Company: MMI
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0001578732-25-000015
Chunk: 65

Company: Marcus & Millichap, Inc.
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1A
Chunk 65
---
 and infrastructure have been subject to, and may in the future be vulnerable to various cyber-attacks, such as hacking, spoofing and phishing attacks and ransomware attacks, exploitation of 

20

system or application vulnerabilities or our systems may be breached due to employee error, malfeasance or other disruptions. We may also not have sufficient logging available to fully investigate the scope of a cyber-attack.

Additionally, a portion of our workforce works remotely in some capacity. This arrangement exposes us to additional threat vectors and vulnerabilities.

A significant actual or potential theft, loss, fraudulent use or misuse of client, employee or other personally identifiable data, whether by third parties or as a result of employee malfeasance or otherwise, non-compliance with our contractual or other legal obligations regarding such data or a violation of our privacy and security policies with respect to such data could result in significant costs, fines, litigation or regulatory actions against us. Such an event could additionally disrupt our operations and the services we provide to clients, damage our reputation, and cause a loss of confidence in our services, which could adversely affect our business, revenue and competitive position.

Additionally, we increasingly rely on third-party data storage providers, including cloud storage solution providers, resulting in less direct control over our data. Such third parties may also be vulnerable to security breaches and compromised security systems, which could adversely affect our reputation. In the past several years, supply chain attacks have increased in frequency and severity. As we are a consumer of information systems and technology, we are at risk of being impacted either directly or indirectly by these attacks. The control systems, cybersecurity program, infrastructure, physical facilities of, and personnel associated with third parties that we rely on are beyond our control.

We rely on the collection and use of personally identifiable information from clients to conduct our business. We disclose our information collection and dissemination practices in a published privacy statement on our websites, which we may modify from time to time. We may be subject to legal claims, government action, including under the Racketeer Influenced and Corrupt Organizations Act, and damage to our reputation if we act or are perceived to be acting inconsistently with the terms of our privacy statement, client expectations or the law. In the event we or the vendors with which we contract to provide services on behalf of our clients were to suffer a breach of personally identifiable information, our customers could terminate their business with us. Further, we may be subject to claims to the extent individual employees or investment sales and financing professionals breach or fail to adhere to Company policies and practices