Company: CRCL
Filing Date: 2025-02-13
Form Type: DRS/A
Source: 0000950123-25-001965
Chunk: 72

Company: Circle Internet Group, Inc.
Filing Date: 2025-02-13
Form: DRS/A
Chunk 72
---
ANT TO 17 C.F.R. § 200.83

governmental authorities and affected individuals with respect to such incidents. For
example, laws throughout the United States and in foreign jurisdictions, including in all 50 U.S. states, the EEA, the UK, and Singapore, may require businesses to provide notice under certain circumstances to consumers whose personal information
has been disclosed as a result of a data breach. Some laws impose specific data breach reporting obligations if special categories of personal information is disclosed as a result of a cyberattack or information security breach. Complying with such
numerous and complex regulations in the event of a cyberattack or information security breach would be expensive and difficult, and failure to comply with these regulations could subject us to regulatory scrutiny and additional liability. We may
also be contractually required to notify customers or business partners of a cyberattack or security breach. Regardless of our contractual protections, any actual or perceived cyberattack or security breach, or breach of our legal or contractual
obligations, could harm our reputation and brand, expose us to potential liability, or require us to expend significant resources on information security and in responding to any such actual or perceived incident or related investigations or
litigation.

Although we maintain insurance coverage that we believe is adequate for our business, it may be insufficient to protect us against all losses and
costs stemming from cyberattacks or security breaches, other types of unlawful activity, or any resulting disruptions from such events. Furthermore, there can be no assurance that we will be able to maintain such insurance coverage at reasonable
costs or at all. Although we currently maintain disaster recovery and business continuity plans to address disruptions of our systems, we may not be able to adequately continue our business or return to operability within a reasonable period of time
in the case of such an occurrence. Recovery of our systems may be additionally hampered where we have outsourced the operation of systems and information storage to third parties. Outages and disruptions of our systems, including any caused by
cyberattacks or security breaches, may harm our business, results of operations, financial condition, and prospects.

As a remote-first company, we are subject to heightened operational and cybersecurity risks.

We are a remote-first company, meaning that for all existing roles our employees work from their homes or
shared office spaces hosted by third parties, which subjects us to heightened operational risks. For example, at these locations, technologies may not be as robust as those used in corporate offices, which could cause our networks,