6 unchanged sentences
and our use of third-party products and services.
+Added: These risks include dependencies on cloud service providers and other third-party technology vendors that support our critical systems and operations.
Protecting our systems, networks, data and confidential information is a priority at Groupon.
1 unchanged sentence
As of the date of this Form 10-K, we have not experienced a material cybersecurity threat or incident that resulted in a material adverse impact to our business strategy, results of operations or financial condition, but there can be no guarantee that we will not experience such an incident in the future.
+Added: The determination of whether a cybersecurity incident is material involves judgment and depends on the specific facts and circumstances at the time of assessment.
Such incidents, whether or not successful, could result in significant costs related to, for example:
2 unchanged sentences
We have seen an increase in the volume, frequency and sophistication of cyberattacks.
−Removed: We seek to detect and investigate unauthorized attempts and attacks against our network, cloud infrastructure, websites, and mobile applications and to prevent their occurrence and recurrence where practicable through changes or updates to our internal processes and our websites and mobile applications;
+Added: We seek to detect and investigate unauthorized attempts and attacks against our
+Added: network, cloud infrastructure, websites, and mobile applications and to prevent their occurrence and recurrence where practicable through changes or updates to our internal processes and our websites and mobile applications;
however, we remain potentially vulnerable to known or unknown threats.
1 unchanged sentence
Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and reputational harm.
+Added: This includes enhanced regulatory requirements in the United States and other jurisdictions related to the timing and content of cybersecurity incident disclosures.
Risk Factors for more information on our cybersecurity risks.
1 unchanged sentence
A member of our IT and Information Security teams regularly reports to the Audit Committee, and directly to the Board, as appropriate, on the state of our cybersecurity program and provides updates on cybersecurity matters.
−Removed: In addition, our Vice President of Software Engineering typically conducts an annual cybersecurity review with our Board.
+Added: In addition, our IT and Information Security teams typically conduct an annual cybersecurity review, which is shared with our Board as needed.
We employ security practices to protect and maintain the systems located at our cloud hosting providers, invest in intrusion and anomaly detection tools and engage third-party security firms to test the security of our websites and systems.
−Removed: Specifically,
−Removed: we leverage industry best practices to identify and mitigate data security risks, including but not limited to, utilizing processes and tools to monitor and address email security, the security of our workstations and servers, cloud security, password management, secure file transfers and ransomware protection.
+Added: Specifically, we leverage industry best practices to identify and mitigate data security risks, including but not limited to, utilizing processes and tools to monitor and address email security, the security of our workstations and servers, cloud security, password management, secure file transfers and ransomware protection.
In addition, we utilize a firewall, a virtual private network, multi-factor authentication and single sign-on and conduct regular phishing testing.
5 unchanged sentences
The day-to-day operations of our cybersecurity risk management program are overseen by our IT and Information Security teams.
−Removed: Our cybersecurity program is run by our Vice President of Engineering for InfoSec, Darren Redmond, who reports to our COO , Filip Popovic.
−Removed: Our COO has served in that position since June 2024.
−Removed: Redmond has served in this position for the last 2 years and has worked at Groupon for over 8 years, and, prior to Groupon, his experience includes serving as the CTO of Knowledge Point, a learning materials management service provider.
−Removed: Our Information Security Officer reports to Mr.
−Removed: Redmond and monitors prevention, detection, mitigation and remediation efforts through regular communication and reporting from professionals in the Information Security team, many of whom hold cybersecurity certifications such as a Certified Information Systems, Security Professional or Certified Information Security Manager, and through the use of technological tools, software and results from third party audits.
−Removed: Our Information Security Officer joined Groupon in November 2023, and, prior to Groupon, was previously in Vodafone, based in Hungary.
−Removed: Our Security Manager and Security Operation Center Manager also have extensive experience assessing and managing cybersecurity programs and cybersecurity risk.
−Removed: Our VP of InfoSec regularly reports directly to the Audit Committee on our cybersecurity program and efforts to prevent, detect, mitigate and remediate issues.
+Added: Our cybersecurity program is run by our CTO, Ales Drabek, who reports to our CEO , Dusan Senkypl.
+Added: Ales Drabek joined Groupon as CTO on May 1, 2025, and is based in Munich, leading a team of around 350 people.
+Added: He has deep expertise in digital and technology transformation, cloud technologies, eCommerce, B2B & B2C marketplaces, Big Data, and CRM.
+Added: He was previously CIO at Lampenwelt GmbH, where he led a full technology modernization and AI initiatives across European marketplaces.
+Added: Before that, as Chief Digital & Disruption Officer at Conrad Electronic SE, he launched one of Europe’s first B2B marketplaces and built an IoT platform for home automation.
+Added: He also held leadership roles at Metro Cash & Carry International, driving digital transformation and customer-focused tech solutions.
+Added: Our CTO regularly reports directly to the Audit Committee on our cybersecurity program and efforts to prevent, detect, mitigate and remediate issues.
In addition, we have an escalation process in place to inform senior management and the Board of material issues.
7 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.