Company: CLPR
Filing Date: 2025-02-14
Form Type: 10-K
Source: 0001437749-25-003988
Chunk: 31

Company: Clipper Realty Inc.
Filing Date: 2025-02-14
Form: 10-K
Item: Item 1A
Chunk 31
---
-keeping systems, and many other key aspects of our business. These operations rely on the secure collection, storage, transmission, and other processing of confidential and other information in our computer systems and networks and subject us, and the third parties upon which we rely, to a variety of evolving threats, including, but not limited to ransomware attacks, which could cause security incidents.
 
 20

Cyberattacks, malicious Internet-based activity, online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of our confidential, proprietary, and sensitive data and information technology systems, and those of the third parties upon which we rely. Such threats are prevalent and continue to rise, are increasingly difficult to detect, and come from a variety of sources, including traditional computer “hackers,” threat actors, “hacktivists,” organized criminal threat actors, our personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors.
 
We rely on certain third-party service providers to operate our business. Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. If our third-party service providers experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if our third-party service providers fail to satisfy their data privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. In addition, supply chain attacks have increased in frequency and severity, and we cannot guarantee that third parties’ infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised. 
 
We take steps to monitor and develop our information technology networks and infrastructure, but we may not be able to detect and remediate all vulnerabilities because the threats and techniques used to exploit the vulnerability change frequently and are often sophisticated in nature. Therefore, such vulnerabilities could be exploited but may not be detected until after a security incident has occurred. Undetected and/or unremedied critical vulnerabilities that are exploited could pose material risks to our business. Further, we may experience delays in developing and deploying remedial measures designed to address any such identified vulnerabilities.
 
Furthermore, the extent of a particular cyberattack and the steps that we may need to take to investigate the attack may not be immediately clear. Therefore, in the event of an attack, it may take a significant amount of time before such an investigation can be completed. During an investigation, we may not