Stepan Company

Item 1A  Risk Factors

There have been no material changes to the risk factors disclosed in the Companys 2023 Annual Report on Form 10-K, except for the modification of the risk factor set forth below:

Interruption of, damage to or compromise of the Companys IT systems, failure to maintain the integrity of customer, colleague or Company data or illegal or fraudulent activities committed against the Company could harm the Companys reputation and have an adverse effect on the Companys business, financial position, results of operations and cash flows.

The Company relies on IT systems in its operations, including production, supply chain, research and development, finance, human resource and regulatory functions. The Companys ability to effectively manage its business depends on the security, reliability and adequacy of these systems. IT system failures due to events including but not limited to network disruptions, programming errors, computer viruses and security breaches (e.g., cyber-attacks) could impact production activities, impede shipment of products, cause delays or cancellations of customer orders, or hamper the processing of transactions or reporting of financial results. These or similar occurrences, whether accidental or intentional, could result in theft, unauthorized use or publication of our intellectual property or confidential business information of our employees, customers, suppliers or other third parties, which could harm our reputation and competitive position, reduce the value of our investments in research and development and other strategic initiatives, result in a loss of business, as well as remedial and other costs, fines, investigations, enforcement actions or lawsuits or otherwise materially and adversely affect our business, financial position, results of operations and cash flows.

During the normal course of business, we have experienced and expect to continue to experience attempts to compromise our information and communications technology and related systems. Despite the security measures the Company has in place, the Companys customers and suppliers information and operational technology systems could be vulnerable to cyber-threats such as computer viruses or other malicious codes, security breaches, unauthorized access, phishing attacks and other disruptions from system failures, including network outages, unintentional or malicious actions of employees or contractors or cyber-attacks by hackers, criminal groups, nation-states and nation-state-sponsored organizations. In addition, if a material, actual or perceived breach of our security

3940

occurs, the public perception of the effectiveness of our security measures could be harmed and we could lose customers or suppliers. Any such material disruptions or breaches of security could have a material adverse effect on our business, financial position, results of operations and cash flows.

The defensive measures and training that we take to limit and manage threats, especially cyber-related and social engineering threats, to our business may not adequately anticipate, prevent or mitigate harm we may suffer from such threats. Criminals use evolving and increasingly sophisticated methods of perpetrating illegal and fraudulent activities. For example, we determined in July 2024 that one of the Companys subsidiaries in Asia was the victim of criminal social engineering scheme that resulted in a series of fraudulently-induced outbound payments for which the Company recognized a pre-tax charges of $3,500,000 pre-tax chargeand $3,300,000 for the quarters ended June 30, 2024. While the investigation is ongoing, the Company expects to record a charge in a similar amount in the third quarter of  and September 30, 2024 as a , result of this eventpectively. See Note 17, Other Matter, of the notes to the Companys condensed consolidated financial statements for additional details regarding the criminal social engineering scheme. Fraudulent activities committed against us could have a material adverse effect on our business, financial position, results of operations and cash flows.

The Company continues to develop and enhance controls and security measures designed to protect against the risk of theft, loss or fraudulent or unlawful use of customer, supplier, third party, employee or Company data, or illegal or fraudulent activities committed against the Company and it maintains an ongoing process to re-evaluate the adequacy of its controls and measures. The Company may also be required to expend additional resources to continue to enhance its privacy and security measures and/or to investigate and remediate any vulnerabilities. The Company maintains what it believes to be adequate and collectible insurance in the event of the theft, loss, fraudulent or unlawful use of customer, supplier, third party, employee or Company data, but any such occurrences could result in costs that may not be covered or may be in excess of any available insurance that the Company may have procured. While the Company has a comprehensive program in place for continuously reviewing, maintaining, testing and upgrading its IT systems and security, there can be no assurance that such efforts will prevent breakdowns of or breaches in Company IT systems or illegal or fraudulent activities committed against the Company that could materially and adversely affect the Companys business, financial position, results of operations and cash flows.