Excerpts from Wal-Mart 10-K Filing, March 30, 2016

We rely extensively on information systems to process transactions, summarize results and manage our business. Disruptions in both our primary and secondary (back-up) systems could harm our ability to conduct our operations.

Although we have independent, redundant and physically separate primary and secondary information systems, given the number of individual transactions we have each year, it is critical that we maintain uninterrupted operation of our business-critical information systems. Our information systems, including our back-up systems, are subject to damage or interruption from power outages, computer and telecommunications failures, computer viruses, worms, other malicious computer programs, denial-of-service attacks, security breaches (through cyberattacks from cyber-attackers and sophisticated organizations), catastrophic events such as fires, tornadoes, earthquakes and hurricanes, and usage errors by our associates. If our information systems and our back-up systems are damaged, breached or cease to function properly, we may have to make a significant investment to repair or replace them, and we may suffer interruptions in our operations in the interim. Any material interruption in both our information systems and back-up systems may have a material adverse effect on our business or results of operations. In addition, we are pursuing complex initiatives to transform our information technology processes and systems, which will include, for many of our information systems, establishing common processes across our lines of business. The risk of system disruption is increased when significant system changes are undertaken, although we believe that our change management process will mitigate this risk. If we fail to integrate our information systems and processes, we may fail to realize the cost savings anticipated to be derived from these initiatives.

If the technology-based systems that give our customers the ability to shop with us online do not function effectively, our operating results, as well as our ability to grow our e-commerce business globally, could be materially adversely affected.

Many of our customers shop with us over our e-commerce websites and mobile commerce applications, including walmart.com and samsclub.com in the U.S. and our retail websites in 10 other countries, which are a part of our multi-channel sales strategy. Increasingly, customers are using computers, tablets, and smart phones to shop online and through mobile commerce applications with us and with our competitors and to do comparison shopping. We are increasingly using social media to interact with our customers and as a means to enhance their shopping experience. As a part of our multi-channel sales strategy, we offer “Walmart Pickup” and “Club Pickup” and in a growing number of locations, “Online Grocery” programs under which many products available for purchase online can be shipped to and picked up by the customer at his or her local Walmart store or Sam's Club, which provides additional customer traffic at such stores and clubs. Multi-channel retailing is a rapidly evolving part of the retail industry and of our operations in the U.S. and in a number of markets in which our Walmart International segment operates.

We must anticipate and meet our customers' changing expectations while adjusting for new developments and technology investments by our competitors through focusing on the building and delivery of a seamless shopping experience across all channels by each operating segment. Any failure on our part to provide attractive, user-friendly e-commerce platforms that offer a wide assortment of merchandise at competitive prices and with low cost and rapid delivery options and that continually meet the changing expectations of online shoppers and developments in online and mobile commerce application merchandising and related technology could place us at a competitive disadvantage, result in the loss of e-commerce and other sales, harm our reputation with customers, have a material adverse impact on the growth of our e-commerce business globally and could have a material adverse impact on our business and results of operations.

Any failure to maintain the security of the information relating to our company, customers, members, associates and vendors that we hold, whether as a result of cybersecurity attacks on our information systems or otherwise, could damage our reputation with customers, members, associates, vendors and others, could cause us to incur substantial additional costs and to become subject to litigation, and could materially adversely affect our operating results.

As do most retailers, we receive and store in our digital information systems certain personal information about our customers and members, and we receive and store personal information concerning our associates and vendors. We also utilize third-party service providers for a variety of reasons, including, without limitation, encryption and authentication technology, content delivery to customers, back-office support, and other functions. In addition, our online operations at www.walmart.com, www.samsclub.com and our websites in certain of our foreign markets depend upon the secure transmission of confidential information over public networks, including information permitting cashless payments. Each year, cyber-attackers make numerous attempts to access the information stored in our information systems. We maintain substantial security measures to protect, and to prevent unauthorized access to, such information and have security processes, protocols and standards that are applicable to our third-party service providers to protect information from our systems to which they have access under their engagements with us.

However, we or our third-party service providers may be unable to anticipate one or more of the rapidly evolving and increasingly sophisticated means by which cyber-attackers may attempt to defeat our security measures or those of our third-party service providers and breach our or our third-party service providers' information systems. During fiscal 2016, we were notified that a third-party service provider that hosts the online photo center for Walmart Canada suffered a security breach that compromised information of users of that company's site, including some Walmart Canada customers, which we believe has not had a material impact on Walmart Canada or the Company. Walmart Canada discontinued use of this third-party service provider. Sam's Club in the United States also used the same third-party service provider to host its online photo center through a different system than the one used by Walmart Canada. After the breach in Canada, Sam's Club suspended the operation of the online photo center until a security review could be completed by the third-party service provider. Once the security review was complete and new technology with enhanced security measures was implemented by the third-party service provider, along with a determination that the information of Sam's Club members was not compromised by the security breach, Sam's Club resumed the operation of the online photo center through the same third-party service provider.

Cyber threats are rapidly evolving and are becoming increasingly sophisticated. As cyber threats evolve and become more difficult to detect and successfully defend against, one or more cyber threats might defeat our security measures or those of our third-party service providers in the future like the incident referenced above and obtain the personal information of customers, members, associates and vendors that we hold or to which our third-party service providers have access, and we or our third-party service providers may not discover any security breach and loss of information for a significant period of time after the security breach occurs. Moreover, associate error or malfeasance, faulty password management or other irregularities may result in a defeat of our or our third-party service providers' security measures and breach our or our third-party service providers' information systems (whether digital or otherwise).

Any breach of our security measures or those of our third-party service providers and loss of our confidential information, which could be undetected for a period of time, or any failure by us to comply with applicable privacy and information security laws and regulations could cause us to incur significant costs to protect any customers and members whose personal data was compromised and to restore customer and member confidence in us and to make changes to our information systems and administrative processes to address security issues and compliance with applicable laws and regulations.

In addition, such events could materially adversely affect our reputation with our customers, members, associates, vendors and shareholders, as well as our operations, results of operations, financial condition and liquidity, could result in the release to the public of confidential information about our operations and financial condition and performance and could result in litigation against us or the imposition of penalties, fines, fees or liabilities, which may not be covered by our insurance policies. Moreover, a security breach could require us to devote significant management resources to address the problems created by the security breach and to expend significant additional resources to upgrade further the security measures that we employ to guard such important personal information against cyberattacks and other attempts to access such information and could result in a disruption of our operations, particularly our digital retail operations.

We accept payments using a variety of methods, including cash, checks, credit and debit cards, our private label cards and gift cards, and we may offer new payment options over time, which may have information security risk implications. By accepting debit and credit cards as a retailer for payment, we are subject to the Payment Card Industry Data Security Standard (“PCI DSS”), issued by the Payment Card Industry Security Standards Council. PCI DSS contains compliance guidelines and standards with regard to our security surrounding the physical and electronic storage, processing and transmission of individual cardholder data. The payment card industry set October 1, 2015 as the date on which it will shift liability for certain transactions to retailers who are not able to accept Europay, MasterCard, Visa (EMV) chip card credit and debit transactions. While we already accept many EMV cards, if we are unable to fully implement EMV as planned, we may incur increased costs associated with the liability shift. By accepting debit cards for payment, we are also subject to compliance with the American National Standards Institute encryption standards and payment network security operating guidelines. Even though we comply with these guidelines and standards and other information security measures, we cannot be certain that the security measures we maintain to protect all of our information technology systems are able to prevent, contain or detect any cyberattacks, cyber terrorism, or security breaches from known malware or malware that may be developed in the future. To the extent that any disruption results in the loss, damage or misappropriation of information, we may be materially adversely affected by claims from customers, financial institutions, regulatory authorities, payment card networks and others. In addition, the cost of complying with stricter privacy and information security laws and standards could be significant to us.

4.1.5.2 Berkshire Hathaway

Wal-Mart's extensive disclosures reflect, in part, the large amount of sensitive consumer data that it handles on a regular basis. Some large companies that do not deal directly with consumers tend to have more abbreviated cybersecurity disclosures. For instance, consider investment firm Berkshire Hathaway's “Risk factors” disclosure, which focuses primarily on potential harms to its operations.

Excerpts from Berkshire Hathaway 10-K Filing, Feb. 26, 2016

Excerpts from Target 10-K Filing, March 11, 2016

Technology Investments and Infrastructure Risks

If our capital investments in technology, supply chain, new stores and remodeling existing stores do not achieve appropriate returns, our competitive position, financial condition and results of operations may be adversely affected.

Our business is becoming increasingly reliant on technology investments, and the returns on these investments can be less predictable than building new stores and remodeling existing stores. We are currently making, and will continue to make, significant technology investments to support our efforts to provide a consistent guest experience across all sales channels, implement improvements to our guest-facing technology, and evolve our supply chain and our inventory management systems, information processes, and computer systems to more efficiently run our business and remain competitive and relevant to our guests. These technology initiatives might not provide the anticipated benefits or may provide them on a delayed schedule or at a higher cost. We must monitor and choose the right investments and implement them at the right pace, which depends on our ability to accurately forecast our needs and is influenced by the amount and pace of investments by our competitors. In addition, our growth also depends, in part, on our ability to build new stores and remodel existing stores in a manner that achieves appropriate returns on our capital investment. We compete with other retailers and businesses for suitable locations for our stores. Many of our expected new store sites are smaller and non-standard footprints located in fully developed markets, which require changes to our supply chain practices and are generally more time-consuming, expensive and uncertain undertakings than expansion into undeveloped suburban and ex-urban markets. Targeting the wrong opportunities, failing to make the best investments, or making an investment commitment significantly above or below our needs could result in the loss of our competitive position and adversely impact our financial condition or results of operations.

A significant disruption in our computer systems and our inability to adequately maintain and update those systems could adversely affect our operations and our ability to maintain guest confidence.

We rely extensively on our computer systems to manage and account for inventory, process guest transactions, manage and maintain the privacy of guest data, communicate with our vendors and other third parties, service REDcard accounts, summarize and analyze results, and on continued and unimpeded access to the Internet to use our computer systems. Our systems are subject to damage or interruption from power outages, telecommunications failures, computer viruses and malicious attacks, security breaches and catastrophic events. If our systems are damaged or fail to function properly or reliably, we may incur substantial repair or replacement costs, experience data loss or theft and impediments to our ability to manage inventories or process guest transactions, engage in additional promotional activities to retain our guests, and encounter lost guest confidence, which could adversely affect our results of operations.

We continually make significant technology investments that will help maintain and update our existing computer systems. Implementing significant system changes increases the risk of computer system disruption. The potential problems and interruptions associated with implementing technology initiatives could disrupt or reduce our operational efficiency, and could negatively impact guest experience and guest confidence.

Data Security and Privacy Risks

If our efforts to protect the security of information about our guests, team members and vendors are unsuccessful, we may face additional costly government enforcement actions and private litigation, and our sales and reputation could suffer.

An important component of our business involves the receipt and storage of information about our guests, team members, and vendors. We have programs in place to detect, contain and respond to data security incidents. However, because the techniques used to obtain unauthorized access, disable or degrade service, or sabotage systems change frequently and may be difficult to detect for long periods of time, we may be unable to anticipate these techniques or implement adequate preventive measures. In addition, hardware, software, or applications we develop or procure from third parties may contain defects in design or manufacture or other problems that could unexpectedly compromise information security. Unauthorized parties may also attempt to gain access to our systems or facilities, or those of third parties with whom we do business, through fraud, trickery, or other forms of deceiving our team members, contractors, vendors, and temporary staff.

Until the data breach in the fourth quarter of 2013, all incidents we experienced were insignificant. The data breach we experienced in 2013 was significant and went undetected for several weeks. Both we and our vendors have experienced data security incidents subsequent to the 2013 data breach; however, to date these other incidents have not been material to our consolidated financial statements. Based on the prominence and notoriety of the 2013 data breach, even minor additional data security incidents could draw greater scrutiny. If we or our vendors experience additional significant data security breaches or fail to detect and appropriately respond to significant data security breaches, we could be exposed to additional government enforcement actions and private litigation. In addition, our guests could lose confidence in our ability to protect their information, which could cause them to discontinue using our REDcards or loyalty programs, or stop shopping with us altogether.