Company: WRBY
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0001504776-25-000010
Chunk: 175

Company: Warby Parker Inc.
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1
Chunk 175
---
-facing operations, successful cyberattacks that disrupt or result in unauthorized access to third party IT systems can materially impact our operations and financial results. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.

A security breach may also cause us to breach our contractual obligations. Our agreements with certain customers, business partners, or other stakeholders may require us to use industry-standard or reasonable measures to safeguard confidential, sensitive and personal information. As a healthcare provider and to the extent we provide services to healthcare providers, we are also subject to laws and regulations such as the HIPAA Security Rule that require us to adhere to specific technical safeguards, or to use industry-standard or reasonable security measures to safeguard certain information. A security incident could lead to claims by our customers, business partners, or other relevant stakeholders that we have failed to comply with such legal or contractual obligations. In addition, our inability to comply with data privacy or security obligations in our contracts or our inability to flow down such obligations to our vendors, collaborators, other contractors, or consultants may cause us to breach our contracts. As a result, we could be subject to legal action or our customers or business partners could end their relationships with us. There can be no assurance that the limitations of liability in our contracts would be enforceable or adequate or would otherwise protect us from liabilities or damages.

In addition, any access, disclosure or other loss or unauthorized use of information or data, whether actual or perceived, could result in legal claims or proceedings, regulatory investigations or actions, negative reputational impacts that cause us to lose existing or future customers, significant incident response, system restoration or remediation and future compliance costs, and other types of liability under laws that protect the privacy and security of personal information, including federal, state and foreign data protection and privacy regulations, violations of which could result in significant penalties and fines in the EU, UK, Canada, and United States. In addition, although we seek to detect and investigate all data security incidents, security breaches, and other incidents of unauthorized access to our information technology systems and data can be difficult to detect and any delay in identifying such breaches or incidents may lead to increased harm and legal exposure of the type described above. 

The cost of investigating, mitigating, and responding to potential security breaches and complying with applicable breach notification obligations to individuals, regulators, partners, and others can be significant. Further, defending a suit, regardless of its merit, could be