Company: RWT-PA
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0000930236-25-000007
Chunk: 184

Company: REDWOOD TRUST INC
Filing Date: 2025-03-03
Form: 10-K
Item: Item 1A
Chunk 184
---
 prevent security breaches, such measures may be inadequate in protecting against threats, or these security measures may be compromised as a result of third-party action, including intentional misconduct by computer hackers, cyber-attacks, "phishing", social engineering, or ransomware attacks, employee, service provider or vendor error, or malfeasance or other intentional or unintentional acts by employees, third parties and bad actors, including third-party service providers. Threat actors continue to use increasingly sophisticated techniques and tools, including artificial intelligence, to gain unauthorized access to enterprise data and information systems. Borrower, customer, or consumer data, including personal information, may be lost, exposed, or subject to unauthorized access or use as a result of accidents, errors, or malfeasance by our employees, independent contractors, or others working with us or on our behalf. Even highly sophisticated protective measures may fail as a result of human error; for instance, an employee of ours or a third party’s may succumb to a phishing or social engineering attack resulting in unauthorized access to our or their information technology systems. Additionally, our servers and systems, and those of our service providers, may be vulnerable to computer malware, break-ins, denial-of-service attacks, ransomware attacks, and similar disruptions from unauthorized tampering with our computer systems, which could result in someone obtaining unauthorized access to borrower, customer or consumer data, other personal information, or other company data, including confidential or proprietary business information. In the past, we have experienced unauthorized access to certain data and information. We have also experienced fraudulent activity initiated through social engineering attacks by malicious third-party actors. As an example, wire transfers are an attractive target of fraudulent activity due to the speed and finality of payment, and the nature of our mortgage banking and HEI activities requires us frequently to transfer funds to various counterparties in connection with the origination or acquisition of mortgage loans and HEI. Although we have policies and procedures in place to mitigate risks related to wire transfers, we have experienced fraudulent and erroneous activity in our business operations and have incurred immaterial financial losses related to such activity. Our response to these incidents has been to take immediate steps to investigate and address the unauthorized access or fraudulent activity, and past unauthorized access and fraudulent activity related to “phishing” or social engineering has not had a material effect on our business and financial results. Although we have designed and implemented information security systems and processes to protect sensitive information from bad actors, such systems or processes may not be effective in preventing unauthorized access or activity in the future. While past