Company: KG
Filing Date: 2025-08-15
Form Type: 10-Q
Source: 0002055116-25-000018
Chunk: 341

Company: Kestrel Group Ltd
Filing Date: 2025-08-15
Form: 10-Q
Item: Item 8
Chunk 341
---
 or other systems could significantly impair Kestrel Group’s ability to perform such functions on a timely basis. These incidents could be caused by malicious or disruptive software, computer hackers, rogue employees, cyber-attacks, failures of telecommunications systems or other catastrophic events. If sustained or repeated, such a business interruption, system failure or service denial could result in a deterioration of Kestrel Group’s ability to write and process business, provide customer service, pay claims in a timely manner or perform other necessary business functions. Furthermore, a significant portion of the communications between Kestrel Group’s employees and its business, banking and investment partners will depend on information technology and electronic information exchange. In addition, Kestrel Group may suffer financial and reputational damage because of lost or misappropriated confidential information belonging to it, and may become subject to legal action and increased regulatory oversight. Kestrel Group could also be required to spend significant financial and other resources to remedy any damage caused to repair or replace information systems.

Kestrel Group’s information systems may be the target of attacks. Although Kestrel Group has not experienced known material or threatened cases involving unauthorized access to its information technology systems and data or unauthorized appropriation of such data to date, it has no assurance that such technology breaches will not occur in the future.

Additionally, some of Kestrel Group’s subsidiaries will collect, use, store, transmit, retrieve, retain and otherwise process confidential and personally identifiable information in their information systems in and across multiple jurisdictions, and they are subject to a variety of confidentiality obligations and privacy, data protection and information security laws, regulations, orders and industry standards in the jurisdictions in which they do business. The regulatory environment surrounding information security, data privacy and cybersecurity is evolving and increasingly demanding. A number of Kestrel Group’s subsidiaries are subject to numerous U.S. federal and state laws and non-U.S. regulations governing the protection of personally identifiable and confidential information of their customers and employees. On October 24, 2017, the NAIC adopted an Insurance Data Security Model Law, which requires licensed insurance entities to comply with detailed information security requirements. The NAIC model law has been adopted by certain states, including Vermont, which may raise compliance costs or increase the risk of noncompliance, and noncompliance could subject Kestrel Group’s insurance subsidiaries to regulatory enforcement actions and penalties, as well as reputational harm. Any such events could potentially have an adverse impact on Kestrel Group’s insurance subsidiaries’ business, results of operations, financial condition and cash flows