Company: SABR
Filing Date: 2025-02-20
Form Type: 10-K
Source: 0001597033-25-000027
Chunk: 311

Company: Sabre Corp
Filing Date: 2025-02-20
Form: 10-K
Item: Item 1A
Chunk 311
---
 harm our reputation. 

Security incidents expose us to liability and could damage our reputation and our business. 

We process, store, and transmit large amounts of data, such as PII of our customers and employees and PCI of our customers, and it is critical to our business strategy that our facilities and infrastructure, including those provided by cloud and mainframe providers or other vendors, remain secure and are perceived by the marketplace to be secure. Our infrastructure may be vulnerable to physical or electronic break-ins, computer viruses, ransomware attacks, or similar disruptive problems.

In addition, we, like most technology companies, are the target of cybercriminals who attempt to compromise our systems. We are subject to and experience threats and intrusions that have to be identified and remediated to protect sensitive information along with our intellectual property and our overall business. To address these threats and intrusions, we have a team of experienced security experts and support from firms that specialize in data security and cybersecurity. We are periodically subject to these threats and intrusions, and sensitive information has in the past been, and could at any time, including in the future, be compromised as a result. In addition, the techniques employed in connection with these threats and intrusions are changing, developing and evolving rapidly, including from emerging technologies such as advanced forms of AI. The costs and impacts related to these incidents, including the costs of investigation and remediation, any associated penalties assessed by any governmental authority or payment card brand, and any indemnification or other contractual obligations to our customers, may be material and could damage our reputation. 

As an example, in the third quarter of 2023, we became aware that an unauthorized actor had illegally extracted certain company data and posted it to the dark web. Immediately upon becoming aware of this extraction, we initiated an investigation, with the assistance of cybersecurity and forensics professionals. We have also notified federal law enforcement and have provided, and will continue to provide, other required notifications. To date this cybersecurity incident has not had a material impact on our financial condition, results of operations or liquidity. However, there is no assurance that it will not result in significant costs to us, reputational harm, expenditure of additional resources, lawsuits and related fees, costs and expenses, or regulatory inquiries in the future that could result in a material adverse effect. For example, in December 2024 and January 2025, four lawsuits were filed against us in the United States District Court for the Northern District of Texas, each of which is seeking class certification. The complaints