Company: KW
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0001408100-25-000084
Chunk: 41

Company: Kennedy-Wilson Holdings, Inc.
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1A
Chunk 41
---
 cyber-attacks, cyber intrusions or otherwise. 

We rely on our own and our third-party service provider’s computer systems, hardware, software, technology infrastructure and online sites and networks for both internal and external operations that are critical to our business (collectively, "IT Systems"). We face risks to the confidentiality, integrity and availability of our IT Systems and data associated with cybersecurity incidents or threats, including through cyber-attacks or cyber intrusions over the internet, malware (including ransomware), computer viruses, social engineer/phishing, insider malfeasance, human or technological error, as a result of bugs, misconfigurations or exploited vulnerabilities in software or hardware and resulting from other significant disruptions of our information technology networks and related systems. These risks include operational interruption, private data exposure and damage to our relationship with our customers, among others. A security breach involving our IT Systems could disrupt our operations in numerous ways that could ultimately have an adverse effect on our financial condition and results of operations. 

It is possible that our IT Systems could be compromised. As threat actors are becoming increasingly sophisticated in using techniques and tools – including artificial intelligence – that circumvent security controls, evade detection and remove forensic evidence, we may be unable to detect, investigate, remediate or recover from future attacks or incidents, or to avoid a material adverse impact to our IT Systems, data or business. Although we utilize various procedures and controls to mitigate our exposure to such risk, cybersecurity attacks are evolving and unpredictable. There can also be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our IT Systems and data.

Any adverse impact to the availability, integrity or confidentiality of our IT Systems or data can result in legal claims or proceedings (such as class actions), regulatory investigations and enforcement actions, fines and penalties, negative reputational impacts that cause us to lose existing or future customers, and/or significant incident response, system restoration or remediation and future compliance costs. Any or all of the foregoing could materially adversely affect our business, operating results, and financial condition. We cannot guarantee that any costs and liabilities incurred in relation to an attack or incident will be covered by our existing insurance policies or that applicable insurance will be available to us in the future on economically reasonable terms or at all.

Failure to comply with federal and state data privacy laws may result in significant liability, negative publicity, and/or an erosion of trust, which could materially adversely affect our business.

We receive, store, handle,