Company: STGW
Filing Date: 2025-03-11
Form Type: 10-K
Source: 0000876883-25-000009
Chunk: 63

Company: Stagwell Inc
Filing Date: 2025-03-11
Form: 10-K
Item: Item 1A
Chunk 63
---
, prevent, respond to and mitigate cybersecurity incidents and our organizational training for employees to develop an understanding of cybersecurity risks and threats may be unable to prevent material security breaches, theft, modification or loss of data, employee malfeasance (including improper use 

15

of social media) and additional known and unknown threats. We have experienced, and may again experience, data security incidents resulting from unauthorized access to our and our service providers’ systems and unauthorized acquisition of our data and our clients’ data, including inadvertent disclosure, misconfiguration of systems, phishing ransomware or malware attacks. In addition, certain of our clients may experience breaches of systems and cloud-based services enabled by or provided by us.

In providing services and solutions to clients, we often manage, utilize and store sensitive or confidential client or other data, including personal data and proprietary information, and we expect these activities to increase, including through the use of AI, bots and cloud-based analytics. Security breaches, improper use of our systems and other types of unauthorized access to our systems, data, and information by employees and others may pose a risk that data may be exposed to unauthorized persons or to the public. We have access to sensitive data, personal data, and information that is subject to various data privacy laws and regulations, which have obligations that are triggered in the event of a breach. Unauthorized disclosure of, denial of access to, or other incidents involving sensitive or confidential client, vendor, Global Affiliates partner or our own data, whether through systems failure, employee negligence, fraud, misappropriation, or cybersecurity, ransomware or malware attacks, or other intentional or unintentional acts, could damage our reputation and our competitive positioning in the marketplace, disrupt our or our clients’ business, cause us to lose clients and result in significant financial exposure and legal liability. Similarly, unauthorized access to or through, denial of access to, or other incidents involving, our software and IT supply chain or SaaS providers, our service providers’ information systems or those we develop for our clients, whether by our employees or third parties, including a cyberattack by computer programmers, hackers, members of organized crime and/or state-sponsored organizations, who continuously develop and deploy viruses, ransomware, malware or other malicious software programs or social engineering attacks, could result in negative publicity, significant remediation costs, legal liability, damage to our reputation and government sanctions and could have a material adverse effect on our results of operations.

We are subject to extensive data privacy laws and regulations.

Laws and regulations related to consumer privacy, processing