Risks Related to Cyber Security, Intellectual Property and Technology
Lion is subject to information technology and cybersecurity risks to operational systems, security systems, infrastructure, integrated software in its vehicles and solutions and customer data processed by it, third-party vendors or suppliers, and any material failure, weakness, interruption, cyber event, incident or breach of security could prevent Lion from effectively operating its business, harm its reputation or materially adversely affect its business, results of operations or financial condition.
Lion is at risk for interruptions, outages and breaches of: (i) operational systems, including business, financial, accounting, product development, data processing or production processes, owned by it or its third-party vendors or suppliers; (ii) facility security systems, owned by it or its third-party vendors or suppliers; (iii) transmission control modules or other in-product technology, owned by it or its third-party vendors or suppliers; (iv) the integrated software in Lion’s vehicles; or (v) customer or driver data that Lion processes or Lion’s third-party vendors or suppliers process on its behalf. Such cyber incidents could materially disrupt operational systems; result in loss of intellectual property, trade secrets or other proprietary or competitively sensitive information; compromise certain information of customers, employees, suppliers, drivers or others; jeopardize the security of Lion’s facilities; or affect the performance of transmission control modules or other in-product technology and the integrated software in Lion’s vehicles. A cyber incident could be caused by disasters, insiders (through inadvertence or with malicious intent) or malicious third parties (including nation-states or nation-state supported actors) using sophisticated, targeted methods to circumvent firewalls, encryption and other security defenses, including hacking, fraud, trickery or other forms of deception. The techniques used by cyber attackers change frequently and may be difficult to detect for long periods of time.
Although Lion maintains information technology measures designed to protect it against intellectual property theft, data breaches and other cyber incidents, such measures will require updates and improvements, and there is no guarantee that such measures will be adequate to detect, prevent or mitigate cyber incidents. Any implementation, maintenance, segregation and improvement of Lion’s systems may require significant management time, support and cost. Moreover, there are inherent risks associated with developing, improving, expanding and updating current systems, including the disruption of Lion’s data management, procurement, production execution, finance, supply chain and sales and service processes. These risks may affect Lion’s ability to manage its data and inventory, procure parts or supplies or produce, sell, deliver and service its vehicles, adequately protect its intellectual property or achieve and maintain compliance with, or realize available benefits under, applicable laws, regulations and contracts. Lion cannot be sure that these systems upon which it relies, including those of its third-party vendors or suppliers, will be effectively implemented, maintained or expanded as planned. If Lion does not successfully implement, maintain or expand these systems as planned, its operations may be disrupted, Lion’s ability to accurately and timely report its financial results could be impaired, and deficiencies may arise in Lion’s internal control over financial reporting, which may impact Lion’s ability to certify its financial results. Moreover, Lion’s proprietary information or intellectual property could be compromised or misappropriated, and its reputation may be adversely affected. If these systems do not operate as expected, Lion may be required to expend significant resources to make corrections or find alternative sources for performing these functions.
A significant cyber incident could impact Lion’s manufacturing capacity or production capability, harm its reputation, cause Lion to breach its contractual arrangements with other parties or subject Lion to regulatory actions or litigation, any of which could materially affect its business, prospects, results of operations or financial condition. In addition, Lion’s insurance coverage for cyberattacks may not be sufficient to cover all the losses it may experience as a result of a cyber incident.
Lion also collects, uses, discloses, stores, transmits and otherwise processes customer, driver and employee and others’ data as part of its business and operations, which may include personal data or confidential or proprietary information. Lion also works with partners and third-party service providers or vendors that may in the course of their business relationship with Lion collect, store and process such data on Lion’s behalf and in connection with Lion’s products and services. There can be no assurance that any security measures that Lion or its third-party service providers, vendors, or suppliers have implemented will be effective against current or future security threats. While Lion has developed systems and processes designed to protect the availability, integrity, confidentiality and security of Lion’s, Lion’s customers’, drivers’ and employees’ and others’ data, such security measures or those of its third-party service providers, vendors or suppliers could fail and result in unauthorized access to or disclosure, acquisition, encryption, modification, misuse, loss, destruction or other compromise of such data. If a compromise of such data were to occur, Lion may become liable under its contracts with other parties and under applicable law for damages and incur penalties and other costs to respond to, investigate and remedy such an incident. Laws in all 50 states of the United States and Canada require Lion to provide notice to individuals, customers, regulators, credit reporting agencies and others when certain sensitive information has been compromised as a result of a security
25