Cyberattacks, cybersecurity breaches, service outages, and other similar incidents continue to increase in frequency and severity, evolve in nature, and become more sophisticated (including through the increased use of AI), and may evade detection for substantial periods of time. Moreover, we regularly encounter attempts to create false or undesirable accounts or take other actions on our platform for purposes such as spamming, spreading misinformation, or other objectionable ends. Threats to our computer systems and networks and those of third parties with whom we partner come from a variety of sources, including organized criminal threat actors, terrorists, hacktivists, nation states, state-sponsored organizations, and other external threat actors with significant financial and technological resources, any of which may see the effectiveness of their efforts enhanced by the use of AI. In addition, the trend towards working from home and using private residential networks to access the internet may further exacerbate risks associated with cyberattacks, cybersecurity breaches, service outages, and other similar incidents as private work environments and electronic connections to our work environment may not have the same security measures deployed in our offices. We, like other financial technology organizations, have experienced from time to time, and may experience in the future, cybersecurity incidents, including, among other things, advanced and persisting cyberattacks, ransomware, cyber extortion, phishing, and social engineering schemes, the introduction of computer viruses or other malware, computer hacking, fraudulent use attempts, denial-of-service attacks, credential stuffing, and the physical destruction of all or portions of our IT infrastructure and those of third parties with whom we partner, due to, among other things, human error, fraud, malice, malfeasance, insider threats, system errors or vulnerabilities, accidental technological failure, or other irregularities on the part of employees, contractors, vendors, or other third parties. Because we rely on third parties in our business, we rely on the cybersecurity practices and policies adopted by such third parties, including our disbursement partners and downstream service providers. Our ability to monitor the cybersecurity practices of third parties with whom we partner is limited, and there can be no assurance that we can prevent, mitigate, or remediate the risk of any compromise or failure in the systems or networks owned or controlled by such third parties. Additionally, any contractual protections with such third parties, including our right to indemnification, if any at all, may be limited or insufficient to prevent a negative impact on our business from such compromise or failure. Any such compromises or failures with respect to our systems or networks, including the systems or networks owned or controlled by third parties with whom we partner, could, among other things: cause interruptions to our platform; compromise the privacy, confidentiality, availability, and integrity of the data, including personal information, in such systems and networks; degrade the user experience; cause users to lose confidence and trust in our platform, impair our internal systems and networks; and harm our reputation and our ability to retain existing customers and attract new customers.
A cyberattack, cybersecurity breach, service outage, or other similar incident could lead to, among other things, any of the following:
- monetary and other losses for us or our customers;- identity theft for our customers;- the inability to expand our business;- additional oversight, assessments, audits, scrutiny, restrictions, fines, or penalties from regulatory or governmental authorities;- loss of customers and customer confidence in our services;- declines in user growth or engagement;- exposure to civil litigation (including civil claims, such as representative actions and other class action-type litigation);- orders to cease or change our processing of our data;- a breach of our contracts with lenders or other third parties;- termination of services provided to us; or - liquidity risks or a negative impact on our relationships with our financial services providers, including payment processors or relevant network organizations, such as Visa or Mastercard, disbursement partners, and other third parties.
Further, we could be forced to expend significant financial and operational resources in response to such incidents, including repairing system damage, increasing security costs, investigating and remediating any cybersecurity vulnerabilities, complying with data breach notification obligations and applicable laws and regulations, and defending against and resolving legal and regulatory claims, all of which could divert resources and the attention of our management and key personnel away from our business operations. As a result, any cyberattack, cybersecurity breach, service outage, or other similar incident could harm our business, reputation, financial condition, and operating results.
While we maintain insurance policies, our coverage may be insufficient to compensate us for all losses caused by cyberattacks, cybersecurity breaches, service outages, or other similar incidents, and any such incidents may result in increased costs for such insurance. We also cannot ensure that our existing cybersecurity insurance coverage will be sufficient to cover the successful assertion of one or more large claims against us, continue to be available on acceptable terms, or at all, or that the insurer will not deny coverage as to any future claim.
For additional information, see "-Our business is subject to the risks of earthquakes, fires, floods, public health crises (including epidemics or pandemics such as the COVID-19 pandemic), and other natural catastrophic events, and to interruption by man-made problems such as cyberattacks, cybersecurity breaches, service outages, or other similar incidents, internal or third-party system failures, political unrest, market or currency disruptions, and terrorism, which could result in system and process failures and interruptions which could harm our business."