2 unchanged sentences
Risk Management and Strategy
−Removed: We have established policies and processes for assessing, identifying and managing risks from cybersecurity threats based on the National Institute of Standards and Technology (“NIST”) cybersecurity framework.
+Added: We have established policies and processes for assessing, identifying and managing risks from cybersecurity threats based on the National Institute of Standards and Technology (“NIST”) cybersecurity framework and Zero Trust Architecture principles.
Our technology environment is regularly assessed, both internally and through the use of third parties, against the six NIST principles (identify, detect, protect, recover, respond, govern) to oversee and identify the likelihood and impact of risks from cybersecurity threats.
1 unchanged sentence
We also utilize third parties to assess the effectiveness of our cybersecurity program on a periodic basis, which includes engaging cybersecurity assessors and cybersecurity experts to assist in the detection, verification and validation of risks from cybersecurity threats, as well as to support associated mitigation plans when necessary.
−Removed: We have a cybersecurity incident response plan in place to assist us in detecting, analyzing, containing, responding to and recovering from cybersecurity incidents.
+Added: We have a cybersecurity incident response plan in place to assist us in detecting, analyzing, containing, responding to and recovering from cybersecurity incidents, designed to facilitate a cross-functional response across the Company, with escalation based on the severity of impact.
We also maintain cybersecurity insurance coverage to protect against certain potential losses arising from cybersecurity incidents.
3 unchanged sentences
Our Chief Information Security Officer (“CISO”) leads a dedicated cybersecurity team responsible for policy, governance, vulnerability management, architecture and incident response.
−Removed: Our team monitors and tests our cybersecurity policies and procedures through methods such as periodic reviews, targeted assessments and tabletop exercises.
+Added: Our team monitors and tests our cybersecurity policies and procedures through methods such as periodic reviews, targeted assessments, penetration testing and tabletop exercises.
All personnel with access to UNFI systems are made aware of our cybersecurity policies and procedures upon hire and through periodic refresher trainings.
Such policies and procedures cover areas such as identity and access management, vendor management, data governance and protection, vulnerability management, incident response, recovery, communications and cybersecurity hygiene.
−Removed: In the fourth quarter of fiscal 2025, we became aware of unauthorized activity on certain of our information technology systems.
−Removed: We promptly activated our incident response plan and implemented containment measures, including proactively taking certain systems offline (the “Cybersecurity Incident”).
−Removed: As a result, our ability to fulfill and distribute customer orders was temporarily impacted until the unauthorized activity could be contained, and we could safely restore the core systems that our customers and suppliers use, enabling business operations to normalize.
−Removed: As a result of the Cybersecurity Incident, we experienced reduced sales volume and increased operational costs in the fourth quarter of fiscal 2025, which negatively impacted our results of operations.
−Removed: Other than the Cybersecurity Incident, we have not experienced any cybersecurity incidents that have materially impacted or are likely to materially impact our business strategy, results of operations or financial condition.
+Added: As previously disclosed, in June 2025, we experienced a cybersecurity incident, which resulted in reduced sales volume and increased operational costs and negatively impacted our results of operations for the fourth quarter of fiscal 2025.
+Added: We are regularly subject to cyber threats, ransomware and other security breaches.
Although we cannot eliminate all potential threats, our cybersecurity program is operated in a manner to minimize the likelihood of any threat becoming material and to keep pace with a constantly evolving cybersecurity landscape.
5 unchanged sentences
Specific topics may include updates to the Company’s strategy to combat cybersecurity risks;
+Added: implementation of certain cybersecurity improvement initiatives;
cybersecurity news and events;
5 unchanged sentences
The information security function is led by our CISO, under the direction of our CIO.
−Removed: In fiscal 2025, following the retirement of our former CISO, we appointed an interim CISO who has over 20 years of experience in information technology and security and is a Certified Information Systems Security Professional.
+Added: Our CISO, who has been serving in the position since fiscal 2025, has over 20 years of experience in information technology and security and is a Certified Information Systems Security Professional.
Our CISO maintains primary responsibility for developing cybersecurity strategies;
2 unchanged sentences
preparing for and responding to cybersecurity incidents;
−Removed: verification and testing of cybersecurity;
−Removed: and disaster recovery governance.
+Added: and verification and testing of cybersecurity.
Our CISO may authorize specific Company associates to assist in managing these responsibilities if determined necessary, including the Crisis Response Team.
4 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.