Company: CDLX
Filing Date: 2025-11-05
Form Type: 10-Q
Source: 0001666071-25-000159
Chunk: 10

Company: Cardlytics, Inc.
Filing Date: 2025-11-05
Form: 10-Q
Item: Item 4
Chunk 10
---
 we may be entitled to damages if the third parties fail to satisfy their data privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties’ infrastructure in our supply chain or our third-party partners' supply chains have not been compromised.

While we have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective. We take steps designed to detect, mitigate, and remediate vulnerabilities in our systems (such as our hardware and software, including that of third parties upon which we rely). We may not, however, detect and remediate all such vulnerabilities, at all or on a timely basis. Further, we may experience delays in developing and deploying remedial measures and patches designed to address identified vulnerabilities. Even if we have issued or otherwise made patches for vulnerabilities in our software applications, products or services, our customers may be unwilling or unable to deploy such patches and use such information effectively and in a timely manner. Vulnerabilities could be exploited and result in a security incident.

Certain of the previously identified or similar threats have in the past and may in the future cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our sensitive information or our information technology systems, or those of the third parties with whom we work. A security incident or other interruption could disrupt our ability (and that of third parties with whom we work) to provide our platform.

53

Further, we could expend significant financial and operational resources to protect against or in response to a security incident, including repairing system damage, increasing cybersecurity protection costs by deploying additional personnel and protection technologies, dealing with regulatory scrutiny, and litigating and resolving legal claims, all of which could divert resources and the attention of our management and key personnel away from our business operations. Applicable data privacy and security obligations may require us, or we may voluntarily choose, to notify relevant stakeholders, including affected individuals, customers, regulators, and investors, of security incidents, or to take other actions, such as providing credit monitoring and identity theft protection services. Such disclosures and related actions are costly, and the disclosure or the failure to comply with such requirements could lead to adverse consequences.

In any event, an actual or perceived breach of the security of our, or the third parties with whom we