4 unchanged sentences
the fact that we operate globally and must defend against cybersecurity attacks in thirteen countries;
−Removed: the substantial level of harm that could occur to our business, our customers, or our merchants if were we to suffer a material cybersecurity incident;
+Added: the substantial level of harm that could occur to our business, our customers, or our merchants if we were to suffer a material cybersecurity incident;
and our use of third-party products and services.
1 unchanged sentence
We are committed to maintaining robust governance and oversight of these risks and implementing mechanisms, controls, technologies and processes designed to help us identify, assess and manage these risks.
−Removed: As of the date of this Form 10-K, we have not experienced a material cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, but there can be no guarantee that we will not experience such an incident in the future.
+Added: As of the date of this Form 10-K, we have not experienced a material cybersecurity threat or incident that resulted in a material adverse impact to our business strategy, results of operations or financial condition, but there can be no guarantee that we will not experience such an incident in the future.
Such incidents, whether or not successful, could result in significant costs related to, for example:
7 unchanged sentences
- Risk Factors for more information on our cybersecurity risks.
−Removed: The Audit Committee of our Board ("Audit Committee") oversees risks pertaining to cybersecurity.
+Added: The Audit Committee oversees risks pertaining to cybersecurity.
A member of our IT and Information Security teams regularly reports to the Audit Committee, and directly to the Board, as appropriate, on the state of our cybersecurity program and provides updates on cybersecurity matters.
In addition, our Vice President of Software Engineering typically conducts an annual cybersecurity review with our Board.
−Removed: We employ security practices to protect and maintain the systems located at our cloud hosting providers, invest in intrusion and anomaly detection tools and engage third-party security firms to test the security of our
−Removed: websites and systems.
−Removed: Specifically, we leverage industry best practices to identify and mitigate data security risks, including but not limited to, utilizing processes and tools to monitor and address email security, the security of our workstations and servers, cloud security, password management, secure file transfers and ransomware protection.
+Added: We employ security practices to protect and maintain the systems located at our cloud hosting providers, invest in intrusion and anomaly detection tools and engage third-party security firms to test the security of our websites and systems.
+Added: Specifically,
+Added: we leverage industry best practices to identify and mitigate data security risks, including but not limited to, utilizing processes and tools to monitor and address email security, the security of our workstations and servers, cloud security, password management, secure file transfers and ransomware protection.
In addition, we utilize a firewall, a virtual private network, multi-factor authentication and single sign-on and conduct regular phishing testing.
5 unchanged sentences
The day to day operations of our cybersecurity risk management program are overseen by our IT and Information Security teams.
−Removed: Our cybersecurity program is run by our Vice President of Engineering for InfoSec, Darren Redmond, who reports to our Chief Technology Officer ("CTO"), Vojtech Rysanek.
−Removed: Our CTO has served in that position since November 2022, and, prior to Groupon, he was previously the CTO at Aukro, the largest online marketplace in the Czech Republic.
−Removed: Redmond has served in this position for the last year and has worked at Groupon for over 7 years, and, prior to Groupon, his experience includes serving as the CTO of Knowledge Point, a learning materials management service provider.
+Added: Our cybersecurity program is run by our Vice President of Engineering for InfoSec, Darren Redmond, who reports to our COO , Filip Popovic.
+Added: Our COO has served in that position since June 2024.
+Added: Redmond has served in this position for the last 2 years and has worked at Groupon for over 8 years, and, prior to Groupon, his experience includes serving as the CTO of Knowledge Point, a learning materials management service provider.
Our Information Security Officer reports to Mr.
Redmond and monitors prevention, detection, mitigation and remediation efforts through regular communication and reporting from professionals in the Information Security team, many of whom hold cybersecurity certifications such as a Certified Information Systems, Security Professional or Certified Information Security Manager, and through the use of technological tools, software and results from third party audits.
−Removed: Our Information Security Officer joined Groupon in November 2023, and, prior to Groupon, was previously in VMware Carbon Black, and prior to that held roles in Skyscanner.
+Added: Our Information Security Officer joined Groupon in November 2023, and, prior to Groupon, was previously in Vodafone, based in Hungary.
Our Security Manager and Security Operation Center Manager also have extensive experience assessing and managing cybersecurity programs and cybersecurity risk.
−Removed: Our VP of InfoSec and CTO regularly report directly to the Audit Committee on our cybersecurity program and efforts to prevent, detect, mitigate and remediate issues.
+Added: Our VP of InfoSec regularly reports directly to the Audit Committee on our cybersecurity program and efforts to prevent, detect, mitigate and remediate issues.
In addition, we have an escalation process in place to inform senior management and the Board of material issues.
7 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.