MARINEMAX INC

Item 1.05 Material Cybersecurity Incidents As disclosed in the Original Report, on March 10, 2024, we determined that the Company experienced a “cybersecurity incident,” as defined in applicable SEC rules, whereby a third party gained unauthorized access to portions of our information environment (the “Incident”). Upon detection, we immediately initiated our previously determined incident response and business continuity protocols and took immediate measures to contain the Incident. As part of this process, the containment measures resulted in some disruption to a portion of the Company’s business. The Company’s operations have continued throughout this matter in all material respects, and, as of the date of this filing, the affected information environment is remediated. The Company continues to investigate the extent of the Incident with the assistance of external cybersecurity experts. The Company has determined that a cybercrime organization accessed a limited portion of our information environment associated with our retail business. As of the date of this filing, our ongoing investigation has identified that this organization exfiltrated limited data from this environment that includes some customer and employee information, including personally identifiable information. The Company intends to provide appropriate notifications to potentially affected parties and to regulatory agencies as required by federal and state law. The Company also has notified law enforcement authorities. The Company has incurred, and may continue to incur, certain expenses related to its response to this Incident. Further, the Company remains subject to risks and uncertainties as a result of the Incident. While the Company is continuing to evaluate the full scope and impact of the Inciden