Company: WRBY
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0001504776-25-000010
Chunk: 173

Company: Warby Parker Inc.
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1
Chunk 173
---
 sufficient to prevent data loss or long-term network outages. 

Our IT and ERP systems and the IT systems of our third-party service providers and business partners may be vulnerable to security incidents, attacks by hackers, acts of vandalism, computer viruses, misplaced or lost data, human or technological errors or other similar events. If unauthorized parties gain access to our networks, databases, or other IT systems, or those of our third-party service providers or business partners, they may be able to steal, publish, delete, use inappropriately, or modify our private and sensitive third-party information including health information, credit card and other payment card information, and personal information. In addition, employees may intentionally or inadvertently cause data or security incidents that result in unauthorized access to or release of sensitive, personal or confidential information. Because the techniques used to circumvent security systems can be highly sophisticated, change frequently, are often not recognized until launched against a target, and may originate from less regulated and remote areas around the world, we may be unable to proactively anticipate or address all possible techniques or implement adequate preventive measures for all situations. 

Security incidents compromising the confidentiality, integrity, and availability of this information and the security of our IT systems could result from cyber-attacks, computer malware, viruses, social engineering (including spear phishing and ransomware attacks), credential stuffing, supply chain attacks, efforts by individuals or groups of hackers and sophisticated organizations, including state-sponsored organizations, errors or malfeasance of our personnel, malicious code embedded in open-source software, misconfigurations, “bugs”, and other security vulnerabilities in the software or systems on which we rely. We anticipate that these threats will continue to grow in scope and complexity over time and such incidents have occurred in the past, and may occur in the future, resulting in unauthorized, unlawful, or inappropriate access to, inability to access, disclosure of, or loss of the sensitive, proprietary, personal and confidential information that we handle. For example, in 2018, we experienced a credential stuffing attack in which malicious third parties likely used credentials compromised in data breaches suffered by other, unaffiliated companies to access accounts on our platform. In 2019, we received notice from the Office for Civil Rights, or OCR, of the U.S. Department of Health and Human Services indicating that OCR would begin an investigation regarding the incident and our compliance with the Health Insurance Portability and Accountability Act (“HIPAA”) Privacy, Security, and Breach Notification Rules and requesting certain information related to the incident and our compliance with such rules