Company: IBTA
Filing Date: 2025-05-15
Form Type: 10-Q
Source: 0001628280-25-025593
Chunk: 199

Company: Ibotta, Inc.
Filing Date: 2025-05-15
Form: 10-Q
Item: Item 8
Chunk 199
---
 practices in response to a security breach or incident. Many of our employees work remotely, which may pose additional cybersecurity risks.

We also have incorporated AIML solutions and features into our platform and may incorporate additional AIML solutions and features into our platform in the future. The use of AIML solutions may result in security incidents and our use of AIML solutions and features may create additional cybersecurity risks or increase cybersecurity risks. Further, AIML technologies may be used in connection with certain cyber-attacks, resulting in heightened risks of security breaches and incidents. There also have been and may continue to be significant attacks on supply chains and on service providers. We do not control the security measures of third parties, but we may be, or face assertions that we are, responsible for any breach or incident they suffer or for any exploitable defects, vulnerabilities, or bugs in third-party components or services that we use.

If any security breach or incident impacts our data or data of one or more consumers, clients, or publishers, if we fail to detect, remediate, and otherwise address an actual or perceived security breach or incident in a timely manner, or if we suffer a cyberattack or other disruption that impacts our ability to operate our apps, systems, or networks, or if any of the foregoing is perceived to have occurred, it could materially adversely affect our reputation, business, financial condition, results of operations, and prospects. For example, any actual or perceived security breach or incident may cause publishers, CPG brands, retailers, and consumers to lose trust and confidence in us and decrease or cease their use of our platform, and we may face claims, litigation, or other adversarial actions by publishers, CPG brands, retailers, consumers, or others. More generally, any cyberattack, security breach, or incident, or the perception that any of these has occurred, could result in claims, demands, or other proceedings, or in fines, penalties, mitigation and remediation costs, reputational harm, diversion of management’s attention, and could otherwise materially adversely affect our business, financial condition, results of operations, and prospects. 

We have contractual and legal obligations to notify relevant stakeholders of certain security breaches and incidents. Any such disclosures could be costly, lead to negative publicity, and cause our clients, publishers, or consumers to lose confidence in the effectiveness of our security measures. Further, any such actual or perceived breach or incident, or any actual or perceived failure by us to comply with security-related contractual obligations, may increase the likelihood and frequency of audits we face under