Company: FCFS
Filing Date: 2025-02-03
Form Type: 10-K
Source: 0000840489-25-000032
Chunk: 91

Company: FirstCash Holdings, Inc.
Filing Date: 2025-02-03
Form: 10-K
Item: Item 1A
Chunk 91
---
 on persons with whom the Company has commercial relationships, that results in the unauthorized access to or use of personal information or the unauthorized access to or use of confidential employee, customer, supplier or Company information, could result in a violation of applicable privacy and other laws, significant legal and financial exposure, damage to the Company’s reputation, and a loss of confidence of the Company’s customers, vendors and others, which could harm its business and operations. Any compromise of security could deter people from entering into transactions that involve transmitting confidential information to the Company’s systems and could harm relationships with the Company’s suppliers, which could have a material adverse effect on the Company’s business. Actual or anticipated cyber attacks may cause the Company to incur substantial costs, including costs to prevent future attacks and investigate actual attacks, deploy additional personnel and protection technologies, train employees and engage third-party experts and consultants. Despite the Company’s implementation of significant security measures, including the use of encryption and authentication technology to provide security and authentication to effectively secure transmission of confidential information, these systems may still be vulnerable to physical break-ins, computer viruses, programming errors, attacks by third-parties or similar disruptive problems. The Company may not have the resources or technical sophistication to anticipate or prevent rapidly evolving types of cyber attacks.  Moreover, the Company may be unable to anticipate cyber attacks, react in a timely manner, or implement adequate preventative or remedial measures. Although the Company monitors its systems in order to detect security breaches or instances of unauthorized access to confidential information, there is no guarantee that its monitoring efforts will be effective. While the Company has not experienced any material losses relating to cyber attacks or other information security breaches to date, the Company and AFF have been the subject of attempted hacking and cyber attacks and there can be no assurance that the Company will not suffer significant losses or reputational harm in the future.

Additionally, the regulatory environment related to information security and data collection, retention, use and privacy is increasingly rigorous, with new and constantly changing requirements applicable to the Company’s business, and compliance with those requirements could result in additional costs, such as increased investment in technology or investigative expenses, the costs of compliance with privacy laws, and fines, penalties and costs incurred to prevent or remediate information security or cyber breaches. Furthermore, federal and state regulators and many federal and state laws and regulations require notice of any data security breaches that involve personal information. These mandatory disclosures are costly to implement and often lead to widespread negative publicity, which may cause consumers to lose confidence in the effectiveness of the Company’s data security measures.