Company: CRCL
Filing Date: 2025-05-27
Form Type: S-1/A
Source: 0001193125-25-126208
Chunk: 80

Company: Circle Internet Group, Inc.
Filing Date: 2025-05-27
Form: S-1/A
Chunk 80
---
 past, we have been subject to cybersecurity incidents in which fraudulent actors obtained company-owned funds. Threats can come from a variety of sources, including criminal hackers, hacktivists,
state-sponsored intrusions, industrial espionage, and insiders. Certain threat actors may be supported by significant financial and technological resources, making them even more sophisticated and difficult to detect. As a result, our costs and the
resources we devote to protecting against these advanced threats and their consequences may continue to increase over time.

A cyberattack or security breach that
results in the unauthorized disclosure of personal information could also expose us to liability under various laws and regulations across jurisdictions and increase the risk of litigation and governmental or regulatory investigation. Due to
concerns about information security and integrity, a growing number of legislative and regulatory bodies have adopted breach notification and other requirements in the event that information subject to such laws is accessed by unauthorized persons
and additional regulations regarding security of such information are possible. We may in the future need to notify governmental authorities and affected individuals with respect to such incidents. For example, laws throughout the United States and
in foreign jurisdictions, including in all 50 U.S. states, the EEA, the UK, and Singapore, may require businesses to provide notice under certain circumstances to consumers whose personal information has been disclosed as a result of a data breach.
Some laws impose specific data breach reporting obligations if special categories of personal information is disclosed as a result of a cyberattack or information security breach. Complying with such numerous and complex regulations in the event of
a cyberattack or information security breach would be expensive and difficult, and failure to comply with these regulations could subject us to regulatory scrutiny and additional liability. We may also be contractually required to notify customers
or business partners of a cyberattack or security breach. Regardless of our contractual protections, any actual or perceived cyberattack or security breach, or breach of our legal or contractual obligations, could harm our reputation and brand,
expose us to potential liability, or require us to expend significant resources on information security and in responding to any such actual or perceived incident or related investigations or litigation.

54

Although we maintain insurance coverage that we believe is adequate for our business, it may be insufficient to
protect us against all losses and costs stemming from cyberattacks or security breaches, other types of unlawful activity, or any resulting disruptions from such events. Furthermore, there can be no assurance that we will be able to maintain such
insurance coverage at reasonable costs or at all. Although we currently maintain disaster recovery