Company: CRCL
Filing Date: 2025-08-04
Form Type: DRS
Source: 0000950123-25-006942
Chunk: 71

Company: Circle Internet Group, Inc.
Filing Date: 2025-08-04
Form: DRS
Chunk 71
---
, and we expect that they will continue to attempt, to gain
access to our systems and facilities, as well as those of our customers, partners, and third-party service providers. Such unauthorized parties have used various means, including hacking, social engineering, phishing, and attempting to fraudulently
induce individuals (including employees, service providers, and our customers) into disclosing usernames, passwords, or other sensitive information, which may in turn be attempted to be used to access our information technology systems and our
customers’ digital assets. In the past, we have been subject to cybersecurity incidents in which fraudulent actors obtained company-owned funds. Threats can come from a variety of sources, including criminal hackers, hacktivists,
state-sponsored intrusions, industrial espionage, and insiders. Certain threat actors may be supported by significant financial and technological resources, making them even more sophisticated and difficult to detect. As a result, our costs and the
resources we devote to protecting against these advanced threats and their consequences may continue to increase over time.

A cyberattack or security
breach that results in the unauthorized disclosure of personal information could also expose us to liability under various laws and regulations across jurisdictions and increase the risk of litigation and governmental or regulatory investigation.
Due to concerns about information security and integrity, a growing number of legislative and regulatory bodies have adopted breach notification and other requirements in the event that information subject to such laws is accessed by unauthorized
persons and additional regulations regarding security of such information are possible. We may in the future need to notify governmental authorities and affected individuals with respect to such incidents. For example, laws throughout the United
States and in foreign jurisdictions, including in all 50 U.S. states, the EEA, the UK, and Singapore, may require businesses to provide notice under certain circumstances to consumers whose personal information has been disclosed as a result of a
data breach. Some laws impose specific data breach reporting obligations if special categories of personal information is disclosed as a result of a cyberattack or information security breach. Complying with such numerous and complex regulations in
the event of a cyberattack or information security breach would be expensive and difficult, and failure to comply with these regulations could subject us to regulatory scrutiny and additional liability. We may also be contractually required to
notify customers or business partners of a cyberattack or security breach. Regardless of our contractual protections, any actual or perceived cyberattack or security breach, or breach of our legal or contractual obligations, could harm our
reputation and brand, expose us to potential