Company: ZCARW
Filing Date: 2025-11-14
Form Type: 10-Q
Source: 0001213900-25-110391
Chunk: 903

Company: Zoomcar Holdings, Inc.
Filing Date: 2025-11-14
Form: 10-Q
Item: Part II, Item 1
Chunk 903
---
 certain employees received external communications from
a threat actor alleging unauthorized access to Company data. Upon discovery, the Company promptly activated its incident response plan.
Although based on its initial assessment the Company determined that an unauthorized third party accessed a limited dataset containing
certain personal information of a subset of approximately 8.4 million users, including names, phone numbers, car registration numbers,
personal addresses and email addresses associated with such users, it found no evidence to suggest that financial information, plaintext
passwords, or other sensitive identifiers were compromised. To date, the incident has not resulted in any material disruption to the Company’s
operations.

Accordingly, any such unauthorized
access to or use of such data and information, or breach of our security measures or those of our third-party service providers, could
adversely affect our business, operations, and future prospects. While we have taken steps to mitigate our cyberattack risks and protect
the confidential information that we have access to, including but not limited to installation and periodical updates of antivirus software
and backup of information on our computer systems, our security measures may be vulnerable to such security breaches. In response to the
Cybersecurity Incident, the Company took immediate actions to contain the threat and enhance its security posture. These measures include
implementing additional safeguards across the cloud and internal network, increasing system monitoring, and reviewing access controls.
The Company is also engaging with third-party cybersecurity consultants to have an external cybersecurity assessment
in order to further strengthen its infrastructure and cybersecurity framework. 

96

Even though the Company
has taken the relevant steps to ensure that such breach does not occur again, because techniques used to sabotage or obtain unauthorized
access to systems change frequently and generally are not recognized until they are launched against a target, we may be unable to anticipate
these techniques or to implement adequate preventative measures. Any cybersecurity incident like the one we recently experienced, accidental
or willful security breaches or other unauthorized access to our systems could cause confidential information to be stolen and used for
criminal purposes. Cybersecurity incidents, security breaches or unauthorized access to confidential information could also expose us
to liability related to the loss of the information, time-consuming and expensive litigation and negative publicity. If security measures
are breached because of third-party action, employee error, malfeasance or otherwise, or if design flaws in our technology infrastructure
are exposed and exploited, our relationships with our Hosts and Guests could be severely damaged, we could incur significant