Company: NEWTP
Filing Date: 2025-03-17
Form Type: 10-K
Source: 0001587987-25-000050
Chunk: 174

Company: NewtekOne, Inc.
Filing Date: 2025-03-17
Form: 10-K
Item: Item 1A
Chunk 174
---
 disclose material cybersecurity incidents that they experience on Form 8-K within four business days of determining that a material cybersecurity incident has occurred and to disclose on annual basis material information regarding their cybersecurity risk management, strategy, and governance. If we fail to comply with the relevant laws and regulations, we could suffer financial losses, a disruption of our businesses, liability to investors, regulatory intervention or reputational damage.

We and our service providers continue to be impacted by the increase in remote work. Policies of extended periods of remote working, whether by us or by our service providers, could strain technology resources, introduce operational risks and otherwise heighten the risks described above. Remote working environments may be less secure and more susceptible to hacking attacks, including phishing and social engineering attempts. Accordingly, the risks described above are heightened under current conditions.

62

We and our subsidiaries are subject to risks associated with “phishing” and other cyber-attack.

Our business and the business of our subsidiaries relies upon secure information technology systems for data processing, storage and reporting. Despite careful security and controls design, implementation and updating, ours and our subsidiaries’ information technology systems could become subject to cyber-attacks. Cyber-attacks include, but are not limited to, gaining unauthorized access to digital systems (e.g., through “hacking”, malicious software coding, social engineering or “phishing” attempts) for purposes of misappropriating assets or sensitive information, corrupting data, or causing operational disruption. Cyber-attacks may also be carried out in a manner that does not require gaining unauthorized access, such as causing denial-of service attacks on websites (i.e., efforts to make network services unavailable to intended users). Our employees have been and expect to continue to be the target of fraudulent calls, emails and other forms of activities. The result of these incidents may include disrupted operations, misstated or unreliable financial data, liability for stolen information, misappropriation of assets, increased cybersecurity protection and insurance costs, litigation and damage to our business relationships, regulatory fines or penalties, or other adverse effects on our business, financial condition or results of operations. In addition, we may be required to expend significant additional resources to modify our protective measures and to investigate and remediate vulnerabilities or other exposures arising from operational and security risks related to cyber-attacks. 

Our and our service providers’ increased use of mobile and cloud technologies could heighten the risk of a cyber-attack as well as other operational risks, as certain aspects of the security of such technologies may be complex, unpredictable or beyond their control. Our and