Company: ZCARW
Filing Date: 2025-08-14
Form Type: 10-Q
Source: 0001213900-25-076590
Chunk: 274

Company: Zoomcar Holdings, Inc.
Filing Date: 2025-08-14
Form: 10-Q
Item: Part I, Item 2
Chunk 274
---

our business, we collect, use, store, transmit, and process data and information about Hosts, Guests, employees, and others, some of which
may be sensitive, personal, or confidential and make us an attractive target and potentially vulnerable to cyberattacks, computer viruses,
electronic break-ins or similar disruptions. Recently on June 9, 2025, the Company identified a Cybersecurity Incident involving unauthorized
access to its information systems. The Company became aware of the incident after certain employees received external communications from
a threat actor alleging unauthorized access to Company data. Upon discovery, the Company promptly activated its incident response plan.
Although based on its initial assessment the Company determined that an unauthorized third party accessed a limited dataset containing
certain personal information of a subset of approximately 8.4 million users, including names, phone numbers, car registration numbers,
personal addresses and email addresses associated with such users, it found no evidence to suggest that financial information, plaintext
passwords, or other sensitive identifiers were compromised. To date, the incident has not resulted in any material disruption to the Company’s
operations.

Accordingly, any such unauthorized
access to or use of such data and information, or breach of our security measures or those of our third-party service providers, could
adversely affect our business, operations, and future prospects. While we have taken steps to mitigate our cyberattack risks and protect
the confidential information that we have access to, including but not limited to installation and periodical updates of antivirus software
and backup of information on our computer systems, our security measures may be vulnerable to such security breaches. In response to the
Cybersecurity Incident, the Company took immediate actions to contain the threat and enhance its security posture. These measures include
implementing additional safeguards across the cloud and internal network, increasing system monitoring, and reviewing access controls.
The Company is also engaging with third-party cybersecurity consultants to have an external cybersecurity assessment
in order to further strengthen its infrastructure and cybersecurity framework. 

Even though the Company has
taken the relevant steps to ensure that such breach does not occur again, because techniques used to sabotage or obtain unauthorized access
to systems change frequently and generally are not recognized until they are launched against a target, we may be unable to anticipate
these techniques or to implement adequate preventative measures. Any cybersecurity incident like the one we recently experienced, accidental
or willful security breaches or other unauthorized access to our systems could cause confidential information to