XML 49 R30.htm IDEA: XBRL DOCUMENT
v3.25.3

Cybersecurity Risk Management and Strategy Disclosure | 12 Months Ended
--- | ---
Oct. 03, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items] |
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | Risk Identification We employ a risk-based approach for our cybersecurity program in which the level of controls are based upon asset value and organizational risk. Consequently, our cybersecurity program has a layered approach to cyber controls focused on protection of the confidentiality, integrity, and availability of sensitive data (both internal and third party). Our CISO and cybersecurity organization are actively engaged within the cybersecurity threat intelligence community in order to monitor emerging trends and developments, attack vectors, and best practices for identifying and mitigating cyber threats. Risk Assessment Our cybersecurity team monitors the cyber risk climate on an ongoing basis and performs cyber risk assessments at both tactical and strategic levels that are integrated into our overall risk management processes. These risk assessments may review various issues such as Payment Card Industry Data Security Standard compliance and cyber vulnerability on an enterprise and application level. Risk Management We have a global information security program responsible for creating cybersecurity policies, including an overarching Global Information Security Policy, that takes into account the National Institute of Standards & Technology Cybersecurity Framework (“NIST CSF”) and regulatory requirements. Our CISO is responsible for oversight of the cybersecurity program, supervision of the members of the team, and implementation of our layered cybersecurity measures, which include a documented security architecture program, endpoint detection, security incident response and event management and recovery, and privileged access management, among others. Likewise, logical access controls are employed to manage and provision access based upon business need, and data encryption is leveraged to preserve data confidentiality. Data is regularly backed up in support of preserving availability. Audit logs are collected, correlated and analyzed by the Security Operations Center (“SOC”). We provide all salaried employees, including new hires, cybersecurity training courses that sensitize them to risks and threat actor tactics. We also provide specialized security and data privacy training for certain employees, such as those handling sensitive or protected health information. On a quarterly basis, our cybersecurity organization conducts simulated phishing exercises to test and educate employees on real-world threats. We engage third-party service providers as part of our cyber risk mitigation efforts. We contractually require vendors with access to personal information to maintain sufficient cybersecurity and data privacy standards. As part of our PCI compliance program, we assess vendors with access to payment card data on an annual basis, and we review other critical vendors periodically and on an as-needed basis. We also maintain relations with local and federal law enforcement in connection with cybersecurity matters. In fiscal 2025, we engaged an independent cybersecurity advisory firm to lead a cybersecurity crisis simulation exercise that has been used by our senior leaders to prepare for a possible cyber crisis. In addition, we engaged an international cybersecurity company, specializing in IT services and software development, to augment our monitoring, incident response, detection, and forensics efforts; various Information Sharing and Analysis Centers (ISACs) for threat intelligence, and a recognized cyber defense company that specializes in threat intelligence and incident response services. We purchase insurance to mitigate the potential financial consequences of cybersecurity incidents. We regularly review our cyber insurance program, assessing our coverage and policy terms. During the normal course of business, we have experienced and expect to continue to experience a range of cyber-based attacks and other attempts to compromise our information systems, although none, to our knowledge, has had a material adverse effect on our business, financial condition, or results of operations. For additional information about cybersecurity risks, see Item 1A. “Risk Factors.”
Cybersecurity Risk Management Processes Integrated [Flag] | true
Cybersecurity Risk Management Processes Integrated [Text Block] | Our cybersecurity team monitors the cyber risk climate on an ongoing basis and performs cyber risk assessments at both tactical and strategic levels that are integrated into our overall risk management processes. These risk assessments may review various issues such as Payment Card Industry Data Security Standard compliance and cyber vulnerability on an enterprise and application level.
Cybersecurity Risk Management Third Party Engaged [Flag] | true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Text Block] | During the normal course of business, we have experienced and expect to continue to experience a range of cyber-based attacks and other attempts to compromise our information systems, although none, to our knowledge, has had a material adverse effect on our business, financial condition, or results of operations.
Cybersecurity Risk Board of Directors Oversight [Text Block] | Our Board of Directors has delegated primary responsibility for the oversight of cybersecurity to the Audit Committee, which reviews and oversees our programs, policies, practices and safeguards relating to: information technology, data privacy and protection, cybersecurity and fraud, identification, assessment, monitoring, mitigation and the overall management of those risks, and our cyberattack incident response and recovery plan. The Audit Committee receives regular reports from our Chief Information Officer (CIO) and CISO on, among other things, our cyber risks and threats, the status of measures to strengthen our cybersecurity systems, assessments of our Cybersecurity program, and our views of the emerging threat landscape. During fiscal 2025, substantially all of our directors attended the Audit Committee meetings in which the Committee received updates relating to cybersecurity.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | Our CISO, who reports directly to our CIO, is responsible for the day-to-day management of the Cybersecurity program and mitigation of cybersecurity risks, and supervises our SOC. Our CISO sets our cybersecurity strategy, oversees relevant policies, and manages the risk, assurance, and internal security reporting processes.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | Our CISO, who reports directly to our CIO, is responsible for the day-to-day management of the Cybersecurity program and mitigation of cybersecurity risks, and supervises our SOC. Our CISO sets our cybersecurity strategy, oversees relevant policies, and manages the risk, assurance, and internal security reporting processes. Our CISO also oversees the Cybersecurity Incident Response Team (“CSIRT”), which receives updates regarding and conducts initial evaluations of critical and emerging risks and reports on such risks to senior management, as necessary. We utilize a security incident response framework that is led by our CISO and supported by the CSIRT with the goal of both ensuring timely notification to our management and the Audit Committee, or the Board of Directors as appropriate, and mitigation of cybersecurity incidents. Our CISO also sits on our Disclosure Committee.
Cybersecurity Risk Role of Management [Text Block] | Our CISO, who reports directly to our CIO, is responsible for the day-to-day management of the Cybersecurity program and mitigation of cybersecurity risks, and supervises our SOC. Our CISO sets our cybersecurity strategy, oversees relevant policies, and manages the risk, assurance, and internal security reporting processes. Our CISO also oversees the Cybersecurity Incident Response Team (“CSIRT”), which receives updates regarding and conducts initial evaluations of critical and emerging risks and reports on such risks to senior management, as necessary. We utilize a security incident response framework that is led by our CISO and supported by the CSIRT with the goal of both ensuring timely notification to our management and the Audit Committee, or the Board of Directors as appropriate, and mitigation of cybersecurity incidents. Our CISO also sits on our Disclosure Committee. Our CISO brings over twenty years of broad technology leadership experience focused in the domains of cybersecurity, software engineering, and enterprise architecture. With a career spanning global organizations across different industries, such as retail, food service, defense and financial software, our CISO holds the following certifications: Certified Information Security Manager (CISM) by the Information Systems Audit and Control Association, Certified Information Systems Security Professional (CISSP) and Certified Cloud Security Professional (CCSP), both by the International Information System Security Certification Consortium.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | Our CISO, who reports directly to our CIO, is responsible for the day-to-day management of the Cybersecurity program and mitigation of cybersecurity risks, and supervises our SOC. Our CISO sets our cybersecurity strategy, oversees relevant policies, and manages the risk, assurance, and internal security reporting processes. Our CISO also oversees the Cybersecurity Incident Response Team (“CSIRT”), which receives updates regarding and conducts initial evaluations of critical and emerging risks and reports on such risks to senior management, as necessary
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | Our CISO brings over twenty years of broad technology leadership experience focused in the domains of cybersecurity, software engineering, and enterprise architecture. With a career spanning global organizations across different industries, such as retail, food service, defense and financial software, our CISO holds the following certifications: Certified Information Security Manager (CISM) by the Information Systems Audit and Control Association, Certified Information Systems Security Professional (CISSP) and Certified Cloud Security Professional (CCSP), both by the International Information System Security Certification Consortium.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | Our CISO also oversees the Cybersecurity Incident Response Team (“CSIRT”), which receives updates regarding and conducts initial evaluations of critical and emerging risks and reports on such risks to senior management, as necessary. We utilize a security incident response framework that is led by our CISO and supported by the CSIRT with the goal of both ensuring timely notification to our management and the Audit Committee, or the Board of Directors as appropriate, and mitigation of cybersecurity incidents. Our CISO also sits on our Disclosure Committee.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardOfDirectorsOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementExpertiseOfManagementResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleReportToBoardFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskManagementProcessesForAssessingIdentifyingAndManagingThreatsTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K + Details
Name: | cyd_CybersecurityRiskManagementStrategyAndGovernanceLineItems
Namespace Prefix: | cyd_
Data Type: | i:stringItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskManagementThirdPartyEngagedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskMateriallyAffectedOrReasonablyLikelyToMateriallyAffectRegistrantFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskMateriallyAffectedOrReasonablyLikelyToMateriallyAffectRegistrantTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskProcessForInformingBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskProcessForInformingManagementOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskRoleOfManagementTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskThirdPartyOversightAndIdentificationProcessesFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration