Search every filing
2,477,667 paragraphs from 10-Ks, 10-Qs and 8-Ks with press releases.
Matching paragraphs
• A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents;
Read in the filing ↗ Also in 10-K of Feb 3, 2026
• Security teams principally responsible for managing our (1) annual cybersecurity risk assessment processes, (2) security controls, and (3) response to cybersecurity incidents;
Read in the filing ↗ Also in 10-K of Feb 4, 2025
• A third-party risk management framework designed to monitor and address risks from cybersecurity incidents of service providers, suppliers, and vendors that includes due diligence over third-party’s information security and technology control environment at onboarding and periodically throughout the lifecycle of the relationship. In addition, our standard contractual terms require notification and communication from third parties in the event of a cybersecurity incident. We maintain procedures to respond to, manage and mitigate third-party cybersecurity events and vulnerabilities when identified.
Read in the filing ↗ Also in 10-K of Feb 3, 2026
Our Information Security Program is designed to support the Company in identifying, protecting, detecting, responding to, and recovering from cybersecurity threats and incidents (collectively, “cybersecurity risks”) with the intention to protect the confidentiality, integrity, and availability of our critical systems and information.
Read in the filing ↗
Our Information Security Program (“Program”) is designed to support the Company in identifying, protecting, detecting, responding to, and recovering from cybersecurity threats and incidents (collectively, “cybersecurity risks”) with the intention to protect the confidentiality, integrity, and availability of our critical systems and information.
Read in the filing ↗
Our cybersecurity teams supervise efforts to prevent, detect, mitigate, and remediate cybersecurity threats and incidents through the operation of our incident response plan and various other means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, as well as alerts and reports produced by security tools deployed in the IT environment. They also oversee, identify, and address security threats aimed at PayPal customers, employees, and partners.
Read in the filing ↗
Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to our ARC Committee oversight of cybersecurity and other information technology risks. The ARC Committee oversees PayPal’s overall risk framework, including management’s implementation of our cybersecurity risk management program, and reports to the full Board of Directors on a regular basis on cybersecurity and information technology risk management. The ARC Committee receives periodic reports from the Chief Information Security Officer (“CISO”) on our cybersecurity risks. Management also updates the ARC Committee, as necessary, regarding cybersecurity incidents.
Read in the filing ↗
Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to our R&C Committee oversight of cybersecurity and other information technology risks. The R&C Committee oversees PayPal’s overall risk framework, including management’s implementation of our cybersecurity risk management program, and reports to the full Board of Directors on a regular basis on cybersecurity and information technology risk management. The R&C Committee receives quarterly reports from the Chief Information Security Officer (“CISO”) on our cybersecurity risks. Management also updates the R&C Committee, as necessary, regarding cybersecurity incidents.
Read in the filing ↗
Our cybersecurity teams, overseen by our CISO, are responsible for assessing and managing our risks from cybersecurity threats, including defining security policy and board reporting of security risk. The CISO approves all security policies and oversees the identification, assessment, and management of cybersecurity risks, which provides a proactive and comprehensive approach to safeguarding our information assets. The teams have primary responsibility for our overall Information Security Program and supervise both our internal cybersecurity personnel and our external cybersecurity consultants. Our cybersecurity teams’ experience includes cybersecurity incident response, in-depth security assessments, and security emulation exercises to evaluate security profile, security research, education and outreach, and security tool development.
Read in the filing ↗ Also in 10-K of Feb 3, 2026
Our cybersecurity teams, in coordination with the CDC, supervise efforts to prevent, detect, mitigate, and remediate cybersecurity threats and incidents through the operation of our incident response plan and various other means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, as well as alerts and reports produced by security tools deployed in the IT environment. The CDC team oversees, identifies, and addresses security threats aimed at safeguarding PayPal employees, consumers, and merchants.
Read in the filing ↗
Cybersecurity and information security risks for global payments and technology companies like us have increased significantly in recent years. Although we have developed systems and processes designed to protect the data we manage, prevent data loss and other security incidents, and enable us to effectively respond to known and potential risks, and expect to continue to expend significant resources to bolster these protections, we have experienced and expect to continue to experience cybersecurity incidents and remain subject to these risks. There can be no assurance that our security measures will provide sufficient protection or security to prevent breaches or attacks. For additional information regarding our cybersecurity and information security risks, see “Item 1A. Risk Factors - Cyberattacks and security vulnerabilities could result in serious harm to our reputation, business, and financial condition” and “Item 1C. Cybersecurity.”
Read in the filing ↗ Also in 10-K of Feb 3, 2026, 10-Q of Jul 29, 2025, 10-Q of Oct 28, 2025, 10-Q of May 5, 2026, 10-Q of Jul 28, 2026, 10-Q of Oct 27, 2026
Any cybersecurity incidents, including cyberattacks or data security breaches affecting the IT or infrastructure of our customers, partners, or vendors (including data center and cloud computing providers) or of companies we acquire, could have similar negative effects.
Read in the filing ↗ Also in 10-Q of Jul 28, 2026, 10-Q of Oct 27, 2026
Any cybersecurity incidents, including cyberattacks or data security breaches affecting the information technology or infrastructure of our customers, partners, or vendors (including data center and cloud computing providers) or of companies we acquire, could have similar negative effects.
Read in the filing ↗
For a description of risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition, see “Item 1A. Risk Factors” under the captions “ Cyberattacks and security vulnerabilities could result in serious harm to our reputation, business, and financial condition ” and “ Business interruptions or systems failures may impair the availability of our websites, applications, products or services, or otherwise harm our business. ”
Read in the filing ↗ Also in 10-K of Feb 3, 2026
We believe that hostile actors, who may comprise individuals, coordinated groups, sophisticated organizations, or nation-state supported entities, may target PayPal due to our name, brand recognition, types of data (including sensitive payments- and identity-related data) that customers provide to us, and the widespread adoption and use of our products and services. We have experienced from time to time, and may experience in the future, cybersecurity incidents, including breaches of our security measures, network breaches, and compromise of personally identifiable customer information due to human error, deception, malfeasance, insider threats, system errors, defects, vulnerabilities, or other issues. Any of the foregoing events may subject us to fines, penalties, regulatory or other enforcement actions, and adversely affect our business, reputation, or financial condition.
Read in the filing ↗ Also in 10-Q of Jul 28, 2026, 10-Q of Oct 27, 2026, 10-K of Feb 4, 2025
We rely on facilities, components, applications, software, and services supplied by third parties, including data center facilities and cloud data storage and processing services. From time to time, we have experienced interruptions in the provision of such facilities and services provided by these third parties. If these third parties experience operational interference or disruptions (including a cybersecurity incident), fail to perform their obligations, or breach their agreements with us, our operations could be disrupted or negatively affected, which could result in customer dissatisfaction, regulatory scrutiny, and damage to our reputation and brands, and materially and adversely affect our business. While we maintain business interruption insurance, our coverage may be insufficient to cover all our losses caused by interruptions in our service due to systems failures and similar events.
Read in the filing ↗
We also rely on facilities, components, applications, software, and services supplied by third parties, including data center facilities and cloud data storage and processing services. From time to time, we have experienced interruptions in the provision of such facilities and services provided by these third parties. If these third parties experience operational interference or disruptions (including a cybersecurity incident), fail to perform their obligations, or breach their agreements with us, our operations could be disrupted or negatively affected, which could result in customer dissatisfaction, regulatory scrutiny, and damage to our reputation and brands, and materially and adversely affect our business. While we maintain insurance policies intended to help offset the financial impact we may experience from these risks, our coverage may be insufficient to compensate us for all losses caused by interruptions in our service due to systems failures and similar events.
Read in the filing ↗ Also in 10-Q of Oct 28, 2025