Company: RITM-PC
Filing Date: 2025-02-18
Form Type: 10-K
Source: 0001556593-25-000007
Chunk: 130

Company: Rithm Capital Corp.
Filing Date: 2025-02-18
Form: 10-K
Item: Item 1A
Chunk 130
---
 not limited to, our Servicing Partners). Cybersecurity incidents may involve gaining authorized or unauthorized access to our information systems for purposes of theft of certain personally identifiable or other information of consumers or fund investors, misappropriating assets, stealing confidential information, corrupting data or causing operational disruption. Disruptions and failures of our systems or those of our third-party vendors could result from these incidents or be caused by fire, power outages, natural disasters and other similar events and may interrupt or delay our ability to provide services to our customers, expose us to remedial costs and reputational damage, and otherwise adversely affect our operations.

Despite our efforts to ensure the integrity of our systems, there can be no assurance that any such cyber incidents will not occur or, if they do occur, that they will be adequately addressed. We also may not be able to anticipate or implement effective preventive measures against all security breaches, especially because the methods and sources of breaches change frequently or may not be immediately detected. The sophistication of cybersecurity threats, including through the use of artificial intelligence, continues to increase, and the controls and preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems, including the regular testing of our cybersecurity incident response plan, may be insufficient. In addition, new technology that could result in greater operational efficiency may further expose our computer systems to the risk of cybersecurity incidents. See “—Risks Related to Our Business—The development and use of AI technology could lead to legal or regulatory actions, harm our reputation, or have a significant negative impact on our business.”

In addition, we are subject to various privacy and data protection laws and regulations, and any changes to laws or regulations, including new restrictions or requirements applicable to our business, could impose additional costs and liability on us and could limit our use and disclosure of such information. For example, the New York State Department of Financial Services requires certain financial services companies, such as NRM and Newrez, to establish a detailed cybersecurity program and comply with other requirements, and the CCPA created new compliance regulations on businesses that collect information from California residents. We are also subject to the GDPR and similar statutes. The GDPR imposes comprehensive data privacy compliance obligations in relation to our collection, processing, sharing, disclosure, transfer and other use of data relating to an identifiable living individual or “personal data,” including a principle of accountability and the obligation to demonstrate compliance through policies, procedures, training and audit. Non-compliance by us, or potentially by third parties with which we share information, with any applicable privacy and cybersecurity