Company: DLX
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0000027996-25-000051
Chunk: 22

Company: DELUXE CORP
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1A
Chunk 22
---
 remaining businesses continue to operate effectively. Additionally, we must strategically evaluate potential divestitures to ensure they align with our long-term objectives and do not unduly harm our financial performance or market position. While divestitures can be a strategic tool to streamline operations and focus on core business areas, they come with inherent risks and challenges. Effective planning, execution, and management of divestiture activities are essential to mitigate these risks and ensure the continued success and stability of our business.

OPERATIONAL RISKS

Security breaches, computer malware, or other cyberattacks involving the confidential information we maintain could significantly damage our reputation, expose us to litigation and enforcement actions, and substantially harm our business and results of operations.

In recent years, information security risks have escalated due to several factors, including the proliferation of new technologies, particularly emerging artificial intelligence systems, an increase in remote work arrangements, and the growing sophistication and activities of hackers, terrorists, and activists. We utilize internet-based channels that collect, manage, transmit, and process a wide array of sensitive information. This includes customers' financial account and payment details, proprietary business information, and personally identifiable information of consumers, employees, contractors, suppliers, and other business partners. Additionally, we provide essential services such as merchant services and remittance processing, which are integral to supporting our customers and their business operations. Cybersecurity is a top risk identified by our Enterprise Risk Management (ERM) Committee, as technology-based organizations like ours are particularly vulnerable to targeted attacks aimed at exploiting network and system weaknesses. Further information regarding our ERM Committee can be found in Part I, Item 1C of this report.

The secure and uninterrupted operation of our networks and systems, as well as the processing, maintenance, and confidentiality of the sensitive information they contain, is critical to our business operations and strategy. We have implemented a risk-based information/cybersecurity program dedicated to protecting our data and solutions. Our defense-in-depth strategy employs multiple security layers and adheres to the CIA (confidential, integrity, and availability) triad model. Despite these measures, computer systems and networks are inherently vulnerable to unauthorized access. A security breach, whether accidental or intentional, could result in unauthorized access and/or misuse of our information, including personally identifiable information or, in some cases, protected health information. Our security measures could be compromised by third-party actions, computer viruses, accidents, employee or contractor error, or malicious actions by rogue employees. Individuals or third parties may circumvent controls and exploit vulnerabilities, leading to the disclosure or misuse of sensitive