Company: TRUE
Filing Date: 2025-11-06
Form Type: 10-Q
Source: 0001327318-25-000065
Chunk: 56

Company: TrueCar, Inc.
Filing Date: 2025-11-06
Form: 10-Q
Item: Part I, Item 4
Chunk 56
---
 these third-party partners to use sufficient security measures to protect such information. If these partners fail to adopt or adhere to adequate data security practices, or suffer a breach of their networks, our data or our users’ data could be improperly accessed, used or disclosed. Affected users or government authorities could initiate legal or regulatory actions against us in connection with any actual or perceived security breaches or improper disclosure of data, which could cause us to incur significant expense and liability or result in orders or consent decrees requiring us to modify our business practices. These incidents, and our efforts to address them, could have a material and adverse effect on our business, reputation or financial results.

For example, as discussed elsewhere in this “Risk Factors” section, in June 2024, CDK Global, a major provider of DMS products, announced that it had suspended certain key systems and operations as a result of a cybersecurity incident. Although we identified no evidence that suggested our own systems were exposed in the incident that impacted CDK, we do share and receive certain data through CDK’s interface. If regulators or other government authorities take the position that the exposure of any data we sent or received through CDK’s systems required us to take further action, or if such a conclusion is reached with respect to a future security incident, we may incur compliance costs and potentially face legal liability.

Further, the SEC requires public companies to disclose material cybersecurity incidents that they experience on a Current Report on Form 8-K within four business days of determining that a material cybersecurity incident has occurred and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy and governance. If we fail to comply with these new requirements we could incur regulatory fines in addition to other adverse consequences to our reputation, business, financial condition and results of operations.

Our platform must integrate with a variety of web browsers and operating systems, both on desktop computers and mobile devices, that are developed by others, and our business is dependent on our ability to maintain our platform’s functionality and deliver a compelling user experience across those browsers and operating systems.

We interact with users through our Internet-based platform, which is designed to operate on a variety of network, hardware and software platforms that are developed by others and over which we have no control, including the numerous web browsers and operating systems that consumers use to access the Internet, both on desktop computers and mobile devices. As a 

67

result, we need to continuously modify and enhance our platform to keep pace with consumers’ evolving expectations and changes in network, hardware, software,