Company: CDLX
Filing Date: 2025-11-05
Form Type: 10-Q
Source: 0001666071-25-000159
Chunk: 9

Company: Cardlytics, Inc.
Filing Date: 2025-11-05
Form: 10-Q
Item: Item 4
Chunk 9
---
. In particular, severe ransomware attacks are becoming increasingly prevalent and can lead to significant interruptions in our operations, ability to provide our products or services, loss of sensitive data and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments.

Current or future criminal capabilities, discovery of existing or new vulnerabilities in our systems and attempts to exploit those vulnerabilities or other developments may compromise the technology protecting our systems. Due to a variety of both internal and external factors, including defects or misconfigurations of our technology, our services have in the past and may in the future become vulnerable to security incidents (both from intentional attacks and accidental causes) that cause them to fail to secure networks and detect and block attacks. In the event that our protection efforts are unsuccessful, and our systems are compromised such that a third party gains entry to our or any of our FI partners' systems, we could suffer substantial harm. 

In addition, the majority of our employees work remotely, which makes us more vulnerable to cyberattacks and has increased risks to our systems and data, as more of our employees utilize network connections, computers and devices outside our premises or network, including working at home, while in transit and in public locations. A security breach could result in operational or administrative disruptions, or impair our ability to meet our marketers' requirements, which could result in decreased revenue. Also, our reputation could suffer irreparable harm, causing our current and prospective marketers and FI partners to decline to use our solutions in the future. Future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities' systems and technologies. Furthermore, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program.

We utilize third parties to operate critical business systems and to process sensitive information in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, employee email, and other functions. Our ability to monitor these third parties' information security practices is limited, and these third parties may not have adequate information security measures in place. If the third parties with whom we work experience a security incident or other interruption, we could experience adverse consequences. While