Company: TIPT
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0001393726-25-000028
Chunk: 77

Company: TIPTREE INC.
Filing Date: 2025-03-03
Form: 10-K
Item: Item 1A
Chunk 77
---
 other improper activity. Our businesses have experienced immaterial cybersecurity incidents and they and their third-party service providers will likely continue to experience cybersecurity incidents of varying degrees. Because the techniques used to obtain unauthorized access or to sabotage systems change frequently, generally are not recognized until launched against a target and can originate from a wide variety of sources, our businesses and the third parties with whom they do business may be unable to anticipate these techniques or to implement adequate preventative measures effective against all such security threats. With the increasing frequency of cyber-related fraud to obtain inappropriate payments and other threats related to cybersecurity attacks, our businesses may find it necessary to expend resources to remediate cyber-related incidents or to enhance and strengthen their cybersecurity. Such remediation efforts may not be successful and could result in interruptions, delays or cessation of service.

Our businesses have also implemented physical, administrative and logical security systems with the intent of maintaining the physical security of their facilities and systems and protecting their and their customers’ confidential and personally identifiable information against unauthorized access through their information systems or by other electronic transmission or through misdirection, theft or loss of data. Despite such efforts, they have in the past, and may in the future, be subject to a breach of their security systems that results in unauthorized access to their facilities or the information they are trying to protect. Anyone who is able to circumvent their security measures or those of their third-party service providers and penetrate their information systems could access, view, misappropriate, alter, destroy, misuse or delete any information in such systems, including personally identifiable information and proprietary business information (their own or that of third parties) or compromise of their control networks or other critical systems and infrastructure, resulting in disruptions to their business operations or access to their financial reporting systems. While our businesses have implemented business contingency plans and other reasonable plans to protect their systems, sustained or repeated system failures or service denials could severely limit their ability to write and process new and renewal business, provide customer service or otherwise operate in the ordinary course of business. In addition, most states require that customers be notified if a security breach results in the disclosure of personally identifiable customer information and the trend toward general public notification of such incidents could exacerbate the harm to our companies’ business, financial condition and results of operations. Any failure, interruption or compromise of the security of our business’s information systems or those of their third-party service providers that result in inappropriate disclosure of such information could result in, among other things, significant financial losses, unfavorable publicity and damage to their reputation, governmental inquiry and oversight, difficulty in