Company: CRCL
Filing Date: 2025-04-01
Form Type: S-1
Source: 0001193125-25-070481
Chunk: 76

Company: Circle Internet Group, Inc.
Filing Date: 2025-04-01
Form: S-1
Chunk 76
---
 all known applications to address IT governance and access control requirements). Despite our efforts, we may not have implemented all systems, security tools, measures, and processes that are consistent
with industry standards and there can be no assurance that the security measures we have developed and implemented, or that we may develop and implement in the future, will provide absolute security or prevent cyberattacks or security breaches.

We may experience breaches of our security measures due to human error, malfeasance, insider threats, system errors or vulnerabilities, or other irregularities.
Unauthorized parties have attempted, and we expect that they will continue to attempt, to gain access to our systems and facilities, as well as those of our customers, partners, and third-party service providers. Such unauthorized parties have used
various means, including hacking, social engineering, phishing, and attempting to fraudulently induce individuals (including employees, service providers, and our customers) into disclosing usernames, passwords, or other sensitive information, which
may in turn be attempted to be used to access our information technology systems and our customers’ digital assets. In the past, we have been subject to cybersecurity incidents in which fraudulent actors obtained company-owned funds. Threats
can come from a variety of sources, including criminal hackers, hacktivists, state-sponsored intrusions, industrial espionage, and insiders. Certain threat actors may be supported by significant financial and technological resources, making them
even more sophisticated and difficult to detect. As a result, our costs and the resources we devote to protecting against these advanced threats and their consequences may continue to increase over time.

A cyberattack or security breach that results in the unauthorized disclosure of personal information could also expose us to liability under various laws and regulations
across jurisdictions and increase the risk of litigation and governmental or regulatory investigation. Due to concerns about information security and integrity, a

54

growing number of legislative and regulatory bodies have adopted breach notification and other requirements in the event that information subject to such laws is accessed by unauthorized persons
and additional regulations regarding security of such information are possible. We may in the future need to notify governmental authorities and affected individuals with respect to such incidents. For example, laws throughout the United States and
in foreign jurisdictions, including in all 50 U.S. states, the EEA, the UK, and Singapore, may require businesses to provide notice under certain circumstances to consumers whose personal information has been disclosed as a result of a data breach.
Some laws impose specific data breach reporting obligations if special categories of personal information is disclosed as a