Marinemax

Item 1.05 Material Cybersecurity Incidents

MarineMax, Inc. (the "Company") determined on March 10, 2024, that it experienced a "cybersecurity incident," as defined in applicable Securities and Exchange Commission rules, whereby a third party gained unauthorized access to portions of its information environment. Upon detection, the Company initiated its previously determined incident response and business continuity protocols and took immediate measures to contain the incident. As part of this process, the containment measures resulted in some disruption to a portion of the Company's business. The Company's operations have continued throughout this matter in all material respects. The Company continues to investigate the extent of the incident, has engaged cybersecurity expertise, and has notified law enforcement authorities.

While the investigation remains ongoing, as of the date of this filing, the incident has not had a material impact on the Company's operations, and the Company is still in the process of determining whether the incident is reasonably likely to materially impact the Company's financial conditions or results of operations. The Company does not maintain sensitive data in the information environment impacted by the incident.

Forward-Looking Statements

Certain statements contained in this Current Report on Form 8-K are forward-looking as defined in the Private Securities Litigation Reform Act of 1995. Such forward-looking statements include those regarding the Company's investigation of the incident, its efforts to contain the activity, the disruption to the Company's business, and the continuation of the Company's operations, as well as the impact on the Company's operations, financial conditions, and results. These statements involve certain risks and uncertainties that may cause actual results to differ materially from expectations as of the date of this release. These risks include the numerous factors identified in the Company's Form 10-K for the fiscal year ended September 30, 2023 and other filings with the Securities and Exchange Commission. The Company disclaims any intention or obligation to update or revise any forward-looking statements, whether as a result of new information, future events or otherwise.

Exhibit Index

Exhibit No.

Description

104

Cover Page Interactive Data File (embedded within the Inline XBRL document)

Item 1.05 Material Cybersecurity Incidents

As disclosed in the Original Report, on March 10, 2024, we determined that the Company experienced a "cybersecurity incident," as defined in applicable SEC rules, whereby a third party gained unauthorized access to portions of our information environment (the "Incident"). Upon detection, we immediately initiated our previously determined incident response and business continuity protocols and took immediate measures to contain the Incident. As part of this process, the containment measures resulted in some disruption to a portion of the Company's business. The Company's operations have continued throughout this matter in all material respects, and, as of the date of this filing, the affected information environment is remediated.

The Company continues to investigate the extent of the Incident with the assistance of external cybersecurity experts. The Company has determined that a cybercrime organization accessed a limited portion of our information environment associated with our retail business. As of the date of this filing, our ongoing investigation has identified that this organization exfiltrated limited data from this environment that includes some customer and employee information, including personally identifiable information. The Company intends to provide appropriate notifications to potentially affected parties and to regulatory agencies as required by federal and state law. The Company also has notified law enforcement authorities.

The Company has incurred, and may continue to incur, certain expenses related to its response to this Incident. Further, the Company remains subject to risks and uncertainties as a result of the Incident. While the Company is continuing to evaluate the full scope and impact of the Incident, as of the date of this filing, the Incident has not had a material impact on the Company's operations, and the Company is still in the process of determining whether the Incident is reasonably likely to materially impact the Company's financial condition or results of operations.

Cautionary Statement Regarding Forward Looking Statements

Certain statements contained in this Report are forward-looking as defined in the Private Securities Litigation Reform Act of 1995. Such forward-looking statements include those regarding the threat actor's access to our systems, the Company's investigation of the incident, the Company's efforts to contain the activity and the impact on the Company's operations, financial conditions, and results. These statements involve certain risks and uncertainties that may cause actual results to differ materially from expectations as of the date of this Report. These risks include the numerous factors identified in the Company's Form 10-K for the fiscal year ended September 30, 2023 and other filings with the Securities and Exchange Commission. The Company disclaims any intention or obligation to update or revise any forward-looking statements, whether as a result of new information, future events or otherwise.

Exhibit Index

Exhibit No.

Description

104

Cover Page Interactive Data File (embedded within the Inline XBRL document)