Company: CRCL
Filing Date: 2025-06-02
Form Type: S-1/A
Source: 0001193125-25-132755
Chunk: 79

Company: Circle Internet Group, Inc.
Filing Date: 2025-06-02
Form: S-1/A
Chunk 79
---
 into releasing control of our systems to a hacker, while others may aim to introduce computer viruses or malware into our systems with a view to stealing confidential or proprietary data. Additionally, certain threats are designed to remain dormant or undetectable until launched against a target, and we may not be able to implement adequate preventative measures. Even when a cyberattack or security breach is detected, the full extent of the breach may not be determined immediately. We have sought to develop systems and processes designed to protect the data we manage, prevent data loss and other cyberattacks or security breaches, and respond to known and potential risks, and we expect to continue to expend significant resources to bolster these protections. For example, we have sought to develop a 53

security program and established controls aligned to the cybersecurity framework established by the National Institute of Standards and Technology; however, there are several areas that continue
to be enhanced and are dependent on a robust asset and device inventory and management tool. This inventory and management tool will assist in enhancing several dependent security areas of focus: robust security operations (which will provide
enhanced logging and monitoring), vulnerability management (which will track vulnerabilities to remediate), endpoint/network security (which will provide the ability to ensure consistent security controls to Circle endpoints and network), data
protection (which will provide the ability to determine known data sources for appropriate data protection controls), and access management (which will provide the ability to have line of sight to all known applications to address IT governance and
access control requirements). Despite our efforts, we may not have implemented all systems, security tools, measures, and processes that are consistent with industry standards and there can be no assurance that the security measures we have
developed and implemented, or that we may develop and implement in the future, will provide absolute security or prevent cyberattacks or security breaches.

We may
experience breaches of our security measures due to human error, malfeasance, insider threats, system errors or vulnerabilities, or other irregularities. Unauthorized parties have attempted, and we expect that they will continue to attempt, to gain
access to our systems and facilities, as well as those of our customers, partners, and third-party service providers. Such unauthorized parties have used various means, including hacking, social engineering, phishing, and attempting to fraudulently
induce individuals (including employees, service providers, and our customers) into disclosing usernames, passwords, or other sensitive information, which may in turn be attempted to be used to access our information technology systems and our
customers’ digital assets