CHARLES RIVER LABORATORIES INTERNATIONAL, INC.

Previous report

We have in the past experienced and in the future could experience unauthorized access into our information systems.

Previous report

We operate large and complex information systems that contain significant amounts of client data. As a routine element of our business, we collect, analyze and retain substantial amounts of data pertaining to the non-clinical studies we conduct for our clients. Unauthorized third parties could attempt to gain entry to such information systems to steal data or disrupt the systems or for financial gain. Like other companies, we have on occasion experienced, and will continue to experience, threats and incursions to our data and systems, including malicious software and viruses, phishing, business email compromise and social engineering attacks, network intrusions, or other cyber-attacks. The number and complexity of these threats continue to increase over time. These threats also may be further enhanced in frequency or effectiveness through threat actors’ use of artificial intelligence technologies, which are becoming more widely adopted and increasingly sophisticated.

Previous report

In response to past cybersecurity incidents, we have implemented additional security safeguards and continually work to enhance existing safeguards; however, such efforts may not be successful, in which case we could suffer significant harm.

Previous report

We are at risk of being targeted, and we have in the past been victim to, business email compromise fraud, which results in payments being made to illegitimate bank accounts. Although these instances have not resulted in our incurring material losses, if similar instances occur in the future, we may incur such losses.

Previous report

We have recently become aware of unauthorized access to certain information systems of the Company. The incident involved a social engineering attack in which a threat actor impersonated a trusted party and obtained employee access credentials from a small number of employees. We identified the incident and immediately activated our cyber incident response plan to contain the intrusion, assess and investigate the incident and implement remedial measures. Based on the information reviewed to date, we believe the unauthorized activity has been contained and did not result in any material disruption to our information systems. We are currently in the process of ascertaining what, if any, information was exfiltrated, including whether there was any compromise of sensitive and/or personal identifiable information contained within the accessed information systems. As of the date hereof, the Company believes that this cybersecurity incident has not had a material impact on the Company’s financial systems, operations or financial condition due in part to the Company’s previously implemented security safeguards.

Previous report

As a result of this or any cybersecurity incident, we may be subject to business disruptions or governmental investigations, private litigation or other claims, which could result in fines, other monetary relief, or injunctive relief that could materially increase our data security costs, adversely impact how we operate our systems and collect and use personal information. If, as a result of any such governmental investigation, other investigation or claim, we are found to be in violation of applicable laws and regulations including, without limitation, any applicable data privacy and information security laws or regulations, we could be subject to legal risk, including governmental enforcement action and civil litigation, which could adversely affect our business, reputation, financial condition or results of operations. Defending any such litigation claim or enforcement action, regardless of merit, and whether successful or unsuccessful, and cooperating with regulatory investigations, could be expensive and time-consuming and adversely affect our business, reputation, results of operations or financial condition. In addition, we may be adversely impacted by reputational harm or a loss of confidence in the security and integrity of our information systems among customers, employees and business partners. There can be no assurance, however, that this cybersecurity incident or any future cybersecurity incidents will not have a material impact on the Company’s future operations, financial systems or financial condition.

Previous report

We leverage software and hardware solutions from technology and services providers, including software-as-a-service and public cloud infrastructure, who have been subject to cybersecurity incidents in the past and may have incidents or breaches in the future. As of the date of this filing, to our knowledge, no prior cybersecurity incident or breach at a third party has had a material impact on our business. However, future incidents or breaches could cause us to suffer significant harm.

Previous report

Our contracts with our clients typically contain provisions that require us to keep confidential the information generated from the studies we conduct. In the event the confidentiality of such information is compromised, whether by unauthorized access or other breaches, we could be exposed to significant harm, including termination of customer contracts, damage to our customer relationships, damage to our reputation and potential legal claims from customers, employees and other parties. In addition, we may face investigations by government regulators and agencies as a result of a breach.

Previous report

Additionally, the rapid ongoing evolution and increased adoption of emerging technologies such as artificial intelligence and machine learning may make it more difficult to anticipate and implement protective measures to recognize, detect, and prevent the occurrence of any of the cyber events described above.

Previous report

For information regarding our processes and practices related to information and cybersecurity, please see our Annual Report on Form 10-K for fiscal year 2025 as filed with the SEC on February 18, 2026, specifically Section 1C “Cybersecurity”.