Company: AFRM
Filing Date: 2025-08-28
Form Type: 10-K
Source: 0001820953-25-000080
Chunk: 73

Company: Affirm Holdings, Inc.
Filing Date: 2025-08-28
Form: 10-K
Item: Item 1A
Chunk 73
---
 similar disruptions.

Our business involves the collection, storage, use, disclosure, processing, transfer, and other handling (collectively, “processing”) of a wide variety of information, including personally identifiable information, for various purposes in our business, including to help support the integrity of our services and to provide features and functionality to our consumers and commercial partners. The processing of the information we acquire in connection with our consumers’ and commercial partners’ use of our services, particularly on our internet applications for consumers, is subject to numerous privacy, data protection, cybersecurity, and other laws and regulations in the United States and foreign jurisdictions. The automated nature of our business and our reliance on digital technologies may make us an attractive target for, and potentially vulnerable to, cyber-attacks, computer malware, computer viruses, social engineering (including phishing and ransomware attacks), general hacking, physical or electronic break-ins, or similar disruptions. In addition, our remote working environment may exacerbate these risks. 

While we and our third-party partners have taken steps to protect the confidential, proprietary, and sensitive information to which we have access and to prevent data loss, our security measures or those of our third-party partners could be breached, such as the Evolve Bank & Trust cybersecurity incident reported in June 2024, resulting in the loss of, or unauthorized access to, our or our consumers’ data, our intellectual property, or other confidential, proprietary, or sensitive business information and could expose us to liability related to the loss of the information, time-consuming and expensive litigation, potential regulatory scrutiny and negative publicity.

44

Table of Contents

As is common in our industry, and with technology-focused companies more broadly, unauthorized parties regularly attempt to gain access to our systems and facilities through various means, including, among others, hacking into our or our partners’ or consumers’ systems or facilities, or attempting to fraudulently induce our employees, partners, consumers or others into disclosing usernames, passwords, or other sensitive information, which may in turn be used to access our information technology systems and gain access to our or our consumers’ data or other confidential, proprietary, or sensitive information. In the past, such attempts have, at times, been successful but with minimal impact on or disruption to our business, and there is no guarantee that our continuous monitoring efforts will be effective in preventing similar or more impactful incidents in the future.

If we are unable to protect our intellectual property, or if third parties are successful in claiming that we are infringing, misappropriating, or violating the intellectual property