Company: CDLX
Filing Date: 2025-11-05
Form Type: 10-Q
Source: 0001666071-25-000159
Chunk: 237

Company: Cardlytics, Inc.
Filing Date: 2025-11-05
Form: 10-Q
Item: Item 8
Chunk 237
---
lytics platform. We do not currently receive or have access to any personal data from our FI partners, although we may obtain or have access to personal data from our FI partners in the future as our business evolves. Additionally, we receive, collect, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, share and have access to personal data as a result of other aspects of our business. As such, we may be a more visible target for cyberattacks or physical breaches of our systems, databases or data centers, and we may in the future suffer from such attacks or breaches. There is a risk that actors may attempt to gain access to our systems, for the purpose of stealing personal data, sensitive or proprietary data, accessing sensitive information on our network, or disrupting our or their respective operations. Cyberattacks, malicious internet-based activity and online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of our sensitive information and information systems, and those of the third parties with whom we work. Such threats are prevalent and continue to rise, are increasingly difficult to detect, and come from a variety of sources, including traditional computer "hackers," threat actors, "hacktivists," organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors. 

Some actors now engage and are expected to continue to engage in cyberattacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we, the third parties with whom we work, and our customers may be vulnerable to a heightened risk of these attacks, including retaliatory cyberattacks, that could materially disrupt our systems and operations, and ability to provide our service.

52

In addition to traditional computer "hackers," we and the third parties with whom we work are subject to a variety of evolving threats, including but not limited to social-engineering attacks (including deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), threat actors, software bugs, malicious code (such as viruses and worms), malware (including: as a result of advanced persistent threat intrusions), employee theft or misuse, denial-of-service attacks, credential attacks, credential harvesting, and ransomware attacks, sophisticated nation-state and nation-state supported actors now engage in attacks (including advanced persistent threat intrusions). We also may be the subject of viruses, malware installation, server malfunction