Company: EVCM
Filing Date: 2025-03-13
Form Type: 10-K
Source: 0001853145-25-000009
Chunk: 42

Company: EverCommerce Inc.
Filing Date: 2025-03-13
Form: 10-K
Item: Item 1A
Chunk 42
---
 well as government institutions, have disclosed breaches of their information security systems, some of which have involved sophisticated and highly targeted attacks on their websites, mobile applications and infrastructure. The techniques used to obtain unauthorized, improper, or illegal access to systems and information (including customers’ personal data), disable or degrade service, or sabotage systems are constantly evolving and have become increasingly complex and sophisticated, may be difficult to detect quickly, and often are not recognized or detected until after they have been launched against a target. Even if identified, we may be unable to adequately investigate or remediate incidents or breaches due to attackers increasingly using tools and techniques that are designed to circumvent controls, avoid detection, and remove or obfuscate forensic evidence.

We have been and could in the future be subject to breaches of security by hackers or other malicious actors. Although we proactively employ multiple measures to defend our systems against intrusions and attacks and to protect the data we collect, our measures may not prevent unauthorized access or use of sensitive data. We experience cyber-attacks and other security incidents of varying degrees from time to time, though none which individually or in the aggregate has led to costs or consequences which have materially impacted our operations or business. We may be required to expend significant additional resources in our efforts to modify or enhance our protective measures against evolving threats. A breach of our system or a third-party system upon which we rely may subject us to material losses or liability, including payment network fines, assessments and claims for unauthorized purchases with misappropriated credit, debit or card information, impersonation or other similar fraud claims. A misuse of such data or a 

I-18

cybersecurity breach could harm our reputation and deter our clients and potential clients from using electronic payments generally and our solutions and services specifically, thus reducing our revenue. In addition, any such misuse or breach could cause us to incur costs to correct the breaches or failures, expose us to uninsured liability, increase our risk of regulatory scrutiny, subject us to lawsuits and result in the imposition of material penalties and fines under state and federal laws or by the payment networks. While we maintain insurance coverage that may, subject to policy terms and conditions, cover certain aspects of cyber risks, such insurance coverage may be insufficient to cover all losses.

Although we generally require that our agreements with our distribution partners and service providers who have access to client and customer data include confidentiality obligations that restrict these parties from using or disclosing any client or customer data except as necessary to perform their services under the applicable agreements, there can be no assurance that these contractual