EverCommerce Inc.

Current report

We rely on computer systems, hardware, software, technology infrastructure and online sites and networks for both internal and external operations that are critical to our business (collectively, “IT Systems”). We own and manage some of these IT Systems but also rely on third parties for a range of IT Systems and related products and services. We and certain of our third-party providers collect, maintain and process data about customers, employees, business partners and others, including information about individuals such as payment card information, as well as proprietary information belonging to our business such as trade secrets (collectively, “Confidential Information”).

Current report

Our IT Systems, Confidential Information, products and services have been and will continue to be targets of cyber-attacks aimed at sabotage, disruption and/or compromise. Threats come from diverse sources, including criminal hackers, hacktivists, state-sponsored groups, industrial espionage actors and insiders. These actors leverage numerous tactics, such as cyber-extortion, ransomware, social engineering (e.g., phishing), the introduction of computer viruses or other malware and even the physical intrusion and/or destruction of IT and infrastructure assets and can be the result of bugs, misconfigurations or exploited vulnerabilities in software or hardware.

Current report

The techniques used to gain unauthorized, improper, or illegal access to systems and information (including personal data), disable or degrade services, or sabotage systems are constantly evolving and have become increasingly complex and sophisticated. These techniques are difficult to detect quickly, and often are not recognized or detected until after they have been launched against a target. Even if identified, we may be unable to adequately investigate or remediate incidents or breaches due to attackers increasingly using tools, such as artificial intelligence (“AI”), that are designed to circumvent controls, avoid detection, and remove or obfuscate forensic evidence. In addition, we identify and track known security vulnerabilities in our (and third-party) software and services that are deployed in our business, and we cannot guarantee that patches or other measures will be comprehensively applied before such vulnerabilities can be exploited by a threat actor. Because certain of our products are integrated with our customers’ systems, the circumvention or failure of our protective measures could compromise the confidentiality, integrity, and availability of our customers’ own systems and/or information. Given the nature of complex systems, software and services like ours, and the scanning tools that we deploy across our networks, infrastructure and products, we regularly identify and track security vulnerabilities. We are unable to comprehensively apply patches or confirm that measures are in place to mitigate all such vulnerabilities, or that patches will be applied before vulnerabilities are exploited by a threat actor. In other situations, vulnerabilities persist even after we have issued security patches because our customers may fail to apply patches or update their systems to newer software versions. If attackers are able to exploit critical vulnerabilities before patches are installed or mitigating measures are implemented, significant compromises could impact our and our customers’ systems and data. In addition, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our IT systems and Confidential Information.

Current report

Advances in artificial intelligence, including models capable of rapidly identifying and exploiting software vulnerabilities, further increase the speed and effectiveness of cyberattacks. Moreover, the integration and use of AI in our and third party providers’ operations, products and services creates unique attack vectors, such as the infiltration, corruption (e.g., “poisoning”), or manipulation of training data and AI model inputs, that threaten downstream model outputs and can skew decision-making based on AI models. As a result of the foregoing AI impacts, we cannot guarantee effective detection, investigation, remediation or recovery in relation to future attacks and incidents, or that material adverse impact to our IT Systems or Confidential Information will not occur. In addition, vulnerabilities or flaws in our products, systems or those of third parties upon which we rely can be discovered more quickly by threat actors, reducing the time available for detection and remediation and increasing the likelihood or severity of security incidents.

Current report

We have experienced cyber-attacks and other security incidents involving access to IT Systems and Confidential Information, and will continue to experience such attacks and incidents to varying degrees. To date, no attacks or incidents either individually or in the aggregate has materially impacted our operations, financial condition or business. Although we and our service providers deploy security measures in relation to our IT Systems and Confidential Information, no measures can guarantee protection against all cyber-attacks and security incidents. A serious breach of our IT Systems, Confidential Information, or a third-party system upon which we rely may subject us to material losses or liability, including, for example, as a result of the following: payment network fines; assessments and claims for unauthorized purchases with misappropriated credit, debit or card information; impersonation or other similar fraud claims; regulatory investigations, fines and penalties; litigation (including class action) costs, damages and injunctive relief; significant harm to our brand and reputation; loss of existing clients and potential clients from using electronic payments generally and our solutions and services specifically, thus reducing our revenue; costs to correct any breaches or failures; and significant uninsured liabilities and costs.

Current report

Although we generally require that our agreements with our distribution partners and service providers who have access to our IT Systems and/or Confidential Information include confidentiality obligations that restrict these parties from using such access or disclosing such information except as necessary to perform their services under the applicable agreements, there can be no assurance that these contractual measures will prevent the unauthorized use or disclosure of Confidential Information, nor can we be sure that such third parties would be willing or able to satisfy liabilities arising from their breach of these agreements. Any failure by such third parties to adequately take these protective measures could result in protracted or costly litigation.

Current report

In addition, our agreements with our bank sponsors (as well as payment network requirements) require us to take certain protective measures to ensure the confidentiality of Confidential Information. Any failure to adequately comply with these protective measures could result in fees, penalties, litigation or termination of our bank sponsor agreements, and/or registration with the payment card networks.

Current report

Our existing general liability and cyber liability insurance policies may not cover, or may cover only a portion of, any potential claims related to security breaches to which we are exposed or may not be adequate to indemnify us for all or any portion of liabilities that may be imposed. We also cannot be certain that our existing insurance coverage will continue to be available on acceptable terms or in amounts sufficient to cover the potentially significant losses that may result from a security incident or breach or that the insurer will not deny coverage of any future claim. We attempt to limit by contract our liability, however, the limitations of liability set forth in the contracts may not be enforceable or otherwise protect us from liability, and we may also be subject to claims that are not covered by contract.

Current report

Additionally, we are responsible both for our own business and to a significant degree for acts and omissions by certain of our distribution partners and third-party vendors under the rules and regulations established by the payment networks, such as Visa, MasterCard, Discover and American Express and the debit networks. We and other third parties collect, process, store and transmit Confidential Information, including financial and payment card information, and we have ultimate liability to the payment networks and member financial institutions that register us with the payment networks for our failure, or the failure of certain distribution partners and third parties with whom we contract, to protect this Confidential Information, in accordance with payment network requirements. Additionally, certain of our software and technology-enabled services are intended for use in collecting, storing and displaying clinical and health care-related information used in the diagnosis and treatment of patients and in related health care settings such as registration, scheduling and billing. The loss, destruction or unauthorized modification of Confidential Information could result in significant fines, sanctions and proceedings or actions against us by the payment networks, payment processors, sponsor banks, governmental bodies, our customers, our clients’ customers or others, which could have a material adverse effect on our business, financial condition and results of operations. Any such sanction, fine, proceeding or action could result in significant damage to our reputation or the reputation of our customers, negatively impact our ability to attract or retain customers, force us to incur significant expenses in defense of these proceedings, disrupt our operations, distract our management, increase our costs of doing business and may result in the imposition of monetary liability. A significant cybersecurity breach could also result in payment networks prohibiting us from processing transactions on their networks or the loss of our financial institution sponsorship that facilitates our participation in the payment networks, either of which could materially impede our ability to conduct business.

Current report

Moreover, we rely on third parties, such as Worldpay, PayPal and other payment processing partners, for specific services, software and hardware used in providing our solutions and services. Some of these organizations and service providers are our competitors or provide similar services and technology to our competitors, and we may not have long-term contracts with them. If these contracts are canceled or we are unable to renew them on commercially reasonable terms, or at all, our business, financial condition and results of operation could be adversely impacted. The termination by our service or technology providers of their agreements with us or their failure to perform their services efficiently and effectively may adversely affect our relationships with our clients and, if we cannot find alternate providers quickly, may cause those clients to terminate their processing agreements with us.