Company: CRCL
Filing Date: 2025-02-13
Form Type: DRS/A
Source: 0000950123-25-001965
Chunk: 70

Company: Circle Internet Group, Inc.
Filing Date: 2025-02-13
Form: DRS/A
Chunk 70
---
 confidence could negatively impact us, including the market perception of the effectiveness of our security measures and technology infrastructure. An increasing number of organizations—including large businesses, technology companies, and financial institutions as well as government institutions—have disclosed breaches of their information security systems, some of which have involved sophisticated and highly targeted cyberattacks or security breaches, including on their websites, mobile applications, and infrastructure. Attacks upon systems across a variety of industries, including the digital asset industry, are increasing in their frequency, persistence, and sophistication, and, in many 45

CONFIDENTIAL TREATMENT REQUESTED BY CIRCLE INTERNET GROUP, INC. PURSUANT TO 17 C.F.R. § 200.83

cases, are being conducted by sophisticated, well-funded, and organized groups and
individuals, including state actors. The techniques used to obtain unauthorized, improper, or illegal access to systems and information (including customers’ personal data and digital assets), disable or degrade services, or sabotage systems
are constantly evolving, may be difficult to detect quickly, and often are not recognized or detected until after they have been launched against a target. These cyberattacks or security breaches may occur on our systems or those of our third-party
service providers or partners. Certain types of cyberattacks or security breaches could harm us even if our systems are left undisturbed. For example, cyberattacks or security breaches may be designed to deceive employees and service providers into
releasing control of our systems to a hacker, while others may aim to introduce computer viruses or malware into our systems with a view to stealing confidential or proprietary data. Additionally, certain threats are designed to remain dormant or
undetectable until launched against a target, and we may not be able to implement adequate preventative measures. Even when a cyberattack or security breach is detected, the full extent of the breach may not be determined immediately.

We have sought to develop systems and processes designed to protect the data we manage, prevent data loss and other cyberattacks or security breaches, and respond to
known and potential risks, and we expect to continue to expend significant resources to bolster these protections. For example, we have sought to develop a security program and established controls aligned to the cybersecurity framework established
by the National Institute of Standards and Technology; however, there are several areas that continue to be enhanced and are dependent on a robust asset and device inventory and management tool. This inventory and management tool will assist in
enhancing several dependent security areas of focus: robust security operations (which will provide enhanced logging