W.W. GRAINGER, INC.

Grainger's 10-K Item 1C cybersecurity disclosure describes the company's risk management framework, governance structure, and cybersecurity posture. No material cybersecurity incident is reported. Grainger states it does not believe any past cybersecurity incidents have had, or are reasonably likely to have, a material adverse effect on the company.

W.W. Grainger Inc. reported a data breach to the Oregon Attorney General. The breach was reported on 2018-04-20. The breach occurred during 9/26/2017 - 10/12/2017. The breach was discovered on 4/10/2018. 17,902 individuals were affected. Notice was sent on 4/18/2018.

W.W. Grainger, Inc. reported a third-party data breach involving its online chat service provider, [24]7.ai. The incident occurred between September 26, 2017, and October 12, 2017, potentially exposing credit card numbers, security codes, expiration dates, names, and addresses of customers who used guest checkout. Grainger engaged forensic experts, notified law enforcement and credit card companies, and offered one year of identity monitoring via Kroll.

Grainger, Inc. reported a data breach to the Montana Attorney General. The breach was reported on 2018-04-17. The breach occurred from 9/26/2017 to 10/12/2017. 65 Montana residents were affected.

W.W. Grainger, Inc. reported a data breach to the Oregon Attorney General. The breach was reported on 2017-09-20. The breach occurred during 8/23/2017 - 8/23/2017. The breach was discovered on 8/24/2017. 57,992 individuals were affected. Notice was sent on 9/18/2017.

W.W. Grainger, Inc. reported the theft of an employee's laptop on August 23, 2017. The device contained personal information of current and former employees and their dependents, including names, contact information, Social Security numbers, dates of birth, and employee benefits information. Grainger disabled the employee's credentials and set the laptop to auto-wipe. No evidence of data access was found. The company offered one year of complimentary identity monitoring through Kroll.

W. W. Grainger, Inc. reported to HHS on 2017-09-18 a Theft affecting 1594 individuals. Breached information located on Laptop. An employee's laptop containing PHI (names, DOB, SSN, addresses) was stolen from an unlocked vehicle. WWGI implemented administrative safeguards and retrained staff.

W.W. Grainger, Inc., a business sector entity reported a theft or mistake incident to the Washington Attorney General. The organization became aware of the incident on 2017-08-23 and filed notice on 2017-09-18. 725 Washington residents were affected. 26 days elapsed between awareness and notification. 0 days to identify the breach. 0 days to contain the breach.

W.W. Grainger, Inc. reported a data breach to the Montana Attorney General. The breach was reported on 2017-09-18. The breach occurred from 8/23/2017 to 8/25/2017. 57 Montana residents were affected.

W.W. Grainger, Inc. identified a coding error in its mobile apps that resulted in the unsecured storage of usernames and passwords. The issue was discovered on October 27, 2015, and immediately fixed. No payment card or other personal information was affected. Passwords were reset as a precaution.