XML 57 R41.htm IDEA: XBRL DOCUMENT v3.26.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
We have a cybersecurity program for assessing, identifying, and managing material risks from cybersecurity threats. This includes compliance with the Enterprise Information Security Policy (“EISP”) established by Brookfield.
We believe our cybersecurity program is reasonably designed to materially protect the security of both our company’s data and the data in our custody. Our policies and procedures address security governance, security awareness and training, access management, vulnerability management, penetration testing, security monitoring and incident response. We use automated technologies to optimize our security risk detection and response capabilities, in addition to access controls and anti-malware protections. We believe our practices align with the National Institute Standards of Technology cybersecurity framework in meeting and exceeding the industry average in cybersecurity practice.
In addition, all employees involved in activities with our company and our operating companies regularly undergo mandatory continuing cybersecurity and data protection training. Employees in higher-risk functions receive additional training and cybersecurity awareness education. Audits, cybersecurity simulations and employee testing results indicate that our program is effective in protecting our information. The policies, standards, and guidance are structured to help our company respond effectively to the dynamically changing environment of cybersecurity threats, cybersecurity risks, technologies, laws, and regulations. Our company modifies its policies, standards, and guidance as needed to adjust to this changing environment.
Our cybersecurity program is one pillar of our larger corporate governance framework and approach to risk management, which also encompasses oversight by our board of directors and board committees, our Code of Business Conduct and Ethics, our Anti-Bribery and Corruption Policy and our Ethics Hotline.
We also engage regularly with third-party assessors to evaluate the strength of our program through penetration and/or ethical hacking exercises. We have policies and processes to govern third-party access and reduce the risks associated with such access. For example, all third-party access must be authorized and have a legitimate business need. Prior to authorization and granting access, the terms and conditions of such access must be agreed to as part of a formal agreement or contract. In addition, all authorized third-party access must be limited, monitored and controlled as appropriate.
Despite the security measures implemented as part of our cybersecurity program, the current cyber threat environment presents increased risks for all companies. In the fiscal year ended December 31, 2024, we were the target of cyber-attacks. For example, in June 2024, our dealer software and technology services operation detected and promptly responded to unauthorized cyber activity on its network. Upon discovery, our dealer software and technology services operation shut down its systems to address and investigate the issue while notifying law enforcement. This cybersecurity incident, and the subsequent system shut down, caused disruption to our dealer software and technology services operation has since become subject to several class action lawsuits and may be subject to further lawsuits, claims, inquiries or investigations. While we have incurred, and may continue to incur, certain expenses related to this attack, including expenses to respond to, remediate and investigate this matter, we do not expect the above-noted cybersecurity incident to have a material impact on our business. In addition, our dealer software and technology services operation has become subject to several class action lawsuits in connection with the cybersecurity incident and the operation may be subject to further lawsuits, claims, inquiries or investigations. We believe that the legal proceedings are without merit and intend to vigorously contest them. On an ongoing basis, we assess the potential impact of these events. Aside from the costs to defend against these claims, the potential loss amount from these claims cannot be measured and is not probable at this time.
We do not believe that any risks we have identified to date from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected us, including our business strategy, results of operations or financial condition. However, we can provide no assurance that we will not experience any material cybersecurity threats or incidents in the future. See “Item 3.D, Risk Factors” — Our group relies on the use of technology and information systems, many of which are controlled by third-party vendors, which may not be able to accommodate our group’s growth or may increase in cost and may become subject to cyber-terrorism or other compromises and shut-downs, and any failures or interruptions of these systems could adversely affect our group’s businesses and results of operations.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]
We have a cybersecurity program for assessing, identifying, and managing material risks from cybersecurity threats. This includes compliance with the Enterprise Information Security Policy (“EISP”) established by Brookfield.
We believe our cybersecurity program is reasonably designed to materially protect the security of both our company’s data and the data in our custody. Our policies and procedures address security governance, security awareness and training, access management, vulnerability management, penetration testing, security monitoring and incident response. We use automated technologies to optimize our security risk detection and response capabilities, in addition to access controls and anti-malware protections. We believe our practices align with the National Institute Standards of Technology cybersecurity framework in meeting and exceeding the industry average in cybersecurity practice.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]
Cybersecurity at our company is overseen by our board, audit committee and management, as well as by Brookfield, through the EISP described above.
Management teams of our company’s operating companies supervise cybersecurity and data privacy activity that are specific to such operating companies, and are required to report on activity, including breaches, to our company’s management and to the board of directors on a quarterly basis.
Pursuant to the EISP, Brookfield’s executive management has appointed a Chief Information Security Officer (“CISO”), who works closely with Brookfield’s senior management, legal counsel and external advisers to develop and monitor Brookfield’s data protection, privacy and cybersecurity program and policies, including such policies that apply to our company. The CISO provides periodic reports to the Brookfield Audit Committee, which subsequently reports to the Brookfield board of directors about data protection and cybersecurity risks and issues. The CISO has over 20 years’ experience in cybersecurity oversight and the remaining Cybersecurity Committee members have an average of approximately 8 years of cybersecurity experience.
In addition, Brookfield has established a Cybersecurity Committee, led by the CISO and composed of representatives from Brookfield’s operating businesses, including from our management team. The Cybersecurity Committee meets quarterly to discuss cybersecurity risks, emerging technologies and associated risks, and security initiatives at Brookfield and its operating businesses.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block]
Cybersecurity at our company is overseen by our board, audit committee and management, as well as by Brookfield, through the EISP described above.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block]
Management teams of our company’s operating companies supervise cybersecurity and data privacy activity that are specific to such operating companies, and are required to report on activity, including breaches, to our company’s management and to the board of directors on a quarterly basis.
Cybersecurity Risk Role of Management [Text Block]
Management teams of our company’s operating companies supervise cybersecurity and data privacy activity that are specific to such operating companies, and are required to report on activity, including breaches, to our company’s management and to the board of directors on a quarterly basis.
Pursuant to the EISP, Brookfield’s executive management has appointed a Chief Information Security Officer (“CISO”), who works closely with Brookfield’s senior management, legal counsel and external advisers to develop and monitor Brookfield’s data protection, privacy and cybersecurity program and policies, including such policies that apply to our company. The CISO provides periodic reports to the Brookfield Audit Committee, which subsequently reports to the Brookfield board of directors about data protection and cybersecurity risks and issues.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block]
Management teams of our company’s operating companies supervise cybersecurity and data privacy activity that are specific to such operating companies, and are required to report on activity, including breaches, to our company’s management and to the board of directors on a quarterly basis.
Pursuant to the EISP, Brookfield’s executive management has appointed a Chief Information Security Officer (“CISO”), who works closely with Brookfield’s senior management, legal counsel and external advisers to develop and monitor Brookfield’s data protection, privacy and cybersecurity program and policies, including such policies that apply to our company. The CISO provides periodic reports to the Brookfield Audit Committee, which subsequently reports to the Brookfield board of directors about data protection and cybersecurity risks and issues. The CISO has over 20 years’ experience in cybersecurity oversight and the remaining Cybersecurity Committee members have an average of approximately 8 years of cybersecurity experience.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] The CISO has over 20 years’ experience in cybersecurity oversight and the remaining Cybersecurity Committee members have an average of approximately 8 years of cybersecurity experience.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block]
In addition, Brookfield has established a Cybersecurity Committee, led by the CISO and composed of representatives from Brookfield’s operating businesses, including from our management team. The Cybersecurity Committee meets quarterly to discuss cybersecurity risks, emerging technologies and associated risks, and security initiatives at Brookfield and its operating businesses.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true