On April 13, 2026, Itron, Inc. (the “Company” or “Itron”) was notified that an unauthorized third party had gained access to certain of its systems.
The Company activated its cybersecurity response plan and launched an investigation with the support of external advisors to assess, mitigate, remediate, and contain the unauthorized activity. The Company’s response efforts included proactively notifying law enforcement.
The Company took action to remediate and remove the unauthorized activity and has not observed any subsequent unauthorized activity within its corporate systems. Further, no unauthorized activity was observed in the customer hosted portion of its systems.
As a result of the Company’s contingency plans and data backup systems, the Company’s operations have continued in all material respects. In addition, Itron currently expects that a significant portion of its direct costs incurred relating to the incident will be reimbursed by its insurers.
The Company is evaluating what legal filings and regulatory notifications might be required because of this incident and intends to take appropriate action based on its review and findings.
While the Company’s investigation and assessment of this incident is ongoing, the Company does not currently believe the incident has had or is reasonably likely to have a material impact on the Company.
Certain Forward-Looking Statements
This Form 8-K contains forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995, including statements regarding the Company’s current beliefs, understanding and expectations regarding the incident and its remediation and investigation. Factors that could cause actual results to differ materially from those indicated in the forward-looking statements include, but are not limited to, the results of the Company’s analysis of the scope and details of the incident and the discovery of new or additional information; the success of the Company’s containment, mitigation and remediation efforts; the unauthorized release of any of the Company’s data, including third party data held by the Company, or the use of any such data for any fraudulent purposes; potential loss or destruction of Company data or adverse impacts to the Company’s operations; any potential adverse impact of the incident on the Company’s results of operations and financial condition; diversion of management’s attention from operations of the Company to addressing the incident; potential investigations, litigation, fines, costs and losses related to the incident and its remediation; potential adverse effects on relationships with customers, suppliers and other third parties as a result of the incident; reputational risk related to the incident; regulatory scrutiny of the incident; risks related to the availability of the Company’s insurance coverage; and other risks listed described in Part I, Item 1A: Risk Factors included in our Annual Report on Form 10-K for the year ended December 31, 2025 and other reports on file with the Securities and Exchange Commission.