8-K/A: ENGlobal Corporation Amends Report to Provide Update on Cybersecurity Incident

ENGlobal Corporation files an amendment to its previous report to provide supplemental information regarding a cybersecurity incident that occurred in November 2024.

Summary

• ENGlobal Corporation is filing an amendment to its original Form 8-K to provide more details about a cybersecurity incident.
• The incident occurred on November 25, 2024, when a threat actor illegally accessed the company's IT system and encrypted some data files.
• The company took immediate steps to contain, assess, and remediate the incident, including engaging cybersecurity specialists and restricting access to its IT system.
• The cybersecurity incident limited the company's ability to access portions of its business applications for approximately six weeks.
• As of the date of the amended report, the company's operations and corporate functions have been fully restored, and the threat actor no longer has access to the IT system.
• The company is working with cybersecurity experts to reinforce its IT system and prevent future unauthorized access.
• The incident involved access to a portion of the company's IT system that contained sensitive personal information.
• The company intends to provide notifications to affected parties and regulatory agencies as required by law.
• Based on the information available, the company believes that the incident has not had a material impact and is not reasonably likely to have a material impact on the company's financial condition and results of operations, except as disclosed.
• The amendment contains forward-looking statements regarding the cybersecurity incident and its potential impact.

Sentiment

Score: 6

Explanation: The sentiment is neutral to slightly negative. While the company claims the incident is not materially impactful and operations are restored, the cybersecurity breach and potential compromise of sensitive information introduce uncertainty and risk.

Positives

• The company's operations and corporate functions have been fully restored after the cybersecurity incident.
• The company believes the threat actor no longer has access to its IT system.
• The company is taking steps to reinforce its IT system and prevent future unauthorized access.
• The company believes that the incident has not had a material impact on its financial condition and results of operations.

Negatives

• The cybersecurity incident limited the company's ability to access portions of its business applications for approximately six weeks.
• The incident involved access to a portion of the company's IT system that contained sensitive personal information.

Risks

• The completion of the company's investigation into the cybersecurity incident.
• The possibility that containment and remediation may not be successful.
• The compromise or improper use of sensitive personal information resulting in negative consequences such as fines, penalties, or loss of reputation.
• The nature and scope of any claims, litigation or regulatory proceedings that may be brought against the company as a result of the cybersecurity incident.
• The availability of insurance coverage.
• Other legal, reputational and financial risks resulting from this or other cybersecurity incidents.
• The potential impact of this cybersecurity incident on the company's revenues, operating expenses, and operating results.

Future Outlook

The company is working to reinforce its IT system and prevent future unauthorized access. The company believes that the incident has not had a material impact on its financial condition and results of operations, but there are risks associated with the incident that could affect future developments and performance.

Management Comments

• The company immediately took steps to contain, assess and remediate the cybersecurity incident, including beginning an internal investigation, engaging external cybersecurity specialists, and restricting access to its IT system.
• As of the date hereof, the company's operations and corporate functions have been fully restored, and the company believes that the threat actor no longer has access to the company's IT system.
• Based on the information available to the company as of the date hereof, the company believes that the incident has not had a material impact and is not reasonably likely to have a material impact, on the company, including the company's financial condition and results of operations, except as disclosed herein.

Industry Context

Cybersecurity incidents are a growing concern for companies across all industries. Companies are increasingly investing in cybersecurity measures to protect their IT systems and data. Regulatory agencies are also increasing their scrutiny of companies' cybersecurity practices.

Comparison to Industry Standards

• It's difficult to compare ENGlobal's situation directly to industry standards without knowing the specific details of their IT infrastructure and security measures.
• However, best practices generally involve robust firewalls, intrusion detection systems, regular security audits, employee training, and incident response plans.
• Companies like CrowdStrike, Palo Alto Networks, and FireEye are often consulted for cybersecurity expertise and incident response.
• The six-week restoration period suggests the incident had a significant impact, which could be longer than some companies experience with well-prepared incident response plans.
• The materiality assessment will be judged against how other companies have disclosed similar incidents, considering factors like financial impact, reputational damage, and regulatory scrutiny.

Stakeholder Impact

• Shareholders may be concerned about the potential financial and reputational impact of the cybersecurity incident.
• Employees may be affected by the disruption to business operations and the potential compromise of their personal information.
• Customers may be concerned about the security of their data.
• Suppliers and creditors may be affected by the disruption to business operations.

Next Steps

• The company intends to provide notifications to affected and potentially affected parties and applicable regulatory agencies as required by federal and state law.
• The company is working with cybersecurity experts to reinforce its IT system, strengthen its surveillance of cybersecurity threats and prevent future unauthorized access to its IT system.

Key Dates