XML 52 R27.htm IDEA: XBRL DOCUMENT v3.25.3
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Sep. 30, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
We face various cybersecurity risks, including those related to unauthorized access to and misuse of data, system interruptions, ransomware, malicious software and other threats. Our cybersecurity program incorporates information technology, retail technology and customer products designed to mitigate cyber risks. Our security measures are customized to meet our unique business requirements and encompass firewalls, intrusion detection and prevention systems, encryption and multi-factor authentication. We also engage external experts to enhance and assess our cybersecurity measures in the form of maturity assessments, incident response, penetration testing and other advisory services. We adhere to the practices and standards outlined by the National Institute of Standards and Technology Cyber Security Framework.
We employ continual monitoring of our systems and data, managed by an external detection and response firm. In the event of a cyber incident, we maintain an incident response plan coordinated across multiple departments. This strategy is designed for rapid and effective incident management to minimize operational disruption. Our response protocol includes steps for detection, containment, eradication, recovery and post-incident review, including impact on safety, data loss, operational disruption, cost and potential reputational damage.
Recognizing our employees as a vital defense mechanism, we provide cybersecurity, privacy and information-handling training. Additionally, we conduct regular phishing exercises to enhance employee vigilance. Our educational programs aim to raise awareness about cyber risks and teach employees to safeguard the Company, our customers and themselves against cyber threats. These programs inform our workforce about the latest cybersecurity dangers and safe online practices, including secure access, phishing awareness, remote work security and reporting suspicious activities.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]
We face various cybersecurity risks, including those related to unauthorized access to and misuse of data, system interruptions, ransomware, malicious software and other threats. Our cybersecurity program incorporates information technology, retail technology and customer products designed to mitigate cyber risks. Our security measures are customized to meet our unique business requirements and encompass firewalls, intrusion detection and prevention systems, encryption and multi-factor authentication. We also engage external experts to enhance and assess our cybersecurity measures in the form of maturity assessments, incident response, penetration testing and other advisory services. We adhere to the practices and standards outlined by the National Institute of Standards and Technology Cyber Security Framework.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]
Our cybersecurity governance framework is structured to promote accountability and ongoing enhancement of cybersecurity measures. Management of the cybersecurity program involves cross-functional resources, our Cyber and Technology Risk Committee, an internal multi-departmental committee formed to address cyber and data privacy matters. The cybersecurity program is led by our Chief Information Security Officer (“CISO”) who has 20 years of relevant work experience and, together with other members of our information technology, security, and compliance teams, maintains expertise in overseeing cybersecurity programs and in leading internal teams and third-party consultants and providers. This expertise includes designing and implementing cybersecurity strategies, identifying risks, and managing incident response, with requisite knowledge of security standards. The CISO reports to our Chief Legal Officer, and our Internal Audit Department monitors and reviews our cybersecurity initiatives.
The Board of Directors is responsible for overseeing and monitoring the material risks facing the Company. The Audit and Risk Committee of the Board is charged with overseeing our risk management framework, including cybersecurity risks. The CISO provides reports on cybersecurity matters and risks directly to the Audit and Risk Committee on a quarterly basis.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] The Board of Directors is responsible for overseeing and monitoring the material risks facing the Company. The Audit and Risk Committee of the Board is charged with overseeing our risk management framework, including cybersecurity risks. The CISO provides reports on cybersecurity matters and risks directly to the Audit and Risk Committee on a quarterly basis.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] The Board of Directors is responsible for overseeing and monitoring the material risks facing the Company. The Audit and Risk Committee of the Board is charged with overseeing our risk management framework, including cybersecurity risks. The CISO provides reports on cybersecurity matters and risks directly to the Audit and Risk Committee on a quarterly basis.
Cybersecurity Risk Role of Management [Text Block]
Our cybersecurity governance framework is structured to promote accountability and ongoing enhancement of cybersecurity measures. Management of the cybersecurity program involves cross-functional resources, our Cyber and Technology Risk Committee, an internal multi-departmental committee formed to address cyber and data privacy matters. The cybersecurity program is led by our Chief Information Security Officer (“CISO”) who has 20 years of relevant work experience and, together with other members of our information technology, security, and compliance teams, maintains expertise in overseeing cybersecurity programs and in leading internal teams and third-party consultants and providers. This expertise includes designing and implementing cybersecurity strategies, identifying risks, and managing incident response, with requisite knowledge of security standards. The CISO reports to our Chief Legal Officer, and our Internal Audit Department monitors and reviews our cybersecurity initiatives.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] Management of the cybersecurity program involves cross-functional resources, our Cyber and Technology Risk Committee, an internal multi-departmental committee formed to address cyber and data privacy matters. The cybersecurity program is led by our Chief Information Security Officer (“CISO”) who has 20 years of relevant work experience and, together with other members of our information technology, security, and compliance teams, maintains expertise in overseeing cybersecurity programs and in leading internal teams and third-party consultants and providers. This expertise includes designing and implementing cybersecurity strategies, identifying risks, and managing incident response, with requisite knowledge of security standards. The CISO reports to our Chief Legal Officer, and our Internal Audit Department monitors and reviews our cybersecurity initiatives.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] The cybersecurity program is led by our Chief Information Security Officer (“CISO”) who has 20 years of relevant work experience and, together with other members of our information technology, security, and compliance teams, maintains expertise in overseeing cybersecurity programs and in leading internal teams and third-party consultants and providers. This expertise includes designing and implementing cybersecurity strategies, identifying risks, and managing incident response, with requisite knowledge of security standards.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block]
We employ continual monitoring of our systems and data, managed by an external detection and response firm. In the event of a cyber incident, we maintain an incident response plan coordinated across multiple departments. This strategy is designed for rapid and effective incident management to minimize operational disruption. Our response protocol includes steps for detection, containment, eradication, recovery and post-incident review, including impact on safety, data loss, operational disruption, cost and potential reputational damage.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true