Company: CRCT
Filing Date: 2025-03-05
Form Type: 10-K
Source: 0001828962-25-000039
Chunk: 94

Company: Cricut, Inc.
Filing Date: 2025-03-05
Form: 10-K
Item: Item 1A
Chunk 94
---
 subject to cyberattacks and security breaches and 

45

incidents in the past, and cyberattacks, security breaches and incidents could expose us to a risk of lost, exposed or corrupted information, unauthorized disclosure of information, litigation and possible liability to employees, users, brick-and-mortar and online retail partners and regulatory authorities. Geopolitical conflicts and tensions may also increase our risks from cyberattacks and security breaches and incidents. In addition, a significant portion of our data and information is hosted in a cloud-computing environment, where design apps and data are hosted, accessed and processed through a third-party provider over a broadband Internet connection. In a cloud-computing environment, we could be subject to outages, security breaches and incidents and cyberattacks affecting the third-party service provider. More of our and our service providers’ personnel are working remotely in recent years than prior to the COVID-19 pandemic, which increases the risks of cyberattacks and security breaches and incidents.

If our data management systems do not effectively and securely collect, store, process and report relevant data and information for the operation of our business, whether due to equipment malfunction or constraints, software defects or deficiencies, bugs, vulnerabilities, computer viruses, malware, ransomware, phishing attacks, distributed denial-of-service attacks, security breaches or incidents, cyberattacks, catastrophic events, human error or malfeasance or otherwise, our ability to effectively plan, forecast and execute our business plan and comply with applicable laws and regulations will be impaired, potentially in a material manner. Any such impairment could materially and adversely affect our financial condition, results of operations, cash flows and the timeliness with which we internally and externally report our results of operations. As a result, our data management systems require an ongoing commitment of significant resources to maintain, protect and enhance existing systems and develop new systems to keep pace with continuing changes in information processing technology, evolving legal and regulatory standards, the increasing need to protect customer, partner and employee information, including personal data and personal information, and the information technology needs associated with our changing products and services. We strive to implement reasonable security procedures and practices to help ensure that our data management systems effectively collect, store, process and report relevant data for the operation of our business, though there are no assurances that these procedures and practices will be successful or that additional systems issues will not arise in the future.

In addition, security breaches or incidents from errors, malfeasance or misconduct by employees, contractors or others with access to our systems may pose a risk that sensitive data, including personal data