8-K/A: Key Tronic Corporation Reports $2.3 Million in Expenses and $15 Million Revenue Loss Due to Cyberattack

Key Tronic Corporation experienced a cybersecurity incident in May 2024, resulting in significant operational disruptions, $2.3 million in additional expenses, and $15 million in lost revenue.

Summary

• Key Tronic Corporation experienced a cybersecurity incident on May 6, 2024, where unauthorized third parties accessed their IT systems.
• The company initiated its cyber incident response, engaging external experts and notifying law enforcement.
• The incident caused disruptions to business applications, including financial and operating reporting systems.
• Domestic and Mexico operations were halted for approximately two weeks for remediation.
• These locations returned to near capacity about two weeks after restarting production.
• Other international operations continued without significant disruption.
• The company continued to pay wages during the disruption.
• New IT infrastructure was deployed, and cybersecurity experts were engaged to remediate the incident.
• Operations and corporate functions were restored in mid-June, and the company believes the unauthorized access has been terminated.
• The threat actor accessed and exfiltrated limited data, including some personally identifiable information.
• The company is notifying affected parties and regulatory agencies as required.
• The cybersecurity incident resulted in approximately $2.3 million in additional expenses during the fourth quarter of fiscal year 2024.
• The company was unable to fulfill approximately $15 million of revenue during the fourth quarter due to the incident, with most of these orders expected to be fulfilled in fiscal year 2025.

Sentiment

Score: 3

Explanation: The document highlights a significant negative event (cybersecurity incident) with substantial financial and operational impacts. While the company is taking steps to remediate the situation, the overall tone is negative due to the disruptions and financial losses.

Positives

• The company's international operations continued production without material disruption.
• The company continued to pay wages during the disruption.
• The company successfully restored operations and corporate functions by mid-June.
• The company believes the unauthorized third party no longer has access to their IT systems.
• Most of the $15 million in lost revenue is expected to be recovered in fiscal year 2025.

Negatives

• The cybersecurity incident caused significant disruptions to the company's operations.
• Domestic and Mexico operations were halted for approximately two weeks.
• The company incurred approximately $2.3 million in additional expenses due to the incident.
• The company experienced a loss of approximately $15 million in revenue during the fourth quarter of fiscal year 2024.
• The threat actor accessed and exfiltrated limited data, including some personally identifiable information.

Risks

• The company faces the risk that containment and remediation efforts may not be fully successful.
• There is a risk of improper use of exfiltrated information.
• The company may face regulatory proceedings or litigation related to the cybersecurity incident.
• The company's future performance could be affected by the ongoing impact of the cybersecurity incident.

Future Outlook

The company expects to fulfill most of the $15 million in lost revenue in fiscal year 2025. The company is also continuing to investigate, contain, and remediate the cybersecurity incident, and the impact on the company, including its financial condition and results of operations.

Management Comments

• The company activated its cyber incident response procedure to investigate, contain, and remediate the incident.
• The company engaged external cybersecurity experts to help investigate the scope and impact of the cybersecurity incident.
• The company is continuing the process of providing appropriate notifications to potentially affected parties and to regulatory agencies as required by applicable law.
• The company believes that the unauthorized third party no longer has access to the company's IT systems.

Industry Context

Cybersecurity incidents are a growing concern across all industries, and this event highlights the importance of robust cybersecurity measures and incident response plans. The impact on Key Tronic Corporation is consistent with other companies that have experienced similar attacks, with significant financial and operational disruptions.

Comparison to Industry Standards

• The financial impact of $2.3 million in expenses and $15 million in lost revenue is significant for a company of Key Tronic's size, but not uncommon in the context of major cyberattacks.
• Companies like Equifax and Target have experienced similar or larger financial impacts from data breaches, including costs for remediation, legal fees, and lost revenue.
• The two-week operational halt in domestic and Mexico operations is a significant disruption, but is within the range of what other companies have experienced during major cyber incidents.
• The time to restore operations to near capacity, approximately four weeks, is also within the range of what other companies have experienced during major cyber incidents.
• The fact that other international operations continued without material disruption is a positive sign for the company's overall resilience.

Legal Proceedings

• The company may face regulatory proceedings or litigation related to the cybersecurity incident.

Stakeholder Impact

• Shareholders will be negatively impacted by the additional expenses and lost revenue.
• Employees may have experienced disruptions and uncertainty during the operational halt.
• Customers may have experienced delays in order fulfillment.
• Suppliers may have been affected by the operational disruptions.
• Creditors may be concerned about the financial impact of the incident.

Next Steps

• The company will continue to investigate, contain, and remediate the cybersecurity incident.
• The company will continue to provide appropriate notifications to potentially affected parties and regulatory agencies.
• The company expects to fulfill most of the $15 million in lost revenue in fiscal year 2025.

Key Dates

Keywords

cybersecurity incident, data breach, IT systems, revenue loss, operational disruption, remediation, data exfiltration, personally identifiable information, financial impact, Key Tronic Corporation