What are some potential costs Benihana could incur due to a data breach?

scope and severity of risks posed to our systems from cyber threats has increased. Many of our information technology systems, including those used for our point-of-sale, delivery services and administrative functions, contain personal, financial or other information that is entrusted to us by our guests, vendors and employees. Many of our information technology systems also contain confidential information about our business, such as business strategies, development initiatives and designs. To date, these attacks have not had a material impact on our operations, but we cannot provide assurance that they will not have an impact in the future.

Our third-party providers' information technology systems and databases are likewise subject to such risks. We provide some guest and employee data, as well as confidential information important to our business, to third parties to conduct our business. Individuals performing work for us and these third parties also may access some of this data, including on personally owned digital devices. To the extent we, a third party or such an individual were to experience a breach of our or their information technology systems that results in the unauthorized access, theft, use, destruction or other compromises of customers' or employees' data or confidential information stored in or transmitted through such systems, it could result in a material loss of revenues from the potential adverse impact to our reputation and brand, a decrease in our ability to retain customers or attract new ones, the imposition of potentially significant costs (including loss of data or payment for recovery of data), loss of business, disruption to our supply chain, business and plans. Unauthorized access, theft, use, destruction or other compromises are becoming increasingly sophisticated and may occur through a variety of methods, including attacks using malicious code, vulnerabilities in software, hardware or other infrastructure (including systems used by our supply chain), system misconfigurations, phishing or social engineering. The rapid evolution and increased adoption of artificial intelligence technologies may intensify our cybersecurity risks. Our logging capabilities, or the logging capabilities of third parties, are not always complete or sufficiently granular, affecting our ability to fully understand the scope of security breaches.

We rely heavily on information technology systems and failures or interruptions in our IT systems could harm our ability to effectively operate our business and/or result in the loss of guests or employees.

We rely heavily on information technology systems, including the point-of-sale and payment processing system in our restaurants, technologies supporting our digital and delivery services business, technologies that manage our supply chain, our rewards program, technologies that facilitate marketing initiatives, employee engagement and payroll processing, and various other processes and transactions. Our ability to effectively manage our business and coordinate

the procurement, production, distribution, safety and sale of our products depends significantly on the availability, reliability and security of these systems. Many of these critical systems are provided and managed by third parties, and we are reliant on these third-party providers to implement protective measures that ensure the security and availability of their systems. Although we have operational safeguards in place, these safeguards may not be effective in preventing the failure of these third-party systems or platforms to operate effectively and be available.

Source: Item 22 — CONTRACTS (FDD pages 73–74)