De-Risking Your Risk Disclosures

Last week, the Ninth Circuit ruled in a securities case that a company's disclosure of cybersecurity risk may be misleading if the risk had already materialized and the company did not disclose that fact.¹ In light of that ruling, companies should consider adding a disclaimer to their risk factor disclosures making clear that, by disclosing a risk, the company is not representing that the risk has not already materialized. If a previously disclosed risk has materialized, companies should avoid representing that there have been no material changes to their prior risk disclosures.

Facts: 

The complaint alleged that in February 2018, Alphabet, Inc. ("Alphabet"), the holding company of Google LLC ("Google"), filed its 10-K for FY 2017. In the "risk factors" section, it listed potential consequences in the event third parties were to breach Google's cybersecurity measures and obtain access to its users' private data.