Company: DLX
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0000027996-25-000051
Chunk: 23

Company: DELUXE CORP
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1A
Chunk 23
---
 business and personal information.

We rely on numerous third parties, including vendors, developers, and partners, who are critical to our business and may have access to our customer or employee data. We have established a vendor security program to assess the risk of these partners, and certain third-party relationships are subject to security requirements specified in written contracts. However, we cannot control the actions of our third-party providers, and any cyberattacks or security breaches they experience could adversely affect our ability to service our customers or conduct our business.

Techniques used to gain unauthorized access, disable or degrade service, or sabotage computer systems are constantly evolving, often difficult to detect immediately, and are generally not recognized until they are launched against a target. As a result, we may be unable to implement adequate preventive measures. Unauthorized parties may attempt to access our systems or facilities through various means, including hacking, fraud, trickery, or other deceptive methods targeting employees and contractors. Additionally, our customers and employees have been and will continue to be targeted by threat actors using social 

15

engineering techniques to obtain confidential information or introduce malware through fraudulent "phishing" emails. To-date, these threats and incidents have not materially impacted our customers, business, or financial results. However, given the increasing threat landscape for all technology businesses, our technologies, systems, and networks are likely to be targeted in future attacks, and we cannot guarantee that future incidents will not be material.

Despite our robust cybersecurity systems and processes, there remains a risk that an unauthorized party could bypass our security measures. Such a breach could result in the misappropriation of personal or proprietary information belonging to us, our customers, or our partners. Additionally, it could lead to disruptions in our operations, damage to our computer systems or those of our users, and potentially harm our reputation. Such events could deter clients and consumers from purchasing our products and services and result in the termination of client contracts. Additionally, vulnerabilities affecting large segments of mobile, computer, or server architecture could have widespread impacts. Any of these events would negatively affect our business, financial condition, and results of operations.

In the event of a material information security breach, we may need to expend significant management time and financial resources to remedy, protect against, or mitigate the effects of the breach. We may not be able to resolve the situation promptly, or at all. Furthermore, under payment card association rules and our contracts with debit and credit card processors, a breach of payment card information stored by us or our third-party partners could make us liable to the payment card issuing