Company: PGYWW
Filing Date: 2025-03-12
Form Type: 10-K
Source: 0001883085-25-000050
Chunk: 168

Company: Pagaya Technologies Ltd.
Filing Date: 2025-03-12
Form: 10-K
Item: Item 1A
Chunk 168
---
 is limited, and these third parties may not have adequate information security measures in place. If our third-party service providers experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if our third-party service providers fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award.

While all information technology operations are inherently vulnerable to inadvertent or intentional security breaches, incidents, attacks and exposures, the size, complexity, accessibility and distributed nature of our information technology systems, and the large amounts of sensitive information stored on those systems make such systems potentially vulnerable to unintentional or malicious, internal and external attacks. Vulnerabilities may be exploited from inadvertent or intentional actions of our employees, independent contractors, third-party service providers, Partners, asset investors or by malicious third parties that may result in actual or attempted unauthorized access, mishandling or misuse of information, computer viruses or malware, cyberattacks that could lead to unauthorized persons obtaining confidential information, destruction of data, disruption or deterioration of service, sabotaged or damaged systems, as well as distributed denial of service attacks, data breaches and other infiltration, exfiltration or other similar events. Additional cybersecurity threats include, but are not limited to, credential harvesting, server malfunctions, software or hardware failures, adware, attacks enhanced or facilitated by AI, natural disasters, terrorism, war and telecommunication and electrical failures and other similar threats. Cyberattacks are increasing in their frequency, levels of persistence, sophistication and intensity, and are being conducted by sophisticated and organized groups and individuals with a wide range of motives (including, but not limited to, industrial espionage) and expertise, including organized criminal groups, “hacktivists,” nation states and others. In addition to the extraction of sensitive information, such attacks could include the deployment of harmful malware, ransomware, denial-of-service attacks, social engineering (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), supply chain attacks and other means to affect service reliability and threaten the confidentiality, integrity and availability of information and systems. In particular, severe ransomware attacks are becoming increasingly prevalent and can lead to significant interruptions in our operations, ability to provide our products or services, loss of sensitive information and income, reputational harm, and diversion of funds. Extortion 

29

Table of Contents

payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable