockstar Games’ systems, including early development footage for the next Grand Theft Auto.
−Removed: Subsequently, also in September 2022, an unauthorized third party illegally accessed credentials for a vendor platform that 2K Games uses to provide help desk support to its customers.
−Removed: The unauthorized party sent a communication to certain players containing a malicious link.
−Removed: 2K Games immediately notified all affected users and took steps to restrict further unauthorized activity until service was restored.
−Removed: In connection with this activity, we have incurred certain immaterial incremental one-time costs related to consultants, experts and data recovery efforts and we generally expect to incur additional costs related to cybersecurity protections in the future.
In determining materiality, cybersecurity incidents are reviewed not only for potential financial impacts, which could include potential legal and regulatory penalties, stolen assets or funds, system damage, forensic and remediation costs, lost client revenue or litigation costs, but also the breadth and sensitivity of data exposure, data exfiltration, impacts on the ability to operate our business or provide our services, client dissatisfaction, reputational harm, and loss of investor confidence.
See Item 1A, Risk Factors, for more information on the cybersecurity threats facing our Company.
−Removed: Our Board actively oversees our risk management activities both directly and through its committees and considers various risk topics throughout the year, including, through the Audit Committee, cybersecurity and information security risk management and controls.
−Removed: As part of its oversight function, the Board, directly and through its Audit Committee, oversees the Company’s risk assessment and risk management policies, including related to cybersecurity.
−Removed: At least quarterly (with respect to the Audit Committee) and annually (with respect to the Board), our CTO and CISO report to the Audit Committee or the Board, respectively, addressing a broad range of topics, including significant cybersecurity incidents that have occurred, if any, since the last update, the status of projects and initiatives to update our cybersecurity policies and practices, and ongoing efforts to prevent, detect, and respond to internal and external critical threats.
+Added: Our Board actively oversees our risk management activities both directly and through its committees and considers various risk topics throughout the year, including, through the Audit Committee and the Technology Risk Committee,
+Added: cybersecurity and information security risk management and controls.
+Added: As part of its oversight function, the Board, directly and through its Audit Committee and Technology Risk Committee, oversees the Company’s risk assessment and risk management policies, including related to cybersecurity.
+Added: At least quarterly (with respect to the Technology Risk Committee) and annually (with respect to the Board), our CTO and CISO report to the Technology Risk Committee or the Board, respectively, addressing a broad range of topics, including significant cybersecurity incidents that have occurred, if any, since the last update, the status of projects and initiatives to update our cybersecurity policies and practices, and ongoing efforts to prevent, detect, and respond to internal and external critical threats.
Our senior management is responsible for assessing and managing the Company’s various exposures to risk, including those related to cybersecurity, on a day-to-day basis, including the identification of risks through an enterprise risk management framework and the creation of appropriate risk management programs and policies to address such risks.
2 unchanged sentences
Our internal audit team is responsible for testing and auditing our information-technology internal controls.
−Removed: In addition, leaders from our communications, finance, legal
−Removed: and risk teams participate in incident response training, including tabletop exercises, designed to enhance our ability to respond to cybersecurity incidents quickly, efficiently and with the appropriate degree of urgency.
+Added: In addition, leaders from our communications, finance, legal and risk teams participate in incident response training, including tabletop exercises, designed to enhance our ability to respond to cybersecurity incidents quickly, efficiently and with the appropriate degree of urgency.
We believe our information technology team to be well-qualified in this area.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.