Company: IBTA
Filing Date: 2025-05-15
Form Type: 10-Q
Source: 0001628280-25-025593
Chunk: 198

Company: Ibotta, Inc.
Filing Date: 2025-05-15
Form: 10-Q
Item: Item 8
Chunk 198
---
 and fines.

We collect, receive, store, generate, use, transfer, disclose, dispose of, share, and otherwise process (Process or Processing) data about consumers, including personal information or personal data, and other confidential or proprietary information, for various purposes, including legal, marketing, and other business-related purposes. Cyberattacks, denial or degradation of service attacks, ransomware attacks, business email compromises, account takeover attacks, malware, viruses, social engineering (including phishing), identity theft, fraudulent payment requests, and other malicious online and related activities are prevalent in our and our service providers’, clients’, and publishers’ industries. Advances in computer and software capabilities and increasing sophistication of hackers have increased these and other cybersecurity risks. Geopolitical tensions and conflicts may also increase these risks. We and our service providers, clients, or publishers may experience cyber-attacks, unavailable, disrupted, or degraded 

67

systems, and unauthorized access to or other Processing of data due to these risks, among others, including employee error or malfeasance, theft or misuse, attacks by nation-state and affiliated actors, and advanced persistent threat intrusions. We have been and may in the future become the subject of cyberattacks, including those seeking unauthorized access to our data or other data we maintain or process. We may not be able to anticipate or to implement effective preventive and remedial measures against all threats, and we cannot guarantee that our security or recovery measures will be adequate to prevent, detect, or address security breaches or incidents, service degradation or interruptions, system failures, data loss, theft, or other unauthorized Processing, or other material adverse consequences. Our security measures, and those of companies we may acquire and our service providers, clients, and publishers, could fail or be insufficient, resulting in interruptions or other disruptions to systems, the loss or unavailability of, or unauthorized use or other Processing of our or our clients’, publishers’ or consumers’ data or other data that we or our service providers or partners Process, or other security breaches or incidents. The time, expense, and resources required to respond to an actual or perceived security breach or incident and/or to mitigate any security vulnerabilities that may be identified could be significant, we may face difficulties or delays in so doing, our efforts to address these problems may not be successful, and these problems could result in unexpected interruptions, delays, cessation or degradation of service, negative publicity, and other harm to our business and our competitive position. We could be required to implement additional security measures or to fundamentally change our business activities and