Jewett Cameron Trading Co. Ltd.

Lumber & Wood Production • Basic Materials • North Plains, OR, United States • JCTC (NCM)

Quarter: Q4 2025 Reported: October 21, 2025 Sentiment: Negative

Jewett-Cameron Trading Company Ltd., through its subsidiaries, engages in the manufacturing and distribution of pet, fencing, and other products. The company operates through Pet, Fencing and Other; and Industrial Wood Products segments. It offers fencing products under the Adjust-A-Gate, Fit-Right, Lifetime Steel Post, Euro Fence, Perimeter Patrol, and Cedar Fencing brand names; and pet products under the Lucky Dog brand name. The company also provides sustainable and post-consumer recycled bag products, including food waste, yard waste, and pet poop bags under the MyEcoWorld brand name. In addition, it offers specialty wood products; noise and vibration reduction panels for transit buses, motor coaches, light rail cars, and boats; acoustical panel under the dB-Ply brand name; and structural panels for a range of industrial applications, as well as jumbo concrete forms. Further, the company is involved in wholesale distribution to home centers, other retailers, on-line, and direct to end consumers. It operates in the United States, Canada, Mexico, Latin America, the Caribbean, Europe, and the Asia Pacific. The company was founded in 1953 and is headquartered in North Plains, Oregon.

Analysis Summary

Nature of Report: This report is an 8-K filing detailing a material cybersecurity incident that occurred on October 15, 2025, and does not contain the Q4 2025 financial results for Jewett-Cameron Trading Co. Ltd. (JCTC). The company is preparing its Annual Report on Form 10-K for the fiscal year ended August 31, 2025, which is expected in mid-November.

Cybersecurity Incident Details: On October 15, 2025, JCTC learned of unauthorized access to portions of its information technology (IT) environment. A threat actor deployed encryption and monitoring software, causing disruptions and limiting access to business applications. The company proactively took affected systems offline as a precautionary measure.

Company Response and Mitigation: JCTC promptly activated its cyber incident response process, notifying law enforcement and retaining external cybersecurity experts. The company has since closed the point of unlawful access and bolstered its cyber defensive capabilities. It believes the unauthorized activity has been contained and is methodically bringing systems back online, expecting to reach full operational capability shortly.

Data Compromise and Ransom Threat: The investigation confirmed that certain information was exfiltrated. This includes IT-related data, financial information being gathered for the upcoming 10-K filing, and images from video meetings and computer screens potentially containing sensitive company information. The threat actors have issued a ransom demand, threatening public release of this data if payment is not made.

Financial and Operational Impact: The incident has caused significant operational disruptions, which are expected to materially impact the Company's financial results for the first quarter of fiscal 2026 due to extended system downtime. While the costs associated with the response are largely expected to be covered by JCTC's cyber security insurance policy, the operational impact remains a concern.

Ongoing Investigation and Data Sensitivity: The full scope, nature, and impact of the incident are still under investigation. As of this report, there is no current evidence that personally identifiable information (PII) of employees, customers, suppliers, or vendors has been compromised, though analysis continues.

Financial Performance & Guidance: No Q4 2025 financial results or forward guidance (beyond the impact of the incident on Q1 2026) are provided in this 8-K filing.

Competitive Positioning & Market Trends: Not applicable to this specific 8-K filing.

Analyst Q&A Highlights: Not applicable as this is a regulatory filing, not an earnings call transcript with Q&A.

Key Highlights

• Material cybersecurity incident reported on October 15, 2025.
• Unauthorized access, deployment of encryption/monitoring software, and data exfiltration occurred.
• Exfiltrated data includes IT info, financial prep data for 10-K, and video meeting images.
• Threat actors issued a ransom demand to prevent public data release.
• Incident caused significant operational disruptions and is expected to materially impact Q1 2026 financial results.
• Company activated incident response, engaged law enforcement and experts, and believes the intrusion is contained.
• Costs associated with the incident are largely expected to be covered by cyber security insurance.

Financial Metrics

eps

YoY: Not reported in this filing

revenue

N/A

YoY: Not reported in this filing

guidance

net income

N/A

YoY: Not reported in this filing

Stock Performance (90 Days)

Data through May 18, 2026

Positive Signals

• Immediate activation of cyber incident response process.
• Engagement of law enforcement and external cybersecurity experts.
• Belief that unauthorized activity has been contained.
• Costs largely covered by the Company's cyber security insurance policy.
• Diligently working to bring impacted IT systems back online, expecting full operational capability shortly.

Risks & Concerns

— Material impact on operations and Q1 2026 financial results due to extended system downtime.
— Threat of public release of sensitive Company information by threat actors if ransom is not paid.
— Uncertainty regarding the full scope, nature, and impact of the incident.
— Potential for compromise of personally identifiable information (PII) despite current lack of evidence.
— Ongoing disruption to business applications and corporate functions.