Company: CAVA
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001628280-25-007882
Chunk: 111

Company: CAVA GROUP, INC.
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1
Chunk 111
---
 grown as we have grown, and the scope and severity of risks posed to our systems from compromises to our information technology systems and cyber threats has increased in part due to the continued evolution and sophistication of attacks as well as the legal and regulatory framework pertaining to privacy and data security matters.

From time to time, we have been, and likely will continue to be, the target of attempts to compromise our information technology systems and data, such as credential stuffing, distributed denial-of-service attacks, ransomware, viruses, malware, phishing attacks, break-ins, social engineering, usage errors, power, communications or other service outages and catastrophic events, security breaches, or other cybersecurity incidents to our data, network, or systems. In addition, if any of our critical suppliers or distributors is the subject of a cyber or ransomware attack, we could experience a significant disruption in our supply chain and possibly shortages of key ingredients. The techniques and sophistication used to conduct cyber-attacks and breaches of information technology systems, as well as the sources and targets of these attacks, change frequently and are often not recognized until such attacks are launched or have been ongoing for a period of time. While we continue to make significant investment in physical and technological security measures, Team Member training, and third-party services designed to anticipate cyber-attacks and prevent breaches, our information technology networks and infrastructure, and those of third parties with which we have business relationships, could be vulnerable to attacks, damage, disruptions, shutdowns, or breaches of personal or confidential information. Efforts to hack or breach security measures, failures of systems or software to operate as designed or intended, viruses, operator error, or inadvertent releases of data all threaten our and our business partners’ information systems and records. Due to these scenarios, we cannot provide assurance that we will be successful in adequately responding to, or preventing, such breaches or data loss.

Any intentional attack or an unintentional event that results in unauthorized access to systems to disrupt operations, corrupt data, or steal or expose intellectual property, proprietary business information, personal or confidential information of our guests, Team Members, or ourselves could result in widespread negative publicity, damage to our reputation, a loss of guests, disruption of our business, and/or legal liabilities, including being the subject of claims or litigation (including class claims), regulatory enforcement, liability under data protection laws, and additional reporting requirements, resulting in substantial remediation costs, operational inefficiencies and a loss of sales.

The majority of our restaurant sales are paid with credit or debit cards, but we accept certain other