Company: CRCL
Filing Date: 2025-05-16
Form Type: S-1/A
Source: 0001193125-25-121234
Chunk: 80

Company: Circle Internet Group, Inc.
Filing Date: 2025-05-16
Form: S-1/A
Chunk 80
---
 regulations regarding security of such information are possible. We may in the future need to notify governmental authorities and affected individuals with respect to such incidents. For example, laws throughout the United States and
in foreign jurisdictions, including in all 50 U.S. states, the EEA, the UK, and Singapore, may require businesses to provide notice under certain circumstances to consumers whose personal information has been disclosed as a result of a data breach.
Some laws impose specific data breach reporting obligations if special categories of personal information is disclosed as a result of a cyberattack or information security breach. Complying with such numerous and complex regulations in the event of
a cyberattack or information security breach would be expensive and difficult, and failure to comply with these regulations could subject us to regulatory scrutiny and additional liability. We may also be contractually required to notify customers
or business partners of a cyberattack or security breach. Regardless of our contractual protections, any actual or perceived cyberattack or security breach, or breach of our legal or contractual obligations, could harm our reputation and brand,
expose us to potential liability, or require us to expend significant resources on information security and in responding to any such actual or perceived incident or related investigations or litigation.

Although we maintain insurance coverage that we believe is adequate for our business, it may be insufficient to protect us against all losses and costs stemming from
cyberattacks or security breaches, other types of unlawful activity, or any resulting disruptions from such events. Furthermore, there can be no assurance that we will be able to maintain such insurance coverage at reasonable costs or at all.
Although we currently maintain disaster recovery and business continuity plans to address disruptions of our systems, we may not be able to adequately continue our business or return to operability within a reasonable period of time in the case of
such an occurrence. Recovery of our systems may be additionally hampered where we have outsourced the

54

operation of systems and information storage to third parties. Outages and disruptions of our systems, including any caused by cyberattacks or security breaches, may harm our business, results of
operations, financial condition, and prospects.

As a remote-first company, we are subject to heightened operational and cybersecurity risks.

We are a remote-first company, meaning that for all existing roles our employees work from their homes or shared office spaces hosted by third parties, which subjects us
to heightened operational risks. For example, at these locations, technologies may not be as robust as those used in corporate offices, which could cause our networks, information systems, applications