of possible controls and procedures. We carried out an evaluation, under the supervision and with the participation of our management, including our Chief Executive Officer and Chief Financial Officer, of the effectiveness of the design and operation of our disclosure controls and procedures as of the end of the period covered by this report. Based on that evaluation, the Chief Executive Officer and Chief Financial Officer concluded that our disclosure controls and procedures were effective at the reasonable assurance level as of October 1, 2024.
Changes in Internal Control over Financial Reporting
There have been no changes in our internal control over financial reporting (as defined in Rules 13a-15(f) and 15d-15(f) under the Securities Exchange Act of 1934) during the fiscal quarter ended October 1, 2024 that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.
PART II — OTHER INFORMATION
Item 1. Legal Proceedings.
See Note 7 of Notes to Condensed Consolidated Financial Statements in Part I, Item 1 of this report.
Item 1A. Risk Factors.
A description of the risk factors associated with our business is contained in Part I, Item 1A, “Risk Factors,” of our Annual Report on Form 10-K for the fiscal year ended January 2, 2024 (“Annual Report”). These cautionary statements are to be used as a reference in connection with any forward-looking statements. The factors, risks and uncertainties identified in these cautionary statements are in addition to those contained in any other cautionary statements, written or oral, which may be made or otherwise addressed in connection with a forward-looking statement or contained in any of our subsequent filings with the SEC.
Except as set forth below, there have been no material changes in our risk factors since the filing of our Annual Report.
If any of our third-party vendors experiences a failure that affects a significant aspect of our business, we may experience data loss, increased costs, operational disruption or other harm, any of which could materially adversely affect our financial performance.
In order to leverage our internal resources and information technology infrastructure, and to support our business continuity and disaster recovery planning efforts, we rely on third-party vendors to provide some of our essential business processes. For example, we rely on a network of third-party distribution warehouses to deliver ingredients and other materials to our restaurants. In some instances, these processes rely on technology and may be outsourced to the vendor in their entirety and in other instances we utilize these vendors’ externally-hosted business applications. Our vendors’ systems have experienced cybersecurity incidents, including credential stuffing attacks in which compromised user credentials were used to breach the systems, and are vulnerable to a variety of risks, including, without limitation, theft, casualties such as fire, power loss, telecommunications failure or other catastrophic events, as well as from internal and external cybersecurity threats, including from diverse threat actors, such as state-sponsored organizations, opportunistic hackers and hacktivists, as well as through diverse attack vectors, such as malfeasance by insiders, human or technological error, malicious code embedded in open-source software, or misconfigurations, “bugs” or other vulnerabilities in commercial software that is integrated into our (or our suppliers’ or service providers’) network infrastructure, products or services, security breaches, denial of service attacks, viruses, worms, malware, ransomware, social engineering/phishing, breaches of the algorithms used to encrypt and protect data and other malicious, or disruptive or unauthorized events that jeopardize the confidentiality, integrity or availability of information systems or information residing therein, including confidential information and personal information (each, a “Cybersecurity Incident” and collectively, “Cybersecurity Incidents”). For example, in July 2024, we experienced disruptions to our information technology systems as part of the CrowdStrike software update that resulted in global information technology outages, including disruptions to our ability to process customer payments at certain of our restaurants. While we experienced this disruption for a limited period of time, the incident did not have a significant impact on our business. We also rely on third party services to effectively operate our restaurants including, for example, gift card distribution and transaction processing services, point-of-sale system services, online ordering services and food delivery services, and our Cheesecake Rewards® program. We derive substantial revenue from these aspects of our business, which could suffer in the event of any factor that adversely impacts our vendors’ ability to provide such services. Such factors include, without limitation, loss of, or significant change in contractual terms of, key vendor contracts, vendor or processor failures, technology failures, changes in applicable laws or regulations, Security