Risk Factors - BBWI

-New additions in green
-Changes in blue
-Hover to see similar sentence in last filing

ITEM 1A. RISK FACTORS.

We caution that any forward-looking statements (as such term is defined in the Private Securities Litigation Reform Act of 1995) contained in this report or made by our Company or our management involve risks and uncertainties and are subject to change based on various factors, many of which are beyond our control. Accordingly, our future performance and financial results may differ materially from those expressed or implied in any such forward-looking statements. Accordingly, our future performance and financial results may differ materially from those expressed or implied in any such forward-looking statements. Words such as “estimate,” “project,” “plan,” “believe,” “expect,” “anticipate,” “intend,” “planned,” “potential,” “target,” “goal” and any similar expressions may identify forward-looking statements. Words such as “estimate,” “project,” “plan,” “believe,” “expect,” “anticipate,” “intend,” “planned,” “potential,” "target," "goal" and any similar expressions may identify forward-looking statements. Risks associated with the following factors, among others, in some cases have affected and, in the future, could affect our financial performance and actual results and could cause actual results to differ materially from those expressed or implied in any forward-looking statements included in this report or otherwise made by the Company or our management:

•general economic conditions, inflation, tariffs, consumer confidence, consumer spending patterns and market disruptions including pandemics or significant health hazards, severe weather conditions, natural disasters, terrorist activities, financial crises, political crises or other major events, or the prospect of these events;

•the seasonality of our business;

•our ability to attract, develop and retain qualified associates and manage labor-related costs;

•difficulties arising from turnover in Company leadership or other key positions;

•the dependence on store traffic and the availability of suitable store locations on appropriate terms;

•our continued growth in part through new store openings and existing store remodels and expansions;

•our ability to successfully operate and expand internationally and related risks;

•our independent franchise, license, wholesale and other distribution-related partners;

•our direct channel business;

•our ability to protect our reputation and our brand image;

•our ability to attract customers with marketing, advertising, promotional programs and our loyalty program;

•our ability to maintain, enforce and protect our trade names, trademarks and patents;

•the highly competitive nature of the retail industry and the segments in which we operate;

•consumer acceptance of our products and our ability to manage the life cycle of our brand, develop new merchandise and launch and expand new product lines successfully;

•our ability to source, distribute and sell goods and materials on a global basis, including risks related to:

•political instability, wars and other armed conflicts, environmental hazards or natural disasters;

•significant health hazards or pandemics, which could result in closed factories and/or stores, reduced workforces, scarcity of raw materials, and scrutiny or embargoing of goods produced in impacted areas;

•duties, taxes and other charges;

•legal and regulatory matters;

•volatility in currency exchange rates;

•local business practices and political issues;

•delays or disruptions in shipping and transportation and related pricing impacts;

•disruption due to labor disputes; or

•changing expectations regarding product safety due to new legislation;

•our ability to successfully complete environmental, social and governance initiatives, and associated costs thereof;

•the geographic concentration of third-party manufacturing facilities and our distribution facilities in central Ohio;

•our reliance on a limited number of suppliers to support a substantial portion of our inventory purchasing needs;

•the ability of our vendors to deliver products in a timely manner, meet quality standards and comply with applicable laws and regulations;

•the spin-off of Victoria’s Secret may not be tax-free for U.S. federal income tax purposes;

•fluctuations in foreign currency exchange rates;

•fluctuations in product input costs;

•fluctuations in energy costs;

•our ability to adequately protect our assets from loss and theft;

•claims arising from our self-insurance;

•our and our third-party service providers’ ability to implement and maintain information technology systems and to protect associated data;

•our ability to maintain the security of customer, associate, third-party and Company information;

•stock price volatility;

•our ability to pay dividends and make share repurchases under share repurchase authorizations;

•shareholder activism matters;

•our ability to maintain our credit ratings;

•our ability to service or refinance our debt and maintain compliance with our restrictive covenants;

7

---

Table of Contents

•our ability to comply with laws, regulations, standards, technology platform rules or other requirements related to data privacy and cybersecurity;

•our ability to comply with regulatory requirements;

•legal and compliance matters; and

•tax, trade and other regulatory matters.

We are not under any obligation and do not intend to make publicly available any update or other revisions to any of the forward-looking statements contained in this report to reflect circumstances existing after the date of this report or to reflect the occurrence of future events even if experience or future events make it clear that any expected results expressed or implied by those forward-looking statements will not be realized.

The following discussion of risk factors contains “forward-looking statements.” These risk factors may be important to understanding any statement in this Annual Report on Form 10-K, other filings or in any other discussions of our business.” These risk factors may be important to understanding any statement in this Annual Report on Form 10-K, other filings or in any other discussions of our business. The following information should be read in conjunction with Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operation and Item 8. Financial Statements and Supplementary Data. The following information should be read in conjunction with Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operation and Item 8. Financial Statements and Supplementary Data.

In addition to the other information set forth in this report, the reader should carefully consider the following factors which could materially affect our business, results of operations, financial condition and/or cash flows. The risks described below are not our only risks. The risks described below are not our only risks. Additional risks and uncertainties not currently known or that are currently deemed to be immaterial may also adversely affect our business, results of operations, financial condition and/or cash flows in a material way. Additional risks and uncertainties not currently known or that are currently deemed to be immaterial may also adversely affect our business, results of operations, financial condition and/or cash flows in a material way.

Risks related to our business:

Our net sales, results of operations and cash flows are sensitive to, have been affected by and may in the future be further impacted by, general economic conditions, inflation, tariffs, consumer confidence, consumer spending patterns, significant health hazards or pandemics, severe weather or other market disruptions.

Our net sales, results of operations, cash flows and future growth may be affected by local, regional, national or international political or economic trends or developments that can reduce consumers’ ability or willingness to spend or alter consumer behavior and spending patterns. These trends and developments (including tariffs), which can vary substantially by country, include political, financial or social instability or conditions, geopolitical events, corruption, anti-American sentiment, social and ethnic unrest, military conflicts and terrorism, as well as changes in general economic conditions (including unemployment levels, inflation and market volatility). These risks, which can vary substantially by country, include political, financial or social instability or conditions, geopolitical events, corruption, anti-American sentiment, social and ethnic unrest, military conflicts and terrorism, as well as changes in general economic conditions (including unemployment levels, inflation and the recent market volatility and instability in the banking sector). For example, during 2022, 2023 and 2024, the global economy was negatively impacted by high inflation rates, which has resulted in higher prices that have negatively impacted and may continue to negatively impact consumer demand. In addition, market disruptions due to natural disasters, significant health hazards or pandemics or other major events or the prospect of these events could also impact or shift consumer spending and sentiment. Extreme weather conditions in the areas in which our stores are located, particularly in markets where we have multiple stores, or in the central Ohio region where most of our third-party manufacturers and our distribution centers are located, have adversely affected and could in the future adversely affect our business. During periods when economic or market conditions are unsettled or weak, purchases of our products have declined, and may in the future further decline. During periods when economic or market conditions are unsettled or weak, purchases of our products have declined, and may in the future decline. In such circumstances, we have increased, and may in the future continue to increase, the number of promotional sales which, when combined with inflationary cost pressures, have negatively affected our merchandise margin rates and, in the future, could have a material adverse effect on our results of operations, financial condition and cash flows. In such circumstances, we have increased, and may in the future continue to increase, the number of promotional sales, which, when combined with inflationary cost pressures, have negatively affected our merchandise margin rates and, in the future, could have a material adverse effect on our results of operations, financial condition and cash flows.

Our net sales, operating income, cash and inventory levels fluctuate on a seasonal basis.

We experience major seasonal fluctuations in our net sales and operating income, with a significant portion of our operating income and cash flows typically realized during the fourth quarter holiday season. Any decrease in sales or margins during this critical period could have a material adverse effect on our results of operations, financial condition and cash flows. Any decrease in sales or margins during this period could have a material adverse effect on our results of operations, financial condition and cash flows.

Seasonal fluctuations also affect our cash and inventory levels since we usually order merchandise in advance of peak selling periods and sometimes before new trends are confirmed by customer purchases. We must carry a significant amount of inventory, especially before the holiday season selling period. If we are not successful in selling inventory, we may have to sell the inventory at significantly reduced prices or may not be able to sell the inventory at all, which could have a material adverse effect on our results of operations, financial condition and cash flows. If we are not successful in selling inventory, we may have to sell the inventory at significantly reduced prices or may not be able to sell the inventory at all, which could have a material adverse effect on our results of operations, financial condition and cash flows.

We may be impacted by our ability to attract, develop and retain qualified associates and manage labor-related costs.

We believe one of our competitive advantages is providing positive, engaging and satisfying experiences for our diverse customer base, which requires us to have highly trained, engaged and diverse associates. Our success depends in part upon our ability to attract, develop and retain a sufficient number of qualified associates, including, but not limited to, store personnel, associates in our home office, distribution and fulfillment centers and key product and support talent. The turnover rate in the retail industry is generally high, and qualified individuals of the requisite caliber and number needed to fill these positions have

8

---

Table of Contents

been in short supply in some areas. Competition for such qualified individuals and shifts in the labor market, including availability of skilled talent, and continued changes and complexity in labor and healthcare laws have caused us to incur higher labor costs, and such increases in labor costs could continue in the future. Our inability to recruit a sufficient number of qualified individuals in the future may, among other things, delay planned openings of new stores, affect the speed with which we expand, or negatively impact our ability to timely and efficiently fulfill orders, to develop new merchandise and to launch new product lines. Delayed store openings, significant increases in associate turnover rates or significant increases in labor-related costs could have a material adverse effect on our results of operations, financial condition and cash flows.

In recent years, multiple retailers have faced unionization campaigns from their workers. If we are subject to a unionization campaign from our associates, we would incur significant expenses in the form of legal and consulting fees and potentially be subject to negative publicity that could significantly disrupt our operations and have an adverse effect on our results of operations, financial condition and cash flows.

An increase in the costs of associate wages, benefits and insurance (including workers’ compensation, general liability, property and health) has adversely affected, and could continue to adversely affect, our operating results.An increase in the costs of associate wages, benefits and insurance (including workers’ compensation, general liability, property and health) could adversely affect our operating results. In particular, labor shortages and the current competitive labor market have increased competition for qualified associates, which has compelled, and may continue to compel, us to pay higher wages to attract or retain qualified associates. In particular, labor shortages and the current competitive labor market have increased competition for qualified associates, which has compelled, and may continue to compel, us to pay higher wages to attract or retain qualified associates. Such increases in costs may result from general economic or competitive conditions or from government imposition of higher minimum wages at the federal, state or local level, including in connection with the increases in state minimum wages that have been enacted by various states. Such increases in costs may result from general economic or competitive conditions or from government imposition of higher minimum wages at the federal, state or local level, including in connection with the increases in state minimum wages that have recently been enacted by various states. Moreover, there may be a long-term trend toward higher wages in developing markets. Any increase in such operating expenses could have a material adverse effect on our results of operations, financial condition and cash flows. Any increase in such operating expenses could have a material adverse effect on our results of operations, financial condition and cash flows.

Turnover in Company leadership or other key positions, and our ability to attract and retain new talent, may have an adverse impact on Company performance.

We may experience changes in key leadership or key positions in the future. The departure of key personnel can result in the loss of significant knowledge and experience. The departure of key leadership personnel can result in the loss of significant knowledge and experience. This loss of knowledge, expertise and experience can be mitigated through successful internal succession planning or external hiring and transition, but there can be no assurance that we will be successful in such efforts. Attracting and retaining qualified senior leadership may be more challenging under adverse business conditions. Attracting and retaining qualified senior leadership may be more challenging under adverse business conditions. Failure to attract and retain the right talent or to smoothly manage the transition of responsibilities resulting from such turnover could affect our ability to meet our goals and may cause us to miss performance objectives or financial targets or disrupt our relationships with our customers, vendors or other third parties. Failure to attract and retain the right talent or to smoothly manage the transition of responsibilities resulting from such turnover could affect our ability to meet our challenges and may cause us to miss performance objectives or financial targets or disrupt our relationships with our customers, vendors or other third parties.

Our net sales depend on a volume of traffic to our stores and the availability of suitable lease space.

More than half of our stores are located in off-mall retail shopping areas with the remainder located in malls and other types of retail centers. Sales at these stores are derived, in part, from the volume of consumer traffic in those retail areas. Sales at these stores are derived, in part, from the volume of consumer traffic in those retail areas. Our stores benefit from the ability of the retail center and other attractions in an area, including “destination” retail stores, to generate consumer traffic in the vicinity of our stores. Sales volume and retail traffic may be adversely affected by factors that we cannot control, such as economic downturns, including due to inflationary or tariff pressures, or changes in consumer demographics in a particular area, consumer trends away from brick-and-mortar retail toward online shopping, competition from internet and other retailers and other retail areas where we do not have stores, significant health hazards or pandemics, the closing of other stores or the decline in popularity or safety in the shopping areas where our stores are located and the deterioration in the financial condition of the operators or developers of the shopping areas in which our stores are located. Sales volume and retail traffic may be adversely affected by factors that we cannot control, such as economic downturns, including due to inflationary pressures, or changes in consumer demographics in a particular area, consumer trends away from brick-and-mortar retail toward online shopping, competition from internet and other retailers and other retail areas where we do not have stores, significant health hazards or pandemics, the closing of other stores or the decline in popularity or safety in the shopping areas where our stores are located and the deterioration in the financial condition of the operators or developers of the shopping areas in which our stores are located.

Part of our future growth is significantly dependent on our ability to operate stores in desirable locations with capital investment and lease costs providing the opportunity to earn a reasonable return. We cannot be sure as to when or whether such desirable locations will become available at reasonable costs. We cannot be sure as to when or whether such desirable locations will become available at reasonable costs. Additionally, we are dependent upon the suitability of the lease spaces that we currently use. The leases that we enter into are generally noncancelable leases with initial terms of ten years. The leases that we enter into are generally noncancelable leases with initial terms of 10 years. If we determine that it is no longer economical to operate a store and decide to close it, we may remain obligated under the applicable lease for, among other things, payment of the base rent for the balance of the lease term. If we determine that it is no longer economical to operate a store and decide to close it, we may remain obligated under the applicable lease for, among other things, payment of the base rent for the balance of the lease term.

These risks could have a material adverse effect on our ability to grow and our results of operations, financial condition and cash flows.

Our continued growth and success depend in part on new store openings and existing store remodels and expansions.

Our continued growth and success depend in part on our ability to open and operate new, primarily off-mall stores and expand and remodel existing stores on a timely and profitable basis. Accomplishing our new and existing store expansion goals will depend upon a number of factors, including the ability to partner with developers and landlords to obtain suitable sites for new and expanded stores at acceptable costs and on acceptable timelines, the hiring and training of qualified personnel and the integration of new stores into existing operations. Accomplishing our new and existing store expansion goals will depend upon a number of factors, including the ability to partner with developers and landlords to obtain suitable sites for new and expanded stores at acceptable costs and on acceptable timelines, the hiring and training of qualified personnel and the integration of new stores into existing operations. There can be no assurance we will be able to achieve our store expansion goals, manage our growth effectively, successfully integrate the planned new stores into our operations or operate our new,

9

---

Table of Contents

remodeled and expanded stores profitably. These risks could have a material adverse effect on our ability to grow and our results of operations, financial condition and cash flows. These risks could have a material adverse effect on our results of operations, financial condition and cash flows.

Our international operations and our plans for international expansion include risks that could impact our results and reputation.

We intend to continue to operate internationally and further expand in our existing markets and into new international markets, including through franchise and other distribution-related partner arrangements. The risks associated with international markets include, among others, difficulties in attracting customers due to a lack of customer familiarity with our brand, our ability to comply with international laws and regulations, our lack of familiarity with local customer preferences, cultures or religious norms and seasonal differences in the international markets. Any of these difficulties may lead to disruption in the overall timing of our international expansion efforts, lower sales than we anticipate and increased costs. Further, entry into other markets may bring us into competition with new competitors or with existing competitors with an established presence in such markets. Such expansions will also have upfront investment costs, some of which may be significant, that may not be accompanied by sufficient revenues to achieve expected operational and financial performance. Such expansions will also have upfront investment costs that may not be accompanied by sufficient revenues to achieve expected operational and financial performance. Other risks include general economic conditions in specific countries or markets, reliance on franchise partners, service providers and other distribution-related partners that we do not control, volatility in the geopolitical landscape (including social and ethnic unrest, military conflicts and terrorism), anti-American sentiment, foreign governmental regulation and enforcement (including the risks of local tariffs and operating in markets in which there are uncertainties regarding the interpretation and enforceability of legal requirements and the enforceability of contract rights and intellectual property rights), legal actions, disruptions or delays in shipments, restrictions on the repatriation of funds held internationally, occurrence of significant health hazards or pandemics, changes in diplomatic and trade relationships and political instability. For example, the conflict in the Middle East has resulted in unpredictable conditions in the region and around the world, and has affected, and may continue to affect, our business and operations as a result of, among other things, the economic consequences and disruptions from such conflict, supply chain availability, consumer boycotts of Western brands, and consumer reaction to perceived acts or failures to act by us or our franchise partners including commencing and/or maintaining operations in countries or regions that are linked to such conflicts.

Further, our results of operations and financial condition may be adversely affected by fluctuations in currency exchange rates. See “Fluctuations in foreign currency exchange rates could impact our results of operations, financial condition and cash flows” below. See “Fluctuations in foreign currency exchange rates could impact our financial condition and results of operations” below.

All of the above risks could have a material adverse effect on our results of operations, financial condition and cash flows.

Our licensees, franchisees, wholesalers and other distribution-related partners could take actions that could harm our business or brand images.

We have global brand exposure through digital sites and stores independently owned and/or operated by our franchise partners and other distribution-related partners. Although we have criteria to evaluate and select prospective partners, the level of control we can exercise over our partners is limited, and the quality and success of their operations may be diminished by any number of factors beyond our control. Although we have criteria to evaluate and select prospective partners, the level of control we can exercise over our partners is limited, and the quality and success of their operations may be diminished by any number of factors beyond our control. For example, our partners may not have the business acumen or financial resources necessary to successfully operate stores in a manner consistent with our standards and may not hire and train qualified store managers and other personnel. For example, our partners may not have the business acumen or financial resources necessary to successfully operate stores in a manner consistent with our standards and may not hire and train qualified store managers and other personnel. Further, we primarily rely on our partners to comply with applicable laws and regulations in the international markets in which they operate. Further, we have no control as to whether our partners comply with applicable laws and regulations in the international markets in which they operate. Our brand image and reputation may suffer materially, and our sales could decline, if our partners do not operate successfully, including operating in compliance with applicable laws and regulations. Our brand image and reputation may suffer materially, and our sales could decline, if our partners do not operate successfully. These risks could have an adverse effect on our results of operations, financial condition and cash flows. These risks could have a material adverse effect on our results of operations, financial condition and cash flows.

Our direct channel business includes risks that could have a material adverse effect on our results.

Our direct channel (also referred to as digital or e-commerce) is subject to numerous risks that could have a material adverse effect on our results of operations, financial condition and cash flows. Such risks include, but are not limited to, the difficulty in recreating the in-store experience through our direct channels; domestic or international large scale buyers and resellers purchasing merchandise and reselling it outside our control; resellers competing against us on domestic or international platforms where we legitimately sell our goods, or competition on marketplaces; our ability to anticipate and implement innovations in technology and logistics in order to appeal to existing and potential customers who increasingly rely on multiple channels to meet their shopping needs; legal and regulatory developments associated with digital, data, analytics, artificial intelligence, communications and ad-targeting practices (including, without limitation, the use of technologies and third-party services to personalize or create concierge-like customer experiences); risks associated with increases in order fulfillment logistics costs; risks associated with the level of support provided by third party partners’ web infrastructure, websites and related support systems; and the failure of and risks related to the resources that underlay and support the operation of our and our third-party partners’ web infrastructure, websites and the related support systems, including computer viruses, malware (including, without limitation, ransomware), unauthorized access to and theft of customer information, privacy violations, fraudulent branded phishing sites impersonating our direct channel, ad scams causing customer confusion, information

10

---

Table of Contents

technology and vendor system failures, deepfakes and other malicious uses of artificial intelligence, disruption of critical services caused by threat actors and similar disruptions.

Our failure to maintain efficient and uninterrupted order-taking and fulfillment operations could also have a material adverse effect on our results of operations, financial condition and cash flows. We utilize third-party service providers for order management and for a majority of our fulfillment services. If these third-party service providers do not maintain efficient and uninterrupted service, we have experienced, and may in the future experience, merchandise delivery delays, loss of sales, stranded inventory, cancellation charges or excessive promotional activity to clear inventory. Further, we may have difficulty replacing these third-party service providers and there can be no assurance we can do so in a timely manner or on terms favorable to us. The satisfaction of our direct channel customers also depends on their timely receipt of merchandise. The satisfaction of our direct channel customers depends on their timely receipt of merchandise. If we encounter difficulties with the distribution and fulfillment facilities, or if the facilities were to shut down for any reason, including as a result of a pandemic, fire, severe weather, natural disaster or work stoppage, we could face shortages of inventory; we could incur significantly higher costs and longer lead times associated with distributing our products to our customers; we could face scrutiny by regulators and litigants; and our customers may be dissatisfied. If we encounter difficulties with the distribution facilities, or if the facilities were to shut down for any reason, including as a result of a pandemic, fire, natural disaster or work stoppage, we could face shortages of inventory; we could incur significantly higher costs and longer lead times associated with distributing our products to our customers; we could face regulatory scrutiny; and our customer may be dissatisfied.

Any of these issues could have a material adverse effect on our results of operations, financial condition and cash flows.

Our ability to protect our reputation could have a material adverse effect on our brand image.

Our ability to maintain our reputation is critical to our brand image. Our reputation could be jeopardized if we fail to maintain high standards for merchandise quality and integrity of the consumer’s experience in stores and online. Our reputation could be jeopardized if we fail to maintain high standards for store and merchandise quality and integrity. If third parties with which we have a business relationship, including our influencer network, fail to represent our brand in a manner consistent with our brand image, it could harm our reputation. Any negative publicity, including information publicized through traditional or social media platforms and similar venues such as websites, blogs and other forums, may affect our reputation and brand and, consequently, reduce demand for our merchandise and negatively impact our reputation, even if such publicity is unverified or inaccurate. Any negative publicity, including information publicized through traditional or social media platforms and similar venues such as blogs, websites and other forums, may affect our reputation and brand and, consequently, reduce demand for our merchandise, even if such publicity is unverified or inaccurate.

Failure to comply with or the perception that we have failed to comply with ethical, social, product, labor, privacy, systems and data security and environmental standards, or related political considerations, or that we have failed to ensure the safety of our stores and products, could also jeopardize our reputation and potentially lead to various adverse consumer actions, including boycotts. Failure to comply with applicable laws and regulations, to maintain an effective system of internal controls, to maintain the security of customer, associate, third-party and company information or to provide accurate and timely financial statement information could also hurt our reputation. Failure to comply with applicable laws and regulations, to maintain an effective system of internal controls, to maintain the security of customer, associate, third-party and company information or to provide accurate and timely financial statement information could also hurt our reputation. Damage to our reputation or loss of consumer confidence for any of these or other reasons could have a material adverse effect on our results of operations, financial condition and cash flows, as well as require additional resources to rebuild our reputation. Damage to our reputation or loss of consumer confidence for any of these or other reasons could have a material adverse effect on our results of operations, financial condition and cash flows, as well as require additional resources to rebuild our reputation.

If our marketing, advertising, promotional programs or loyalty program are unsuccessful, or if our competitors are more effective with their programs than we are, our results of operations, financial condition and cash flows may be adversely affected.

Customer traffic and demand for our merchandise are influenced by our advertising, marketing and promotional activities, the effectiveness of our loyalty program, the name recognition and reputation of our brand and the location of and service offered in our stores and through our direct business. Although we use marketing, advertising and promotional programs and our loyalty program to attract customers through various media, including social media, websites, mobile applications, email and print, and we continue to invest to improve the online and mobile user experience for our customers, some of our competitors may expend more for their programs than we do or use different or more efficient approaches than we do, which may provide them with a competitive advantage. Our financial forecasts are dependent on our marketing, advertising and promotional programs and our loyalty program enhancements driving customer acquisition and stronger customer retention. Our programs may not be effective or could require increased expenditures, which could have a material adverse effect on our results of operations, financial condition and cash flows. Our programs may not be effective or could require increased expenditures, which could have a material adverse effect on our results of operations, financial condition and cash flows.

Our ability to adequately maintain, enforce and protect our trade names, trademarks and patents could have an impact on our brand image and ability to penetrate new markets.

We believe that our trade names, trademarks and patents are important assets and an essential element of our strategy. We have obtained or applied for federal registration of these trade names, trademarks and patents and have applied for or obtained registrations in many foreign countries. We have obtained or applied for federal registration of these trade names, trademarks and patents and have applied for or obtained registrations in many foreign countries. There can be no assurance that we will obtain such applied for registrations or that the registrations we obtain will prevent the imitation of our products or infringement or other violation of our intellectual property rights by others. There can be no assurance that we will obtain such applied for registrations or that the registrations we obtain will prevent the imitation of our products or infringement or other violation of our intellectual property 14Table of Contentsrights by others. In particular, the laws of certain foreign countries may not protect proprietary rights to the same extent as the laws of the U.S. If any third party copies our products, our or our partners’ websites or our or our partners’ stores in a manner that projects lesser quality or carries a negative connotation, it could have a material adverse effect on our brand image and reputation as well as our results of operations, financial condition and cash flows.

11

---

Table of Contents

Third parties may assert rights in or ownership of our trademarks and other intellectual property rights, or trademarks that are similar to our trademarks, or claim that we are infringing, misappropriating or otherwise violating their intellectual property rights. We may be unable to successfully resolve these types of conflicts to our satisfaction and may be required to enter into costly license agreements, be required to pay significant royalties, settlement costs or damages, be required to rebrand our products and/or be prevented from selling some of our products. We may be unable to successfully resolve these types of conflicts to our satisfaction and may be required to enter into costly license agreements, be required to pay significant royalties, settlement costs or damages, be required to rebrand our products and/or be prevented from selling some of our products.

Our ability to compete favorably in our highly competitive segments of the retail industry could impact our results of operations, financial condition and cash flows.

The retail industry is highly competitive. We compete for sales with a broad range of other retailers, including individual and chain specialty stores, department stores and discount retailers. We compete for sales with a broad range of other retailers, including individual and chain specialty stores, department stores and discount retailers. In addition to the traditional store-based retailers, we also compete with direct marketers or retailers that sell similar lines of merchandise and who target customers through online channels. In addition to the traditional store-based retailers, we also compete with direct marketers or retailers that sell similar lines of merchandise and who target customers through online channels. Brand image, marketing, design, price, service, assortment, quality, innovation, image presentation and fulfillment are all competitive factors in both the store-based and online channels. Brand image, marketing, design, price, service, assortment, quality, image presentation and fulfillment are all competitive factors in both the store-based and online channels.

Some of our competitors may have greater financial, marketing and other resources available and trends across our product categories may favor our competitors. We rely to a greater degree than some of our competitors on physical locations in retail centers. We rely to a greater degree than some of our competitors on physical locations in retail centers. Therefore, declines in traffic to such locations may affect us more significantly than our competitors. Some of our competitors sell their products in stores that are located in the same retail centers as our stores. Some of our competitors sell their products in stores that are located in the same retail centers as our stores. In addition to competing for sales, we compete for favorable site locations and lease terms in retail centers. In addition to competing for sales, we compete for favorable site locations and lease terms in retail centers.

Increased competition, combined with declines in store and/or direct channel traffic, could result in price reductions, increased marketing expenditures and loss of pricing power and market share, any of which could have a material adverse effect on our results of operations, financial condition and cash flows.

Our ability to manage the life cycles of our brand and to remain current with trends and launch and expand new product lines successfully could impact the image and relevance of our brand.

Our success depends in part on management’s ability to effectively manage the life cycles of our brand, to anticipate and respond to changing preferences and consumer demands and to translate market trends into appropriate, saleable product offerings in advance of the actual time of sale to the customer. We are dependent on certain product categories and declines in customer demand in these product categories have negatively impacted, and may in the future impact, our results of operations, financial condition and cash flows. We are dependent on certain product categories, and a decline in customer demand in these product categories could negatively impact our results of operations, financial condition and cash flows. Our financial forecasts are dependent on our ability to drive growth through adjacent product categories, including men’s, fragrant haircare, laundry and lip. Customer demands and trends change rapidly. If we are unable to successfully anticipate, identify or react to changing preferences or trends, we misjudge the market for our products or any new product lines, or our launches or expansions of new product lines are unsuccessful, we may not be able to achieve the growth in our business that we currently anticipate. In response, we may be forced to increase our marketing, promotions or price markdowns and potentially discontinue a product line. In response, we may be forced to increase our marketing promotions or price markdowns and potentially discontinue a product line. These risks are particularly acute for us because of our reliance on innovation and the newness we offer to engage new and existing customers and could have a material adverse effect on our brand image and reputation as well as our results of operations, financial condition and cash flows.

We may be impacted by our ability to adequately source, distribute and sell merchandise and other materials on a global basis.

We source merchandise and other materials directly in domestic and international markets. We distribute merchandise and other materials globally to our franchise and other distribution-related partners in international locations and to our stores. Many of our imports and exports are subject to a variety of customs regulations and international trade arrangements, including existing or potential duties, tariffs or safeguard quotas. Many of our imports and exports are subject to a variety of customs regulations and international trade arrangements, including existing or potential duties, tariffs or safeguard quotas. We also compete with other companies for manufacturing facilities. We also compete with other companies for production facilities.

We also face a variety of other risks generally associated with doing business on a global basis. For example:

•political instability, geopolitical conflict, including the war between Russia and Ukraine and the conflict in the Middle East, environmental hazards or natural disasters, which could negatively affect international economies, financial markets and business activity;

•significant health hazards or pandemics, which could result in closed factories, distribution and fulfillment centers and/or stores, reduced workforces, scarcity of raw materials and scrutiny or embargoing of goods produced in impacted areas;

•imposition of new or retaliatory trade duties, sanctions, tariffs or taxes and other charges on imports or exports;

•evolving, new or complex legal and regulatory matters;

•volatility in currency exchange rates;

•local business practices and political issues (including issues relating to compliance with domestic or international labor standards) and anti-American sentiment, which may result in adverse publicity or threatened or actual adverse consumer actions, including boycotts;

•delays or disruptions in shipping and transportation and related pricing impacts;

12

---

Table of Contents

•disruption due to labor disputes; and

•changing expectations regarding product safety due to new laws or regulations or other factors.

Certain goods that we import are sourced from third-party suppliers in China. Our ability to successfully import such materials may be adversely affected by U.S. and Canadian laws and changes in those laws. The Uyghur Forced Labor Prevention Act (“UFLPA”) imposes a presumptive ban on the import of goods to the U.S. that are made, wholly or in part, in the Xinjiang Uyghur Autonomous Region of China (“XUAR”) or by persons that participate in certain programs in the XUAR that entail the use of forced labor. U.S. Customs and Border Protection (“CBP”) has published both a list of entities that are known to utilize forced labor, and a list of commodities that are most at risk, such as poly-vinyl chloride, cotton, tomatoes and silica-based products. Although none of our Chinese suppliers are located in the XUAR, we do not currently have full visibility to the entirety of each supplier’s separate sub-tier supply chains to be able to ensure that the raw materials or other inputs they use to manufacture their goods are not produced in the XUAR. Although none of our Chinese suppliers are located in the XUAR, we do not currently have full visibility to the entirety of each supplier's separate supply chains to be able to ensure that the raw materials or other inputs they use to manufacture their goods are not produced in the XUAR. Materials we import into the U.S. could be held by the CBP based on a suspicion that inputs used in such materials originated from the XUAR or that they may have been produced by Chinese suppliers accused of participating in forced labor, pending our providing satisfactory evidence to the contrary. Among other consequences, such an outcome could result in negative publicity that harms our brand and reputation and could result in a delay or complete inability to import such materials, which could result in inventory shortages and an increase in supply chain compliance costs.

We also rely upon third-party transportation providers for substantially all of our product shipments, including shipments to and from our distribution centers to our stores and fulfillment centers, and to our customers. Our utilization of these delivery services for shipments is subject to risks, including increases in labor costs and fuel prices, which would increase our shipping costs, and associate strikes and inclement weather, which may impact our transportation providers’ ability to provide delivery services that adequately meet our shipping needs. Our utilization of these delivery services for shipments is subject to risks, including increases in labor costs and fuel prices, which would increase our shipping costs, and associate strikes and inclement weather, which may impact our transportation providers’ ability to provide delivery services that adequately meet our shipping needs.

Our ability, or perceived inability, to complete environmental, social and governance (“ESG”) initiatives may have a material adverse effect on our reputation.

Investors, other stakeholders, the general public and U.S. and foreign governmental and nongovernmental organizations have been focused on ESG initiatives, including with respect to climate change, greenhouse gas emissions, packaging and waste, diversity, equity and inclusion, worker pay and benefits, human rights, sustainable supply chain practices, animal health and welfare, deforestation and land, energy and water use. We maintain an ESG function to provide direction and coordinate ESG work throughout the Company. Increased scrutiny of ESG initiatives by public, regulatory, investor and other stakeholders, including U.S. and foreign governmental agencies, may put pressure on us to adjust our disclosures in these areas, and make adjustments to our commitments, targets, or goals and take actions to meet or address such adjustments, which could expose us to market, operational, regulatory, legal and execution costs or risks. Our business may also face increased scrutiny related to ESG activities, including from U.S. and foreign governmental agencies, and potentially lead to enforcement actions and litigation. Setting these targets and goals or expanding or adjusting our disclosure or our failure, or perceived failure, to meet or properly adjust such targets and goals could adversely affect our reputation and, as a result, our business, financial performance and growth. Any harm to our reputation resulting from setting these metrics, targets and goals or expanding our disclosure or our failure, or perceived failure, to meet such metrics, targets and goals could adversely affect our business, financial performance and growth.

We rely on a number of manufacturing and distribution facilities located in the same vicinity, making our business susceptible to local and regional disruptions or adverse conditions.

To achieve the necessary speed and agility in supply of our inventory, we rely heavily on third-party manufacturing facilities and our distribution facilities in close proximity to our headquarters in central Ohio. As a result of the geographic concentration of many of the manufacturing and distribution facilities that we rely upon, our operations are susceptible to local and regional factors, such as accidents, system failures, economic and weather conditions, natural disasters (including as may be exacerbated by climate change), demographic and population changes and other unforeseen events and circumstances. As a result of geographic concentration of many of the vendor and distribution facilities that we rely upon, our operations are susceptible to local and regional factors, such as accidents, system failures, economic and weather conditions, natural disasters, demographic and population changes and other unforeseen events and circumstances. Any significant interruption in the operations of these facilities could lead to inventory issues, increased costs or interruptions to our operations, which could have a material adverse effect on our results of operations, financial condition and cash flows. Any significant interruption in the operations of these facilities could lead to inventory issues, increased costs or interruptions to our operations, which could have a material adverse effect on our results of operations, financial condition and cash flows.

A change in the relationship with our key vendors could have a material effect on our business.

We rely on a limited number of vendors (including manufacturers) to supply our inventory. In 2024, our largest vendor supplied approximately 15% of our total merchandise purchases (on a dollar basis) and our largest five vendors in the aggregate supplied approximately 40% of our total merchandise purchases (on a dollar basis). In 2022, our largest vendor supplied approximately 13% of our total merchandise purchases and our largest five vendors supplied approximately 38% of our total merchandise purchases on a combined basis. Our business depends on developing and maintaining close relationships with our vendors and on our vendors’ ability or willingness to sell quality products to us at competitive prices and on other favorable terms. Many factors outside of our control may impact these relationships and the ability or willingness of these vendors to sell us products on favorable terms. Many factors outside of our control may harm these relationships and the ability or willingness of these vendors to sell us products on favorable terms. For example, financial or operational difficulties that our vendors may face could increase the cost of the products we purchase from them or our ability to source products from them. For example, financial or operational difficulties that our vendors may face could increase the cost of the products we purchase from them or our ability to source products from them.

13

---

Table of Contents

We may be impacted by our vendors’ ability to manufacture and deliver products in a timely manner, meet quality standards and comply with applicable laws and regulations.

We purchase products from third-party vendors. Factors outside our control, such as production issues, shipping delays, quality problems, geopolitical conflicts and wars, outbreaks of disease, or natural disasters, could disrupt merchandise deliveries and result in lost sales, cancellation charges or excessive markdowns.

In addition, quality problems could result in product liability judgments or widespread product recalls that may negatively impact our sales and profitability for a period of time depending on product availability, reaction of competitors and consumer attitudes. Even if product liability claims are unfounded, unsuccessful or are not fully pursued, the negative publicity surrounding any assertions could adversely impact our reputation with existing and potential customers and our brand image. Even if product liability claims are unsuccessful or are not fully pursued, the negative publicity surrounding any assertions could adversely impact our reputation with existing and potential customers and our brand image.

Our business could also suffer if our third-party vendors fail to comply with applicable laws and regulations. While our internal and vendor operating guidelines promote ethical business practices and our associates and third-party compliance auditors visit and monitor the operations of our third-party vendors, we do not control these vendors or their practices. While our internal and vendor operating guidelines promote ethical business practices and our associates and third-party compliance auditors visit and monitor the operations of our third-party vendors, we do not control these vendors or their practices. Violations of labor, environmental or other laws by third-party vendors used by us or the divergence of a third-party vendor’s or partner’s labor or environmental practices from those generally accepted as ethical or appropriate could interrupt or otherwise disrupt the shipment of finished products to us or damage our reputation. Violations of labor, environmental or other laws by third-party vendors used by us or the divergence of a third-party vendor’s or partner’s labor or environmental practices from those generally accepted as ethical or appropriate could interrupt or otherwise disrupt the shipment of finished products to us or damage our reputation.

These risks could have a material adverse effect on our results of operations, financial condition and cash flows.

The spin-off of Victoria’s Secret could result in substantial tax liability to us and our stockholders.

We received an opinion of counsel to the effect that, for U.S. federal income tax purposes, the spin-off and certain related transactions qualify for tax-free treatment under certain sections of the Internal Revenue Code. However, the opinion relies on certain assumptions, representations and undertakings, including those relating to the past and future conduct of our business, and the opinion would not be valid if such assumptions, representations and undertakings were incorrect. However, the opinion relies on certain assumptions, representations and undertakings, including those relating to the past and future conduct of our business, and the opinion would not be valid if such assumptions, representations and undertakings were incorrect. Furthermore, the opinion is not binding on the Internal Revenue Service (“IRS”) or the courts. Furthermore, the opinion is not binding on the Internal Revenue Service ("IRS") or the courts. If, notwithstanding receipt of the opinion, the spin-off or certain related transactions are determined to be taxable, we would be subject to a substantial tax liability. If, notwithstanding receipt of the opinion, the spin-off or certain related transactions are determined to be taxable, we would be subject to a substantial tax liability. In addition, if the spin-off is taxable, each holder of our common stock who received shares of Victoria’s Secret common stock in connection with the spin-off would generally be treated as receiving a taxable dividend in an amount equal to the fair market value of the shares received.

Even if the spin-off otherwise qualifies as a tax-free transaction, the distribution would be taxable to us (but not to our stockholders) in certain circumstances if future significant acquisitions of our stock or the stock of Victoria’s Secret are determined to be part of a plan or series of related transactions that included the spin-off. In this event, the resulting tax liability could be substantial. In this event, the resulting tax liability could be substantial. In connection with the spin-off, we entered into a Tax Matters Agreement with Victoria’s Secret, pursuant to which Victoria’s Secret agreed to not enter into any transaction that could cause the spin-off or any related transactions to be taxable to us without our consent and to indemnify us for any tax liability resulting from any such transaction. In addition, these potential tax liabilities may discourage, delay or prevent a change of control of us. In addition, these potential tax liabilities may discourage, delay or prevent a change of control of us.

Fluctuations in foreign currency exchange rates could impact our results of operations, financial condition and cash flows.

We are exposed to foreign currency exchange rate risk with respect to our sales, profits, assets and liabilities denominated in currencies other than the U.S. dollar. In addition, our royalty arrangements are calculated based on sales in local currency and, as such, we are exposed to foreign currency exchange rate fluctuations. In addition, our royalty arrangements are calculated based on sales in local currency and, as such, we are exposed to foreign currency exchange rate fluctuations. Although we use foreign currency forward contracts to hedge certain foreign currency risks, these measures may not succeed in offsetting all of the short-term negative impacts of foreign currency rate movements on our business and results of operations, financial condition and cash flows. Although we use foreign currency forward contracts to hedge certain foreign currency risks, these measures may not succeed in offsetting all of the short-term negative impacts of foreign currency rate movements on our business and results of operations, financial condition and cash flows. Hedging would generally not be effective in offsetting the long-term impact of sustained shifts in foreign exchange rates on our business results. Hedging would generally not be effective in offsetting the long-term impact of sustained shifts in foreign exchange rates on our business results. As a result, the fluctuation in the value of the U.S. dollar against other currencies could have a material adverse effect on our results of operations, financial condition and cash flows.

Our results may be affected by fluctuations in product input costs.

Product input costs, including freight, labor and raw materials, fluctuate subject to price volatility caused by any fluctuation in aggregate supply and demand or other external conditions, such as inflationary conditions, weather and climate conditions, geopolitical conflicts and wars, energy costs, natural events or disasters, taxes and tariffs (including as a result of trade disputes), industry demand, labor shortages, transportation issues, fuel costs, product recalls, governmental regulation and other factors, all of which are beyond our control and in many instances are unpredictable. These factors may result in an increase in our product input costs. We may not be able to, or may elect not to, fully pass these increases on to our customers which may adversely impact our profit margins. We may not be able to, or may elect not to, fully pass these increases on to our customers which may adversely impact our profit margins. These risks could have a material adverse effect on our results of operations, financial condition and cash flows.

14

---

Table of Contents

Our results may be affected by fluctuations in energy costs.

Energy costs have fluctuated in the past and may fluctuate in the future due to changes in factors beyond our control, such as weather and climate conditions or natural events or disasters, taxes and tariffs (including as a result of trade disputes), industry demand, high demand for renewable energy, inflationary conditions, labor shortages, transportation issues, fuel costs, geopolitical conflicts and wars, governmental regulation and other factors. These fluctuations may result in an increase in our transportation costs for distribution, utility costs for our retail stores, distribution and fulfillment centers and other Company locations and costs to purchase products from third-party manufacturers. These fluctuations may result in an increase in our transportation costs for distribution, utility costs for our retail stores, distribution centers and other Company locations and costs to purchase products from our manufacturers. A continual rise in energy costs could adversely affect consumer spending and demand for our products and increase our operating costs, both of which could have a material adverse effect on our results of operations, financial condition and cash flows. A continual rise in energy costs could adversely affect consumer spending and demand for our products and increase our operating costs, both of which could have a material adverse effect on our results of operations, financial condition and cash flows.

Our results may be impacted by our ability to adequately protect our assets from loss and theft.

Our assets are subject to loss, including those caused by illegal or unethical conduct by associates, customers, vendors, partners or unaffiliated third parties (including from organized retail crime). We experience events that cause inventory shrinkage. Our inventory shrinkage rates have increased in recent years and may continue to increase, and we cannot assure that incidences of loss and theft will decrease in the future or that the measures we are taking will effectively reduce these losses. Higher rates of loss or increased security costs to combat theft could have a material adverse effect on our results of operations, financial condition and cash flows. Higher rates of loss 17Table of Contentsor increased security costs to combat theft could have a material adverse effect on our results of operations, financial condition and cash flows.

We self-insure certain risks and may be impacted by unfavorable claims experience.

We are self-insured for various types of insurable risks including associate medical benefits, workers’ compensation, property, general liability and automobile, up to certain stop-loss limits. Claims are difficult to predict and may be volatile. Claims are difficult to predict and may be volatile. Any adverse claims experience could have a material adverse effect on our results of operations, financial condition and cash flows. Any adverse claims experience could have a material adverse effect on our results of operations, financial condition and cash flows.

We have undertaken a multi-year initiative to upgrade our digital and information technology systems and capabilities. We significantly rely on our, and our third-party service providers’, ability to successfully implement, upgrade and sustain information technology systems and to protect associated data and system availability.

Following the substantial completion of our information technology separation from Victoria’s Secret in 2023, we have undertaken the IT Transformation Project, a multi-year project to significantly upgrade our digital and information technology systems and capabilities to, among other things, advance our data analytics capabilities, enhance our in-store and online customer experience, enable us to more effectively personalize our marketing, shopping and promotional experiences, enhance the security of and otherwise reduce risks associated with our IT systems, streamline our information technology operations and enable us to work more efficiently. We, together with our third-party service providers and vendors, maintain a complex ecosystem of information technology systems and environments that will be impacted by the IT Transformation Project. As with any significant information technology upgrade, the IT Transformation Project increases the risk of interruption of service, data loss and vulnerabilities, corruption of data, breach, failure of information technology systems to effectively communicate and other disruptions to our operations. Among other things, the CCPA requires covered companies to provide new disclosures to California consumers and provide such consumers data protection and privacy rights, including the ability to opt-out of certain disclosures of their personal information and the ability to access and delete personal information. Moreover, the IT Transformation Project could result in expenses and capital expenditures that substantially exceed the expenses and capital expenditures that we currently anticipate.

The success of our business depends, in part, on the secure and uninterrupted performance of our, and our third-party service providers’ and vendors’, information technology systems. Our information technology systems, as well as those of our service providers and vendors, are vulnerable to damage, interruption, service availability or breach from a variety of sources, including cyberattacks, ransomware attacks, deepfakes and other malicious uses of artificial intelligence, telecommunication and/or technology failures, malicious human acts, human errors and natural disasters. Moreover, despite maintaining comprehensive measures, some of our systems, e-commerce environments and servers and those of our service providers and vendors are potentially vulnerable to physical or electronic break-ins, malware (including, without limitation, ransomware), computer viruses and similar disruptive problems. Moreover, despite maintaining comprehensive measures, some of our systems, e-commerce environments and servers and those of our service providers and vendors are potentially vulnerable to physical or electronic break-ins, malware (including, without limitation, ransomware), computer viruses and similar disruptive problems. Such incidents have disrupted, and could in the future further disrupt, our operations (whether directly or due to disruptions of our service providers’ and vendors’ operations) including our ability to timely ship and track product orders and project inventory requirements and lead to interruptions or delays in our supply chain. Additionally, these types of problems could result in an actual or perceived breach of confidential customer, merchandise, financial, associate or other important information (including personal information), which could result in damage to our reputation, costly litigation, customer complaints, negative publicity, breach notification obligations, regulatory or administrative sanctions, inquiries, orders or investigations, indemnity obligations, damages for contract breach or penalties for violations of applicable laws or regulations. The increased use of smartphones, tablets, mobile devices and data applications and services may also heighten these and other operational risks. The increased use of smartphones, tablets and other mobile devices may also heighten these and other operational risks. Despite the precautions we have taken, unanticipated problems or events may nevertheless cause failures in, or unauthorized access to, our and our third-party service providers’ and vendors’ information technology systems. Despite the precautions we have taken, unanticipated problems or events may nevertheless cause failures in, or unauthorized access to, our and our third-party service providers’ and vendors' information technology systems. Sustained or repeated system disruptions that interrupt our ability to process orders and deliver products to the stores or directly to our customers, impact our ability to process transactions in our stores, impact our customers’ ability to access our websites and mobile applications in a timely manner or expose confidential customer, merchandise, financial, associate or other important information (including personal information), the risks of which may be

15

---

Table of Contents

heightened as we execute on the IT Transformation Project, could have a material adverse effect on our results of operations, financial condition and cash flows.

We use third-party service providers and vendors to store, transmit and otherwise process certain confidential customer, merchandise, financial, associate or other important information (including personal information) on our behalf, and our third-party service providers and vendors are subject to cybersecurity and privacy risks similar to us. Due to applicable laws and regulations or contractual obligations, we may be held responsible for any cybersecurity incidents or privacy violations attributed to our service providers or vendors as they relate to the information we share with them, information to which they are granted access, or information that they process for us to deliver services to our customers. Although we strive to contractually require these service providers and vendors to implement and maintain controls and a standard of security (such as implementing reasonable measures) and to comply with applicable law, we cannot control third parties and cannot guarantee that a security breach or privacy violation will not occur in connection with their systems and practices. Although we contractually require these service providers to implement and maintain a standard of security (such as implementing reasonable measures) and comply with applicable law, we cannot control third parties and cannot guarantee that a security breach or privacy violation will not occur in connection with their systems and practices.

Any significant compromise or breach of our data security, including the security of customer, associate, third-party or Company information, could have a material adverse effect on our reputation, results of operations, financial condition and cash flows.

In the operation of our business, we collect, use, transmit and otherwise process a large volume of personal and other confidential, proprietary and sensitive information. Information systems are susceptible to an increasing threat of continually evolving cybersecurity risks. Information systems are susceptible to an increasing threat of continually evolving cybersecurity risks. Breaches or failures of security involving our information systems, including those provided, managed and supported by any of our third-party service providers, have occurred, and in the future may occur. Breaches or failures of security involving our information systems, including those provided, managed and supported by Victoria's Secret & Co. Any significant compromise or breach of our data security, media reports about such an incident, whether accurate or not, or our failure to make adequate or timely disclosures to the public, regulatory agencies or law enforcement agencies following any such event, whether due to delayed discovery or a failure to follow existing protocols or regulations, could significantly damage our reputation with our customers, associates, investors and other third parties, cause the disclosure of personal, confidential, proprietary or sensitive customer, associate, third-party or Company information, cause interruptions to our operations and distraction to our management, cause our customers to stop shopping with us, inhibit our ability to attract new customers and result in significant legal, regulatory and financial liabilities and lost revenues. Any significant compromise or breach of our data security, media reports about such an incident, whether accurate or not, or our failure to make adequate or timely disclosures to the public or law enforcement agencies following any such event, whether due to delayed discovery or a failure to follow existing protocols, could significantly damage our reputation with our customers, associates, investors and other third parties, cause the disclosure of personal, confidential, proprietary or sensitive customer, associate, third-party or Company information, cause interruptions to our operations and distraction to our management, cause our customers to stop shopping with us, inhibit our ability to attract new customers and result in significant legal, regulatory and financial liabilities and lost revenues. Compounding these risks is the complexity of our information systems, which are a collection of our and our third-party service providers’ systems. Compounding these risks is the complexity of our information systems, which are a collection of our and our third-party service providers’ systems, and increased associated risks related to transitioning information systems from Victoria's Secret & Co.

While we train our associates, have implemented systems, processes and security measures to protect our physical facilities and information technology systems against unauthorized access and prevent data loss, and have vetted our third-party service providers’ systems, processes and security measures, there is no guarantee that these procedures are adequate to safeguard against all data security threats to us or our third-party service providers. Despite these measures, we have been and may in the future be vulnerable to targeted or random attacks on our systems that could lead to security breaches, denial of service, vandalism, computer viruses, malware, ransomware, misplaced, corrupted or lost data, programming and/or human errors or similar events. Despite these measures, we have been and may in the future be vulnerable to targeted or random attacks on our systems that could lead to security breaches, denial of service, vandalism, computer viruses, malware, ransomware, misplaced, corrupted or lost data, programming and/or human errors or similar events. Our systems and facilities (and the systems and facilities of our third-party service providers) are also subject to compromise from internal threats, such as theft, misuse, unauthorized access or other improper actions by associates, contractors and third-party service providers with otherwise legitimate access to our (or such third-party service providers’) systems, websites, mobile applications or facilities (which risks may be heightened as a result of our (or their) associates working from home). Our systems and facilities (and the systems of our third-party service providers) are also subject to compromise from internal threats, such as theft, misuse, unauthorized access or other improper actions by associates, contractors and third-party service providers with otherwise legitimate access to our (or such third-party service providers') systems, websites, mobile applications or facilities (which risks may be heightened as a result of our associates working-from-home). Furthermore, because the methods of cyberattack and deception change frequently, are increasingly complex and sophisticated and can originate from a wide variety of sources, including nation-state actors, despite our efforts to ensure the confidentiality, availability and integrity of our systems, websites and mobile applications, it is possible that we may not be able to anticipate, detect, appropriately react and respond to or implement effective preventative measures against all cybersecurity threats, and our third-party service providers may be subject to the same risks. Furthermore, because the methods of cyberattack and deception change frequently, are increasingly complex and sophisticated and can originate from a wide variety of sources, including nation-state actors, despite our reasonable efforts to ensure the confidentiality, availability and integrity of our systems, websites and mobile applications, it is possible that we may not be able to anticipate, detect, appropriately react and respond to or implement effective preventative measures against all cybersecurity incidents, and our third-party service providers may be subject to the same risks.

We have and may in the future be required to expend significant capital and other resources to protect against, respond to and recover from any potential, attempted or existing cybersecurity incidents. As cybersecurity incidents continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities. As cybersecurity incidents continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities. In addition, our remediation efforts may not be successful or may not be completed in a timely manner. In addition, our remediation efforts may not be successful or may not be completed in a timely manner. The inability to implement, maintain and upgrade adequate safeguards could have a material adverse effect on our results of operations, financial condition and cash flows. The inability to implement, maintain and upgrade adequate safeguards could have a material adverse effect on our results of operations, financial condition and cash flows. Moreover, there could be public announcements regarding cybersecurity incidents and any steps we take to respond to or remediate such incidents, and if securities analysts or investors perceive these announcements to be negative, it could, among other things, have a substantial adverse effect on the price of our common stock. Moreover, there could be public announcements regarding any cybersecurity incidents and any steps we take to respond to or remediate such incidents, and if securities analysts or investors perceive these announcements to be negative, it could, among other things, have a substantial adverse effect on the price of our common stock.

While we currently maintain cybersecurity insurance, such insurance may not be sufficient in type or amount to cover us against claims related to breaches, violations of law, failures or other data security-related incidents, and we cannot be certain that cybersecurity insurance will continue to be available to us on economically reasonable terms, or at all, or that any insurer will not deny coverage as to any future claim. The successful assertion of one or more large claims against us that exceed available insurance coverage or the occurrence of changes in our insurance policies, including premium increases or the

16

---

Table of Contents

imposition of large deductible or co-insurance requirements, could have a material adverse effect on our results of operations, financial condition and cash flows.

Risks related to our common stock:

Our stock price may be volatile.

Our stock price has fluctuated and may continue to fluctuate substantially as a result of variations in our actual or projected performance or the financial performance of other companies in the retail or consumer product industries. Any guidance that we provide is based on goals that we believe are reasonably attainable at the time guidance is given. Any guidance that we provide is based on goals that we believe are reasonably attainable at the time guidance is given. If, or when, we announce actual results that differ from those that have been forecasted by us, outside investment analysts or others, our stock price could be adversely affected. If, or when, we announce actual results that differ from those that have been predicted by us, outside investment analysts or others, our stock price could be adversely affected. Investors who rely on these forecasts when making investment decisions with respect to our securities do so at their own risk. Investors who rely on these predictions when making investment decisions with respect to our securities do so at their own risk.

The stock market in general has experienced extreme price and volume fluctuations that have often been unrelated or disproportionate to the operating performance of listed companies. In particular, our common stock may in the future be traded by short sellers which may put pressure on the supply and demand for our common stock, further influencing volatility in its market price. In particular, our common stock may in the future be traded by short sellers which may put pressure on the supply and demand for our common stock, further influencing volatility in its market price. Public perception and other factors outside of our control may additionally impact the stock price of companies like us that garner a disproportionate degree of public attention, regardless of actual operating performance. Public perception and other factors outside of our control may additionally impact the stock price of companies like us that garner a disproportionate degree of public attention, regardless of actual operating performance.

If we are unable to pay quarterly dividends or repurchase our shares at intended levels, our reputation and stock price may be impacted.

Quarterly cash dividends and share repurchase programs have historically been part of our capital allocation strategy. We are not required to declare dividends or make any share repurchases under our share repurchase programs in the future. For example, in 2020, we did not repurchase any of our shares, and we suspended our quarterly cash dividends due to the anticipated impact of the COVID-19 pandemic. Our Board will determine our future levels of dividend payments and share repurchase authorizations, if any, giving consideration to our levels of profit and cash flow, capital requirements, capital allocation strategy, current and forecasted liquidity and the restrictions placed upon us by our borrowing arrangements, as well as financial and other conditions which may be beyond our control. Our Board will determine our future levels of dividend payments and share repurchase authorizations, if any, giving consideration to our levels of profit and cash flow, capital requirements, current and forecasted liquidity and the restrictions placed upon us by our borrowing arrangements, as well as financial and other conditions which may be beyond our control. Any reduction, or failure, to pay dividends or repurchase our shares after we have announced our intention to do so may negatively impact our reputation, investor confidence in us and our stock price.

Shareholder activism could cause us to incur significant expense, impact the execution of our business strategy and have an adverse effect on our business.

Shareholder activism, which can take many forms and arise in a variety of situations, could result in substantial costs and divert our attention and resources from our business and our ability to execute our strategic plans. Additionally, such shareholder activism could give rise to perceived uncertainties as to our future, adversely affect our relationships with our associates, customers, service providers or other vendors and make it more difficult to attract and retain qualified personnel. Additionally, such shareholder activism could give rise to perceived uncertainties as to our future, adversely affect our relationships with our associates, customers or service providers and make it more difficult to attract and retain qualified personnel. Also, we may be required to incur significant fees and other expenses related to activist shareholder matters, including for third-party advisors. Also, we may be required to incur significant fees and other expenses related to activist shareholder matters, including for third-party advisors. Our stock price could be subject to significant fluctuation or otherwise be adversely affected by the events, risks and uncertainties of any shareholder activism.

Risks related to our indebtedness:

Our ability to maintain our credit ratings could affect our ability to access capital and could increase our interest expense.

The credit rating agencies periodically review our capital structure and the quality and stability of our earnings. A deterioration in our capital structure or the quality and stability of our earnings could result in a downgrade of our credit ratings. A deterioration in our capital structure or the quality and stability of our earnings could result in a downgrade of our credit ratings. Any negative ratings actions could constrain the capital available to us or our industry and could limit our access to funding for our operations. Any negative ratings actions could constrain the capital available to our Company or our industry and could limit our access to funding for our operations. We are dependent upon our ability to access capital at rates and on terms we determine to be attractive. We are dependent upon our ability to access capital at rates and on terms we determine to be attractive. If our ability to access capital becomes constrained, our interest costs may increase, we may not be able to fund future growth or we may not be able to meet some or all of our financial obligations, which could have a material adverse effect on our results of operations, financial condition and cash flows.

We may be unable to service or refinance our debt or maintain compliance with restrictive covenants in our debt instruments, including our asset-backed revolving credit facility.

We currently have substantial indebtedness. Our asset-backed revolving credit facility (the “ABL Facility”) contains a covenant and negative covenants that under certain circumstances require maintenance of a certain financial ratio and also, under certain conditions, restrict our ability to pay dividends, repurchase shares of our common stock and make other restricted payments as defined in the agreement. Our asset-backed revolving credit facility (the "ABL Facility") contains a covenant and negative covenants that under certain circumstances require maintenance of a certain financial ratio and also, under certain conditions, restrict our ability to pay dividends, repurchase shares of our common stock and make other restricted payments as defined in the agreement. Our cash flow from operations provides the primary source of funds for our debt service payments. Our cash flow from operations provides the primary source of funds for our debt service payments. If our cash flow from operations declines, we may be unable to service or refinance our current debt. If our cash flow from operations declines, we may be unable to service or refinance our current debt. If we fail to

17

---

Table of Contents

comply with any covenant, including our financial covenant, it could result in an event of default and our lenders could terminate the commitments under our ABL Facility and make the entire debt incurred thereunder immediately due and payable, or we may be forced to sell assets, restructure our indebtedness or seek additional equity capital, which would dilute our stockholders’ interests.

Risks related to laws and regulations:

Changes in laws, regulations, standards, technology platform rules or other requirements relating to privacy and cybersecurity, or any actual or perceived failure by us to comply with such laws, regulations, rules or contractual or other obligations relating to data privacy and cybersecurity, could have a material adverse effect on our reputation, results of operations, financial condition and cash flows.

We are, and may increasingly become, subject to various laws, directives, industry standards, rules and regulations, as well as contractual obligations, relating to data privacy and cybersecurity (including the use of artificial intelligence) in the jurisdictions in which we operate and may in the future operate. The legal and regulatory environment related to data privacy and cybersecurity is increasingly rigorous and rapidly evolving, with new requirements, constantly changing requirements, and new or novel interpretations of existing requirements applicable to our business, and enforcement actions and litigation are likely to remain uncertain for the foreseeable future. These laws and regulations may be interpreted and applied differently over time and from jurisdiction to jurisdiction, and it is possible that the laws and regulations will be interpreted and applied in ways that may have a material adverse effect on our results of operations, financial condition and cash flows. These laws and regulations may be interpreted and applied differently over time and from jurisdiction to jurisdiction, and it is possible that the laws and regulations will be interpreted and applied in ways that may have a material adverse effect on our results of operations, financial condition and cash flows.

In the U.S., data privacy and protection are regulated at federal, state and local levels. Various federal and state regulators, including governmental agencies like the SEC and the Federal Trade Commission, have adopted, or are considering adopting, laws and regulations concerning data privacy and cybersecurity and have prioritized data privacy and cybersecurity-related violations for enforcement actions. Various federal and state regulators, including governmental agencies like the Consumer Financial Protection Bureau and the Federal Trade Commission, have adopted, or are considering adopting, laws and regulations concerning privacy and data security and have prioritized privacy and data security violations for enforcement actions. Certain state laws are, and in the future may continue to be, more stringent or broader in scope, or offer greater individual rights, with respect to personal information than federal, international or other state laws, and such laws may differ from each other, all of which complicates compliance efforts and increases risks to our business.

These laws and regulations range from the “sectoral” variety (i.e., laws that govern specific practices, services or technologies) to omnibus laws (i.e., laws that comprehensively seek to govern all aspects of data processing practices). As an omnichannel retailer, we are subject to both. As an omnichannel retailer, we are subject to both.

In North America, we are subject to sectoral laws that impose different enforcement regimes, whether enforced by government agencies or class action and/or mass arbitration litigants, with fines and statutory damages that can result in significant exposure when applied to large customer segments. Illustrative of the sectoral variety are laws that govern telephonic communications (e.g., the Federal Telephone Consumer Protection Act), email communications (e.g., the Federal Controlling the Assault of Non-Solicited Pornography and Marketing Act and Canada’s Anti-Spam Legislation), the use of biometric technology (e.g., the Illinois Biometric Information Privacy Act), the printing of payment card numbers on certain transaction receipts (e.g., the Federal Fair and Accurate Credit Transactions Act), the use of call recordings (e.g., federal and state laws governing unlawful surveillance and consent for recordings), the collection of consumer information at retail point of sale (e.g., the California Song-Beverly Act), and the collection of driver’s license information (e.g., state laws governing the scanning of government identification).

We are further subject to omnibus data privacy and protection laws. For example, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the “CCPA”), broadly governs data privacy practices, increases privacy rights for California residents and imposes obligations on companies that process their personal information, including certain sensitive personal information. Among other things, the CCPA requires covered companies to provide disclosures to California consumers and provide such consumers data protection and privacy rights, including the ability to opt out of certain disclosures of their personal information and the ability to access and delete personal information. Among other things, the CCPA requires covered companies to provide new disclosures to California consumers and provide such consumers data protection and privacy rights, including the ability to opt-out of certain disclosures of their personal information and the ability to access and delete personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for certain data breaches that result in the loss of certain classifications of personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for certain data breaches that result in the loss of certain classifications of personal information. This private right of action may increase the likelihood of, and risks associated with, data breach litigation. This private right of action may increase the likelihood of, and risks associated with, data breach litigation. Other states and countries have passed omnibus data privacy laws that are similar to the CCPA, further complicating the legal landscape, and similar bills are making their way through several state legislatures. Other states and countries have passed comprehensive data privacy laws that are similar to the CCPA and CPRA, further complicating the legal landscape, and similar bills are making their way through several state legislatures. In addition, laws in all 50 U.S. states require businesses to provide notice to consumers (and, in some cases, to regulators) of data breaches, which are when certain types of personal information have been accessed, impacted or acquired without authorization. State laws are changing rapidly, and there have been deliberations in the U.S. Congress regarding a new comprehensive federal data privacy law to which we would become subject if one were to be enacted. Such a law could add complexity, variation in requirements, restrictions and potential legal risk. Such a law could add complexity, variation in requirements, restrictions and potential legal risk. Moreover, it could require additional investment of resources in compliance programs, impact strategies and the availability of previously useful data and result in increased compliance costs or changes in business practices and policies. Moreover, it could require additional investment of resources in compliance programs, impact strategies and the availability of previously useful data and result in increased compliance costs or changes in business practices and policies.

While most of our international operations are conducted through franchise, license, wholesale and other distribution-related arrangements, we are also subject to certain international laws, regulations, rules and standards in certain international

18

---

Table of Contents

jurisdictions and may be subject to additional international laws, regulations, rules and standards, whether existing or enacted in the future, that apply broadly to the collection, use, retention, security, disclosure, handling transfer and other processing of personal information. In Canada, we are subject to the Personal Information Protection and Electronic Documents Act (“PIPEDA”) as well as substantially similar provincial privacy laws (e. In Canada, we are subject to the Personal Information Protection and Electronic Documents Act (“PIPEDA”) as well as substantially similar provincial privacy laws. g., Quebec’s Law 25). These data privacy laws broadly govern the entire lifecycle of personal information, enumerating principles that govern accountability; purpose; consent; assessment; privacy by default; limitations on collection, use, disclosure and retention; accuracy; safeguards; transparency; data rights of access, correction and deletion; and complaint-handling. These privacy statutes broadly govern the entire lifecycle of personal information, enumerating principles that govern accountability; purpose; consent; limitations on collection, use, disclosure and retention; accuracy; safeguards; transparency; right to access and correct; and complaint-handling. Certain of the laws also contain a mandatory breach notification regime. Certain of the statutes also contain a mandatory breach notification regime. Canadian federal and provincial authorities and litigants enforce these laws. Canadian federal and provincial authorities enforce these laws. Privacy regulators have an express obligation to investigate complaints and have the authority to initiate investigations. Privacy regulators have an express obligation to investigate complaints and have the authority to initiate investigations. Under PIPEDA, the Office of the Privacy Commissioner of Canada has the power to require an organization to enter into a compliance agreement and failure to comply may result in a court order or court proceedings. Under PIPEDA, the Office of the Privacy Commissioner of Canada has the power to require an organization to enter into a compliance agreement and failure to comply may result in a court order or court proceedings. A complainant may also appeal to Federal Court, and the court has broad authority including awarding damages. A complainant may also appeal to Federal Court, and the court has broad authority including awarding damages. Similarly, the European Union’s (“EU”) General Data Protection Regulation (“GDPR”) imposes strict data privacy and cybersecurity requirements for handling personal data. Further, the GDPR was transposed into U.K. law (“U.K. GDPR”) as supplemented by the U.K.’s Data Protection Act of 2018, which currently imposes the same obligations as the GDPR in most material respects. Additionally, under the GDPR, EU member states have enacted certain implementing legislation that adds to and/or further interprets the GDPR requirements and, depending on the extent and degree to which we conduct business in the European Economic Area (“EEA”) and the U. Under the GDPR, EU member states have enacted certain implementing legislation that adds to and/or further interprets the GDPR requirements and, depending on the extent and degree to which we conduct business in the European Economic Area (“EEA”) and U. K., potentially extends our obligations and potential liability for failing to meet such obligations. The GDPR, together with national legislation, regulations and guidelines of the EEA states and the U. The GDPR, together with national legislation, regulations and guidelines of the EEA states and the U. K. GDPR governing the processing of personal data, impose strict obligations and restrictions on the ability to collect, use, retain, protect, disclose, handle, transfer and otherwise process personal data, and other international jurisdictions are expected to pass similar laws that may include even more stringent requirements. governing the processing of personal data, impose strict obligations and restrictions on the ability to collect, use, retain, protect, disclose, transfer and otherwise process personal data, and other international jurisdictions are expected to pass similar laws that may include even more stringent requirements. Changes in such international laws or changes in our business strategy such as direct expansions into additional jurisdictions may cause us to incur additional compliance costs, increase our risks of being subject to lawsuits, complaints and/or regulatory investigations or fines, or restrict our ability to transfer personal data between and among countries and regions in which we operate or may in the future operate. Changes in such international laws or changes in our business strategy such as direct expansions into additional jurisdictions may cause us to incur additional compliance costs, increase our risks of being subject to lawsuits, complaints and/or regulatory investigations or fines, or restrict our ability to transfer personal data between and among countries and regions in which we operate or may in the future operate. Such international laws, and our compliance with such laws, could impact the manner in which we do business and the geographical location or segregation of our relevant operations and could adversely affect our results of operations, financial condition and cash flows.

All of these evolving compliance and operational requirements impose significant costs, such as costs related to organizational changes, investing in and implementing additional data protection technologies and other safeguards and training associates and engaging third-party service providers, which are likely to increase over time. In addition, such requirements may require us to modify our data processing or cybersecurity practices and policies and distract management or divert resources from other initiatives and projects, all of which could have a material adverse effect on our results of operations, financial condition and cash flows. In addition, such requirements may require us to modify our data processing practices and policies and distract management or divert resources from other initiatives and projects, all of which could have a material adverse effect on our results of operations, financial condition and cash flows. Any failure or perceived failure by us or our partners to comply with any applicable federal, state or similar foreign laws, regulations, standards or rules relating to data privacy and cybersecurity could result in damage to our reputation and our relationship with our customers, as well as proceedings or litigation by governmental agencies or customers, including class- action data-privacy and -protection litigation in certain jurisdictions, which could subject us to significant fines, sanctions, awards, penalties or judgments, any of which could have a material adverse effect on our results of operations, financial condition and cash flows. Any failure or perceived failure by us or our partners to comply with any applicable federal, state or similar foreign laws and regulations relating to privacy and data security could result in damage to our reputation and our relationship with our customers, as well as proceedings or litigation by governmental agencies or customers, including class action privacy and data-protection litigation in certain jurisdictions, which could subject us to significant fines, sanctions, awards, penalties or judgments, any of which could have a material adverse effect on our results of operations, financial condition and cash flows.

We may be impacted by our ability to comply with legal and regulatory requirements.

We are subject to numerous legal and regulatory requirements. Our policies, procedures and internal controls are designed to comply with all applicable foreign and domestic laws and regulations, including those required by the Sarbanes-Oxley Act of 2002, the U.S. Foreign Corrupt Practices Act, the U.K. Bribery Act, the SEC and the New York Stock Exchange (“NYSE”), among others. Bribery Act, the SEC and the NYSE, among others. Although we have put in place policies and procedures aimed at ensuring legal and regulatory compliance, our associates, subcontractors, manufacturers, other vendors, licensees, franchisees and other third parties could take actions that violate these laws and regulations. Although we have put in place policies and procedures aimed at ensuring legal and regulatory compliance, our associates, subcontractors, vendors, licensees, franchisees and other third parties could take actions that violate these laws and regulations. Any violations of such laws or regulations could have an adverse effect on our reputation, the market price of our common stock and our results of operations, financial condition and cash flows. Any violations of such laws or regulations could have an adverse effect on our reputation, the market price of our common stock and our results of operations, financial condition and cash flows.

It can be difficult to comply with sometimes conflicting statutes or regulations in local, national or foreign jurisdictions as well as new or changing laws and regulations. Also, changes in such laws and regulations could make operating our business more expensive or require us to change the way we do business. Also, changes in such laws and regulations could make operating our business more expensive or require us to change the way we do business. For example, changes in product safety or other consumer protection laws could lead to increased costs for certain merchandise, increased research and development costs associated with product reformulations or new product lines, or additional labor costs associated with readying merchandise for sale. We operate stores in all 50 states, Canada and Puerto Rico, which requires us to comply with a myriad of provincial, state and local laws pertaining to all aspects of our business, including our associates and consumers. We operate stores in all 50 states, Canada and Puerto Rico, which requires us to comply with a myriad of provincial, state and local laws pertaining to all aspects of our business, including our associates and consumers. The trend for states and localities in the U.S. to legislate in the absence of national laws passed by the U.S. Congress has greatly increased the complexity of legal compliance for us. In addition, future domestic and international legislative and regulatory efforts to combat climate change or other environmental considerations could result in increased regulation and additional taxes and other expenses in a manner that

19

---

Table of Contents

adversely affects our business, financial performance and growth. It may be difficult for us to comply with these laws, compliance may be costly and compliance and associated costs may negatively impact our operations.

We may be adversely impacted by certain compliance or legal matters.

We, along with third parties we do business with, are subject to complex compliance and litigation risks. Actions filed against us from time to time include commercial, tort, intellectual property, product liability, tax, customer, employment, wage and hour, data privacy, securities, anti-corruption and other claims, including purported class action lawsuits and mass arbitration claims. The cost of defending against these types of claims against us or the ultimate resolution of such claims, whether by settlement or adverse court decision, may harm our business. The cost of defending against these types of claims against us or the ultimate resolution of such claims, whether by settlement or adverse court decision, may harm our business. Further, potential claimants may be encouraged to bring suits based on a settlement from us or adverse court decisions against us. Further, potential claimants may be encouraged to bring suits based on a settlement from us or adverse court decisions against us. We cannot currently assess the likely outcome of such suits, but if the outcome were negative, it could have a material adverse effect on our reputation, results of operations, financial condition and cash flows. We cannot currently assess the likely outcome of such suits, but if the outcome were negative, it could have a material adverse effect on our reputation, results of operations, financial condition and cash flows.

In addition, we may be impacted by litigation trends, including class action lawsuits involving consumers and stockholders, that could have a material adverse effect on our reputation, the market price of our common stock and our results of operations, financial condition and cash flows.

We may be impacted by changes in taxation, trade and other regulatory requirements.

We are subject to income tax in local, national and international jurisdictions. In addition, our products are subject to import and excise duties and/or sales or value-added taxes in many jurisdictions. In addition, our products are subject to import and excise duties and/or sales or value-added taxes in many jurisdictions. We are also subject to the examination of our tax returns and other tax matters by the IRS and other tax authorities and governmental bodies. We are also subject to the examination of our tax returns and other tax matters by the IRS and other tax authorities and governmental bodies. We regularly assess the likelihood of an adverse outcome resulting from these examinations to determine the adequacy of our provision for taxes. We regularly assess the likelihood of an adverse outcome resulting from these examinations to determine the adequacy of our provision for taxes. There can be no assurance as to the outcome of these examinations. There can be no assurance as to the outcome of these examinations. Fluctuations in tax rates and duties, changes in tax legislation or regulation or adverse outcomes of these examinations could have a material adverse effect on our results of operations, financial condition and cash flows. Fluctuations in tax rates and duties, changes in tax legislation or regulation or adverse outcomes of these examinations could have a material adverse effect on our results of operations, financial condition and cash flows.

There is increased uncertainty with respect to international tax policy and trade relations between the U.S. and other countries. The uncertainty results from, among other things, executive actions or legislative priorities taken, set or under consideration, by the current U.S. presidential administration, major developments in tax policy or trade relations (including the imposition of unilateral tariffs on imported products), and Organization for Economic Cooperation and Development actions adopted in certain jurisdictions. These actions, legislation and developments and the response by foreign governments to these actions could have a material adverse effect on our results of operations, financial condition and cash flows.

ITEM 1B. UNRESOLVED STAFF COMMENTS.

None.

ITEM 1C.ITEM 1A. CYBERSECURITY

The Company has developed an information security program to address material risks from cybersecurity threats and incidents, which is integrated within its overall enterprise risk management program. The program includes policies and procedures that identify how security measures and controls are developed, implemented and maintained. Under the information security program, the Company performs one or more cyber risk assessments each year based on recognized industry best practices and standards and cyber threat intelligence. The risk assessments, together with risk-based analysis and judgment, are used to determine security measures and controls to address identified risks. The Company considers the following factors, among others, during its risk and control implementation assessments: the likelihood and severity of the risk; the impact on the Company, the Company’s customers, associates and stockholders, and others if a risk materializes; the feasibility and cost of security measures and controls; and the impact of security measures and controls on operations and others.

The Company’s information security program currently includes the following security measures and controls, which are deployed as the Company deems applicable:

•endpoint threat detection and response;

•identity and access management;

•privileged access management;

•logging and monitoring involving the use of security information and event management;

•multi-factor authentication;

•firewalls and intrusion detection and prevention;

•web application firewalls and bot security tools; and

•vulnerability and patch management.

20

---

Table of Contents

All of the Company’s office-based associates and certain distribution and fulfillment center associates undergo mandatory security awareness training at the time of hiring and on an annual basis thereafter. The Company’s store-based associates receive ad hoc awareness communications and are provided with cybersecurity awareness materials as part of the store operating manual.

The Company uses third-party security firms in different capacities to provide or operate certain security measures and controls and technology systems, including cloud-based platforms and services. For example, third parties are used to conduct assessments, such as vulnerability scans and penetration testing. The Company also uses a variety of processes designed to address cybersecurity threats and incidents related to the use of third-party technology and services, including pre-acquisition diligence, imposition of contractual obligations and performance monitoring.

As part of the Company’s overall enterprise risk management program, the Company has developed business continuity and disaster recovery plans, which include measures designed to respond to potential disruptions to its information technology systems (or information technology systems of third parties on which it relies). The Company also maintains a written information security incident response plan and conducts tabletop exercises to enhance incident response preparedness. The Company is also a member of an industry cybersecurity intelligence and risk sharing organization.

The Company (or third parties on which it relies) may not be able to fully, continuously and effectively implement security measures and controls as designed or intended. As described above, the Company utilizes a risk-based approach and judgment to determine the security measures and controls to implement, and it is possible that the Company may not implement appropriate security measures and controls if management does not recognize, or underestimates, a particular risk. In addition, security measures and controls, no matter how well designed or implemented, may only partially mitigate, but not fully eliminate, risks. Cybersecurity threats and incidents, even when detected or foreseeable, may not always be immediately understood or acted upon by the Company (or by third parties on which it relies).

The Company, like many retailers, relies upon third-party service providers, such as payment processors, network providers and application providers, that have faced risks from threat actors and cybercriminal groups that seek to steal payment card data, consumer data, and other sensitive information; disrupt critical information technology systems; and/or demand ransom payments. Although the Company has implemented security measures and controls designed to address these risks, if these risks were to materialize, such as in the event of a cybersecurity incident causing the networks of a third-party payment processor to not be operational, the impact to the Company could be material.

The Company has not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, which have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations, or financial condition. However, the Company continues to face risks from cybersecurity threats and incidents that, if realized, may have such material effect. Despite its ongoing efforts, the Company cannot provide complete assurance that its information security program will be effective in detecting, preventing, or mitigating such cybersecurity risks. See also “We have undertaken a multi-year initiative to upgrade our digital and information technology systems and capabilities. We significantly rely on our, and our third-party service providers’, ability to successfully implement, upgrade and sustain information technology systems and to protect associated data and system availability” and “Any significant compromise or breach of our data security, including the security of customer, associate, third-party or Company information, could have a material adverse effect on our reputation, results of operations, financial condition and cash flows” in Item 1A. Risk Factors of this Annual Report on Form 10-K for a discussion of cybersecurity risks that could have a material impact on the Company, which sections should be read in conjunction with this Item 1C.

The Company’s Chief Information Security Officer (“CISO”) is the member of the management team with primary responsibility for the development, operation and maintenance of the Company’s information security program. The CISO holds a master of science degree in information assurance and has over 20 years of cybersecurity experience with Fortune 500 financial, defense, consulting and retail companies. The Audit Committee oversees the Company’s information security program at the Board level. The Audit Committee, which is composed entirely of independent members of the Board, receives reports directly from the CISO at least three times per year regarding the Company’s information security program, including reports regarding items such as cybersecurity policies and practices, cybersecurity program resources, third-party assessments of the Company’s information security program, key risks related to the Company’s information security program and the Company’s security measures and controls.

As described above, the Company maintains an information security incident response plan that includes processes and procedures for evaluating and escalating cybersecurity threats and incidents to, as determined to be appropriate, the Company’s executive management team and members of the Board. The initial impact level of each cybersecurity threat or incident is evaluated by a designated team of information security specialists using risk criteria that have been defined and approved by the Company’s executive management team and reviewed with the Audit Committee. If escalated, the threat or incident is evaluated by a cross-functional core and extended team, as applicable, of managers that includes the CISO and designated internal legal counsel with extensive cybersecurity experience, as well as identified associates from across the Company’s business and functions, as applicable. Cybersecurity threats and incidents are assigned incident impact levels based on the core

21

---

Table of Contents

team’s determination of potential impact to the Company. The core team employs defined risk criteria to classify incidents and escalate incidents accordingly. Based on the severity classification assigned by the core team, incidents may be escalated to, as applicable, representatives of the Company’s executive management team (which includes the Disclosure Committee), the Chairs of the Board and the Audit Committee, other members of the Audit Committee and/or the full Board.

The Company has an Enterprise Risk Management function that oversees the identification, prioritization and mitigation of the Company’s enterprise risks, and cybersecurity is a risk category addressed by that function. The Company uses governance, risk and compliance tools designed to assess, identify and manage its cybersecurity risks.

Recently Filed

Click on a ticker to see risk factors

Ticker *	File Date
HMBL	1 day, 21 hours ago
LIMX	2 days ago
PBH	2 days, 8 hours ago
MCK	2 days, 21 hours ago
CELU	2 days, 21 hours ago
MINR	3 days ago
TBH	3 days, 21 hours ago
NVEC	3 days, 22 hours ago
SAR	3 days, 23 hours ago
AIXN	4 days, 6 hours ago
SUAC	4 days, 18 hours ago
NCRA	4 days, 22 hours ago
HIGR	4 days, 22 hours ago
LVPA	5 days, 3 hours ago
CVLT	5 days, 23 hours ago
JOCM	6 days, 8 hours ago
OAKU	1 week, 1 day ago
LGSP	1 week, 1 day ago
DGLY	1 week, 1 day ago
VNCE	1 week, 1 day ago
WBSR	1 week, 1 day ago
KIRK	1 week, 1 day ago
STRM	1 week, 2 days ago
MRKY	1 week, 3 days ago
CSLR	1 week, 3 days ago
CHMX	1 week, 3 days ago
KORE	1 week, 3 days ago
SCPX	1 week, 3 days ago
FORL	1 week, 3 days ago
KATX	1 week, 4 days ago
ITOX	1 week, 4 days ago
PWDY	1 week, 4 days ago
VHAI	1 week, 4 days ago
NAYA	1 week, 4 days ago
GLST	1 week, 4 days ago
GITS	1 week, 4 days ago
FRST	1 week, 4 days ago
ETWO	1 week, 4 days ago
KIDZ	1 week, 4 days ago
CRWE	1 week, 4 days ago
KAYS	1 week, 5 days ago
SRRE	1 week, 5 days ago
STRG	1 week, 5 days ago
JMTM	1 week, 5 days ago
NTRB	1 week, 5 days ago
EVLV	1 week, 5 days ago
QIND	1 week, 6 days ago
CASK	1 week, 6 days ago
GDLG	2 weeks, 1 day ago
TRMB	2 weeks, 1 day ago

OTHER DATASETS

House Trading

Dashboard

Corporate Flights

Dashboard

App Ratings

Dashboard

TRADE SMARTER

with our free, cutting-edge alternative data platform

Please enter user name

Password too short

Sign in

Don't have an account? Sign Up for Free

Forgot password?

TRADE SMARTER

with our free, cutting-edge alternative data platform

Please enter user name

Please enter valid email

Password too short

Password too short

Sign Up

I already have an account, Sign In

App Store (iOS)

Play Store (Android)