KNIGHT-SWIFT TRANSPORTATION HOLDINGS INC.

Swift Transportation Co. of Arizona, LLC notified the New Hampshire Attorney General on June 1, 2026, of a cybersecurity event involving four NH residents. Unauthorized access to a single employee's email account occurred on March 9, 2026, discovered on March 25, 2026. Files accessed contained names, Social Security numbers, and/or driver's license numbers. Swift secured the account, notified law enforcement, and mailed notifications offering one year of Experian credit monitoring.

Swift Transportation Co. of Arizona, LLC notified Massachusetts residents of a data breach involving personal information. The company provided two years of Experian IdentityWorks credit monitoring and identity protection services to affected individuals. Specific details regarding the attack vector, scope, or date of the incident are not disclosed in this notice.

Swift Transportation Co. of Arizona, LLC reported an external system breach (hacking) occurring on March 9, 2026, discovered on April 15, 2026. The incident affected 1,417 individuals, including 1 Maine resident. Swift provided written notification and offered one year of credit monitoring and identity theft protection services through Experian.

Swift Transportation Co. of Arizona LLC reported a data breach to the Indiana Attorney General. The breach occurred on 2026-03-09 and was reported on 2026-06-01. 14 Indiana residents were affected. 1,417 individuals affected in total.

Knight-Swift Transportation Holdings Inc. disclosed in its 10-K Item 1C that it has not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on the Company. While the Company has experienced past cyberattacks, they were mitigated by preventative, detective, and responsive measures. The Company maintains a robust cybersecurity risk management strategy, including incident response teams, third-party assessments, employee training, and insurance.

Knight-Swift Transportation Holdings Inc.'s Form 10-K Item 1C cybersecurity disclosure describes its risk management strategy, governance, and incident response program. The Company states it has not identified any cybersecurity threats that have materially affected, or are reasonably anticipated to materially affect, the organization, though it acknowledges experiencing prior cyberattacks that it believes have been mitigated. No specific incident, affected individual count, threat actor, or data types are disclosed.