Company: CRCT
Filing Date: 2025-03-05
Form Type: 10-K
Source: 0001828962-25-000039
Chunk: 95

Company: Cricut, Inc.
Filing Date: 2025-03-05
Form: 10-K
Item: Item 1A
Chunk 95
---
 and personal information, may be exposed to unauthorized persons or to the public and may compromise our security systems. We have been, and may in the future be, subject to compromises and other security breaches or incidents impacting such data. There can be no assurance that any efforts we make to prevent against such breaches will prevent breakdowns in our systems or security breaches or incidents that could adversely affect our business. Third parties may also attempt to fraudulently induce employees or users, using constantly evolving social engineering techniques, into disclosing usernames, passwords or other sensitive information, which may in turn be used to access information technology systems used in our business. For example, our employees and users have received and likely will continue to receive “phishing” e-mails attempting to induce them to divulge sensitive information or to purchase counterfeits of our products, respectively. In addition, unauthorized persons may attempt to hack into our products or systems to obtain personal data relating to users or employees, our confidential or proprietary information or confidential information we maintain from third parties, which, if successful, could pose a risk of loss of data, risk to customer safety and risk of product recall. While we provide security and privacy training to attempt to protect against these risks, the techniques used to obtain unauthorized access to systems and data change frequently and may be difficult to detect, so we may not be able to anticipate and prevent these intrusions or other security breaches or incidents, to identify them promptly or to mitigate them when they occur.

Moreover, we manufacture and sell hardware and software products that allow our users to store confidential information, including their original designs, locally or in our cloud infrastructure. While we have measures in place to protect and update our software installed on our users’ devices, we do not have measures to configure, update or secure our users’ desktop or mobile devices or any information stored in our users’ own systems or at their locations, which is the responsibility of our users. While we have implemented security measures designed to protect our hardware and software products from unauthorized access and cyberattacks, these measures may not be effective in securing these products, particularly since techniques used to obtain unauthorized access or otherwise sabotage systems, change frequently and may not be recognized until launched against a target. A cyberattack, security breach or incident or other event that causes the loss or public disclosure of, or unauthorized access by third parties to, sensitive information stored by us or our brick-and-mortar and online retail partners, or the perception that any of these have occurred, could have serious negative consequences for our business, including loss of