Company: KMX
Filing Date: 2025-04-11
Form Type: 10-K
Source: 0001170010-25-000024
Chunk: 26

Company: CARMAX INC
Filing Date: 2025-04-11
Form: 10-K
Item: Item 1A
Chunk 26
---
 and may share that information with our third-party service providers.  This information includes the information customers provide when purchasing or selling a vehicle and applying for vehicle financing.  We also collect, process and retain sensitive and confidential associate information in the normal course of business and may share that information with our third-party service providers.  Although we have taken measures designed to safeguard such information and have received assurances from our third-party providers, our facilities and systems, and those of third-party providers, could be vulnerable to external or internal security breaches, acts of vandalism, computer viruses, misplaced or lost data, programming or human errors or other similar events.  

The security measures we have implemented to protect against cybersecurity incidents may not always prevent or mitigate the impact of a cybersecurity incident and there can be no assurance that future efforts to prevent or mitigate a cybersecurity incident will be effective either.  Numerous national retailers have disclosed security breaches involving sophisticated cyber-

17

attacks, including ransomware, that were not recognized or detected until after such retailers had been affected, notwithstanding the preventive measures such retailers had in place.  Further, the rapid evolution and increased adoption of AI and other evolving technologies may increase our level of cybersecurity risk.  Any security breach involving the misappropriation, loss or other unauthorized disclosure of confidential customer or associate information, whether experienced by us or by our third-party service providers, and whether due to an external cybersecurity incident, a programming error, or other cause, could damage our reputation, expose us to mitigation costs and the risks of private litigation and government enforcement, disrupt our business and otherwise have a material adverse effect on our business, sales and results of operations.  In addition, our failure to respond quickly and appropriately to such a security breach could exacerbate the consequences of the breach.

We are subject to numerous and rapidly changing federal, state, and local laws and regulations regarding privacy, cybersecurity, and the collection, use, and disclosure of sensitive confidential information.  If we fail to comply with these laws and regulations or future applicable laws and regulations, we could suffer reputational harm and disruption to our business, and be subject to significant litigation, monetary damages, regulatory enforcement actions, or fines.  See the risk factor below titled “We operate in a highly regulated industry and are subject to a wide range of federal, state and local laws and regulations.  Changes in these laws and regulations, or our failure to comply, could have a material adverse effect on our business, sales, results of operations and financial condition” for the risks associated