Company: WRBY
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0001504776-25-000010
Chunk: 40

Company: Warby Parker Inc.
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1
Chunk 40
---
. The Company paid a civil monetary penalty to OCR in December 2024 and the investigation was formally closed in February 2025. 

While we employ a number of security measures designed to prevent, detect, and mitigate the potential for harm to our business or to our users from security incidents, such as from malicious cyber attacks or theft or misuse of user credentials on our network, these measures may not be effective in every instance. Moreover, while we maintain cyber insurance that may help provide coverage for these types of incidents, we cannot assure you that our insurance will be adequate to cover costs and liabilities related to these incidents or that applicable insurance will be available to us in the future on economically reasonable terms or at all. Any such breach, attack, virus, or other event could result in additional costly investigations and litigation exceeding applicable insurance coverage or contractual rights available to us, civil or criminal penalties, operational changes or other response measures, loss of consumer confidence in our security measures, and negative publicity that could adversely affect our business, financial condition, and results of operations. 

We also rely on a number of third-party service providers to operate our critical business systems, provide us with software, and process confidential, sensitive and personal information, such as the payment processors that process customer credit card payments, which expose us to security risks outside of our direct control and our ability to monitor these third-party service providers’ data security is limited. Certain of our vendors have experienced security incidents in the past, and we expect that other vendors or third-party service providers will experience security incidents in the future that could compromise the confidentiality, integrity, or availability of the systems they operate for us or the information they process on our behalf. Cybercrime and hacking techniques are constantly evolving, and we or our third-party service providers may be unable to anticipate attempted security breaches, react in a timely manner, or implement adequate preventative measures, particularly given the increasing use of hacking techniques designed to circumvent controls, avoid detection, and remove or obfuscate forensic artifacts. While we have taken measures 

18

designed to protect the security of the IT systems and confidential and personal information under our control, we cannot ensure that any security measures that we or our third-party service providers have implemented will be effective against current or future security threats. Moreover, we or our third-party service providers may be more vulnerable to such attacks in remote work environments, which have increased since the COVID-19 pandemic. Because we make extensive use of third-party suppliers and service providers, such as cloud services that support our internal and customer