We identify and assess material risks from cybersecurity threats to our information systems and the information residing in those systems through ongoing monitoring of our technology environment, review of vulnerabilities and incidents, assessment of third-party hosting and service-provider risks, and consideration of the sensitivity of the education, student, campus, enterprise and institutional data processed by our systems. Our assessment also takes into account the data leakage incident described under “Item 3. Key Information-D. Risk Factors-Risks Related to Our Business and Industry-Unauthorized disclosure, destruction or modification of data, through cybersecurity breaches, computer viruses or otherwise or disruption of our services could expose us to liability, protracted and costly litigation and damage our reputation.”

We manage material risks from cybersecurity threats through processes and procedures that may include, depending on the applicable system and operating environment, access controls, credential management, network security controls, vulnerability remediation, backup and recovery procedures, cloud and server configuration review, incident identification and escalation procedures, employee awareness, third-party technical support, and internal controls within our accounting and financial reporting functions. Following the 2023 data leakage incident described in this annual report, we implemented remediation measures required by the Cyberspace Affairs Office of Nanchang, including closing relevant external network ports and servers, destroying data and hard disks associated with the affected server, rectifying the relevant server room and cooperating with regulatory inspection and acceptance procedures.

As Smart Campus Services, HanLink, Cogni AI and other AI application initiatives expand, our cybersecurity processes must address not only historical student learning data but also campus operations data, institutional and enterprise documents, private-deployment environments, third-party hosting or service-provider risks and international data flows.

Other than the 2023 data leakage incident described in Item 3.D, which resulted in an administrative fine of RMB 200,000 and remediation measures and which we do not believe materially affected our financial condition or results of operations, we are not aware of any cybersecurity threats or cybersecurity incidents during fiscal year 2026 that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, future cybersecurity incidents could materially affect us, including through operational disruption, regulatory action, litigation, reputational harm, loss of customers or partners, increased costs or changes to our data and technology practices.

Governance

Our board of directors oversees cybersecurity risk management as part of its oversight of enterprise risk management, disclosure controls and compliance. Management reports cybersecurity matters to the board of directors or appropriate board committee when significant cybersecurity risks, incidents or remediation matters arise. The board of directors also oversees the Company’s assessment of whether cybersecurity incidents, if any, require disclosure under applicable SEC rules, including through Form 6-K or this annual report. The board of directors’ oversight role includes reviewing management updates regarding significant cybersecurity risks, incident-response matters, remediation status, materiality assessments and related disclosure determinations, including whether any cybersecurity incident requires disclosure under applicable SEC rules.

Within management, responsibility for assessing and managing material risks from cybersecurity threats is shared among senior management and technology personnel, including our chief executive officer, chief technology officer and personnel responsible for information systems and data security. These personnel are responsible for identifying, assessing, escalating and responding to cybersecurity risks and incidents, with support from internal staff and external advisors or service providers as appropriate.

As of the date of the filing of this annual report with the SEC, other than the 2023 data leakage incident described in this annual report, we have not identified any cybersecurity incidents or cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.