Company: SVV
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0001883313-25-000013
Chunk: 81

Company: Savers Value Village, Inc.
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1C
Chunk 81
---
 our most critical systems covered by appropriate backup approaches and rapid recovery tools/processes matched with their criticality.Cybersecurity RisksIn 2020, we suffered a ransomware incident associated with a well-known threat actor. While personnel time and attendance data was encrypted and unrecoverable, no evidence of unauthorized access of personal or business-related information was found, and our IT Security team immediately blocked the point of entry. Post-incident, Savers undertook a comprehensive review, identifying areas of vulnerability. Controls were systematically implemented, including appropriate backup approaches and regular testing of their effectiveness, proactive security monitoring tools and processes, and the expansion of our cybersecurity team and activities. Our continued ransomware mitigation strategies focus on resiliency, rapid recovery, and automated isolation of potentially affected assets. 

Other than the 2020 incident discussed above, we have no reason to believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For additional information, see “Risks Relating to Information Technology, Intellectual Property, Data Security and Privacy,” in Item 1A, “Risk Factors” in this Annual Report. 

Governance

Our Board, directly and through the Audit Committee, provides oversight of our operational risk management process and compliance with legal and regulatory requirements. As one of its responsibilities, the Audit Committee has the responsibility to review and discuss with management and the internal audit group all major financial risk exposures and management’s risk assessment and risk management policies. Further, the Audit Committee has specific oversight of risks related to data privacy and information security, including compliance with applicable laws and management’s response to material cybersecurity and privacy incidents or breaches. As part of its responsibilities, the Audit Committee periodically reviews with management the Company’s capabilities, policies, controls, methods and procedures related to (i) identifying, assessing and mitigating information and cybersecurity risks, (ii) disaster recovery and business continuity and (iii) compliance with data privacy and information security laws.Regularly scheduled Audit Committee meetings include an information technology and cybersecurity update as a standing agenda item. These updates are typically given by our Chief Information Officer (CIO) and can include additional team members from our information technology and security team. In addition, the Audit Committee also receives periodic updates from our Enterprise Risk Committee, a management committee which provides oversight to the anticipation, identification, prioritization, and management of the Company’s material risks. The Audit Committee regularly reports to the Board on