Company: STAA
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0000950170-25-024813
Chunk: 51

Company: STAAR SURGICAL CO
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1A
Chunk 51
---
 the world and between our personnel and our subsidiaries, customers, and suppliers. The integrity and protection of our customer, vendor, supplier, employee, and other Company data that we collect, use and store, including personal information, is an important part of our business. Addressing applicable and evolving security and privacy regulations may increase our operating costs or adversely affect our business operations.

Certain of our employees, contractors and vendors have access to and use personal information in the ordinary course of our business. The secure processing, maintenance and transmission of this information is critical to our 

22

operations. Despite our security measures and business controls, our information technology and infrastructure may be vulnerable to attacks by hackers, breaches due to employee, contractor or vendor error, or malfeasance, systems error (whether as a result of an intentional breach, a natural disaster or human error) or other disruptions or subject to the inadvertent or intentional unauthorized release of information. Any such occurrence could compromise our networks and the information stored thereon could be accessed, publicly disclosed, lost or stolen. Any such access, disclosure or other loss of information could result in legal claims or proceedings, and liability under laws that protect the privacy of personal information and regulatory penalties, disrupt our operations and the supply of products we provide to our clients, compromise our intellectual property or other confidential business information, or damage our reputation, any of which could adversely affect our profitability, revenue and competitive position. Many of our employees currently work remotely, which may make us more vulnerable to cyberattacks. While we have not experienced a material system failure, accident or security breach to date, we cannot assure you that our data protection efforts and our investment in information technology will prevent significant breakdowns, data leakages, breaches in our systems or other cyber incidents that could have a material adverse effect upon our reputation, business, operations or financial condition. We continue to invest in our cybersecurity program to enhance current capabilities and also implement new capabilities in our effort to keep pace with the changing threat landscape. Also, certain of our information technology systems are not redundant, and our disaster recovery planning is not sufficient for every eventuality. Despite any precautions we may take, such events could materially harm our reputation and financial results. Moreover, while we maintain cyber insurance, it may be insufficient to address any potential loss incurred. We also rely on third parties to host or otherwise process some of this data (such as cloud-based computing). Elements of our information technology systems that we outsource to third parties may also be vulnerable to various types of attacks or disruptions. Any