Risk Factors Update Summary

• A successful cyber incident could result in financial losses, regulatory fines, and reputational harm.
• Adding a resource buffer to address surges in demand may enhance our ability to prevent cyber incidents.
• Implementing emission reduction targets may significantly increase operational costs and capital expenditures.
• Human error or cyber-attack methods could affect our systems or those of third parties.
• International conflicts like the Russia-Ukraine conflict can impact fuel price volatility.
• Extreme weather conditions could cause interruptions to our rail network, potentially affecting operations.
• Economic factors like inflationary pressures and high interest rates may affect our financial condition.