Company: TRUE
Filing Date: 2025-05-06
Form Type: 10-Q
Source: 0001327318-25-000016
Chunk: 274

Company: TrueCar, Inc.
Filing Date: 2025-05-06
Form: 10-Q
Item: Part I, Item 8
Chunk 274
---
 confidence and trust in our products, impair our internal systems or result in financial harm to us. Further, these risks could be heightened by the fact that most of our employees work from home.

Our efforts to protect our data or the data we receive could also be unsuccessful due to software bugs or other technical malfunctions; employee, contractor or vendor error or malfeasance; government surveillance; or other threats. In addition, third parties may attempt to fraudulently induce employees or users to disclose information to gain access to our data or our users’ data. Cyberattacks continue to evolve in sophistication and volume and may be inherently difficult to detect for long periods of time. Although we have developed systems and processes that are designed to protect our data and user data, to prevent data loss and to prevent or detect security breaches, we cannot assure you that such measures will provide absolute security, and we may need to expend significant resources in protecting against or remediating security breaches and cyberattacks.

In addition, some of our third-party partners, including developers, vendors, affinity group marketing partners and OEM partners, may receive or store information that we or our users provide. If these partners fail to adopt or adhere to adequate data security practices, or suffer a breach of their networks, our data or our users’ data could be improperly accessed, used or disclosed. Affected users or government authorities could initiate legal or regulatory actions against us in connection with any actual or perceived security breaches or improper disclosure of data, which could cause us to incur significant expense and liability or result in orders or consent decrees requiring us to modify our business practices. These incidents, and our efforts to address them, could have a material and adverse effect on our business, reputation or financial results.

For example, as discussed elsewhere in this “Risk Factors” section, in June 2024, CDK Global, a major provider of DMS products, announced that it had suspended certain key systems and operations as a result of a cybersecurity incident. Although we identified no evidence that suggested our own systems were exposed in the incident that impacted CDK, we do share and receive certain data through CDK’s interface. If regulators or other government authorities take the position that the exposure of any data we sent or received through CDK’s systems required us to take further action, or if such a conclusion is reached with respect to a future security incident, we may incur compliance costs and potentially face legal liability.

Further, the SEC requires public companies to disclose material cybersecurity incidents that they experience on a Current Report on Form