Company: ZM
Filing Date: 2025-11-25
Form Type: 10-Q
Source: 0001585521-25-000202
Chunk: 98

Company: Zoom Communications, Inc.
Filing Date: 2025-11-25
Form: 10-Q
Item: Part I, Item 4
Chunk 98
---
 integrity of our platform or data security, as well as other potential liability and consequences. Additionally, our platform, products, and services are relied on by a large number of companies worldwide and as a result, if our platform, products, or solutions are compromised, a significant number or all of our customers and their data could be simultaneously affected. The potential liability and associated consequences we could suffer as a result of such a large-scale event could be catastrophic and result in irreparable harm.

Future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies.  Furthermore, we have discovered, and may in the future discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program.

Our customers may place certain security obligations on us. For example, some of our customers may be subject to the EU’s Digital Operational Resilience Act (DORA) and similar UK regulatory requirements on operational resilience. These laws may obligate our customers to impose contractual provisions on us, including certain mandatory third-party risk management provisions. If we fail to materially comply with these contractual requirements, we may be subject to investigations, audits or other adverse consequences.

In addition, our reliance on third parties has in the past and could continue to introduce new cybersecurity risks and vulnerabilities, including supply-chain attacks, and other threats to our business operations. We rely on third parties to operate critical business systems to process confidential, proprietary, and sensitive data in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, employee email, content delivery to customers, and other functions. We also rely on third parties to provide other products, services and parts, or otherwise to operate our business.  Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. If the third parties with whom we work experience a security incident or other interruption, we could experience adverse consequences.  While we may be entitled to damages if      the third parties with whom we work fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award.  In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties’ infrastructure in