Company: IMXI
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0001683695-25-000030
Chunk: 33

Company: International Money Express, Inc.
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1A
Chunk 33
---
 processing, storage, and transmission of confidential, sensitive, proprietary, and other types of information relating to our business operations and confidential and sensitive information about consumers, agents, and employees in our computer systems and networks, and in those of our third-party vendors. Additionally, our business is built upon proprietary platforms that are supported by Intermex employees and partners. Keeping these platforms safe, private, and agile so that we may adjust to market demands is critical to our success. Individuals, groups, and state-sponsored organizations may take steps that pose threats to our operations, our computer systems, our employees, our consumers, and our agents. The cybersecurity risks we face range from cyberattacks that are common to most industries, such as the development and deployment of malicious software to gain access to our networks and to attempt to steal confidential information, launching distributed denial of service attacks, or attempting other coordinated disruptions. They may also include more advanced threats that target us because of our position in the remittance industry. Ransomware risk has increased significantly in recent years and presents a significant risk of financial extortion and loss of data. With the Intermex operating model, certain employees continue to work remotely or on a hybrid basis, which increases the importance of the integrity of our remote access security measures. We also face risk from our third-party suppliers if they are affected by cybersecurity incidents, which could result in their loss of service (which could be a significant component of our services to agents and consumers), exposure of Intermex proprietary, agent and consumer data, or a potential backdoor into the Company’s systems and networks.

While plans and procedures are in place to protect our sensitive data, systems, and networks, we cannot be certain that these measures will be successful and will be sufficient to counter all current and emerging technological threats that are designed to breach our systems to gain access to sensitive information or disrupt our operations. The methods used to obtain unauthorized access, disable or degrade service, or compromise systems change frequently, have become increasingly complex and sophisticated, and are often difficult to detect timely. Threats to our systems and our associated third parties’ systems can derive from human error, fraud, or malice on the part of employees or third parties as well as may result from accidental technological failure. Our defensive data protection measures may not prevent unauthorized access or use of sensitive data. While we maintain insurance coverage that may cover certain aspects of cyber risks 

18

and incidents, our insurance coverage may be insufficient to cover all losses, and we may not be able to renew the insurance on commercially reasonable