Company: SRFM
Filing Date: 2025-03-21
Form Type: 10-K
Source: 0000950170-25-043326
Chunk: 85

Company: SURF AIR MOBILITY INC.
Filing Date: 2025-03-21
Form: 10-K
Item: Item 1A
Chunk 85
---
 Our information technology networks and systems process, transmit and store personal and financial information, proprietary information of our business, and also allow us to coordinate our business across our operation bases and allow us to communicate with our employees and externally with customers, suppliers, partners and other third parties. To date, we have not implemented comprehensive security measures to secure these information technology networks and systems and the data processed, transmitted, and stored on them, and the integration of these two separate information technology systems following the merger will be more challenging as a result. These networks, systems, and data will be susceptible to cyberattacks, viruses, malware or other unauthorized access or damage (including by environmental, malicious or negligent acts), which could result in unauthorized access to, or the release and public exposure of, our proprietary information or our users’ personal information. In addition, cyberattacks, viruses, malware, or other damage or unauthorized access to our information technology networks and systems, would result in damage, disruptions or shutdowns to our platform. Any of the foregoing could cause substantial harm to our business, require us to make notifications to our customers, governmental authorities, or the media, and could result in litigation, investigations or inquiries by government authorities, and subject us to penalties, fines, and other losses relating to the investigation and remediation of such an attack or other unauthorized access or damage to our information technology systems and networks. 

We may in the future be subject to data breaches. A significant data breach or any failure, or perceived failure, by us to comply with any federal, state or data foreign privacy laws, regulations or other principles or orders to which we may be subject could adversely affect our reputation, brand and business, and may result in claims, investigations, proceedings or actions against us by governmental entities, litigation, including class action litigation, from our customers, fines, penalties, or other liabilities, or require us to change our operations or cease using certain data sets. Depending on the nature of the information compromised, we may also have obligations to notify users, law enforcement, government authorities, payment companies, consumer reporting agencies or the media about the incident and may be required to expend additional resources in connection with investigating and remediating such an incident, and otherwise complying with applicable privacy and data security laws.

System failures, defects, errors or vulnerabilities in our website, applications, backend systems or other technology systems or those of third-party technology providers could harm our reputation and brand and adversely affect our business, financial condition and results of operations. 

Our systems, or those of third parties