XML 53 R29.htm IDEA: XBRL DOCUMENT v3.26.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]

Risk Management and Strategy

We have implemented robust processes for assessing, identifying and managing material risks from cybersecurity threats and monitoring the prevention, detection, mitigation and remediation of material cybersecurity incident. We have also integrated cybersecurity risk management into our overall enterprise risk management system.

We have developed a comprehensive cybersecurity threat defense system to address both internal and external threats. This system encompasses various levels, including network, host, application, data security and incorporates systematic security capabilities for threat defense, monitoring, analysis, response, deception and countermeasures. We strive to manage cybersecurity risks and protect sensitive information through various means, such as technical safeguards, procedural requirements, an intensive program of monitoring on our corporate network, continuous testing of aspects of our security posture internally and with outside vendors, a robust incident response program and regular cybersecurity awareness training for employees. Our IT department regularly monitors the performance of our apps, platforms and infrastructure to enable us to respond quickly to potential problems, including potential cybersecurity threats.

With the continuous advancement of new technologies and the expansion of business scenarios, we have been steadily enhancing our cybersecurity protection capabilities and privacy protection standards. We have increased investment in the following areas to enhance cybersecurity and data security protection capabilities.

We have continuously strengthened our overall cybersecurity protection capabilities and further improved its in-depth defense system. We have developed key security capabilities including DDoS protection and application-layer security protection, effectively ensuring the stable and efficient operation of its business systems.

To effectively address increasingly severe data security risks, we have continuously invested resources to enhance our data security governance framework. We have established and continuously refined data security management policies and processes to effectively implement security requirements. We have strengthened data security lifecycle management, conducted data processing activities in adherence to the data minimization principle, and focused on enhancing process controls over critical stages such as data usage and external data transfer to mitigate security risks including data leakage and abuse. Meanwhile, we have continued to upgrade our data security technical capabilities by adopting measures including encryption, data pseudonymization, and access controls to improve the security of data processing across our products and services. We have also conducted regular data security training and awareness programs for critical business functions and roles to strengthen employees’ security risk awareness and capabilities, and to protect user data and the company’s data assets.

In terms of certification, Weibo has attained ISO 27001 certification for its information security management system, signifying that its security management complies with internationally recognized authoritative standards.

As of the date of this annual report, we have not experienced any material cybersecurity incidents or identified any material cybersecurity threats that have affected or are reasonably likely to materially affect us, our business strategy, results of operations or financial condition.

Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]

We have implemented robust processes for assessing, identifying and managing material risks from cybersecurity threats and monitoring the prevention, detection, mitigation and remediation of material cybersecurity incident. We have also integrated cybersecurity risk management into our overall enterprise risk management system.

We have developed a comprehensive cybersecurity threat defense system to address both internal and external threats. This system encompasses various levels, including network, host, application, data security and incorporates systematic security capabilities for threat defense, monitoring, analysis, response, deception and countermeasures. We strive to manage cybersecurity risks and protect sensitive information through various means, such as technical safeguards, procedural requirements, an intensive program of monitoring on our corporate network, continuous testing of aspects of our security posture internally and with outside vendors, a robust incident response program and regular cybersecurity awareness training for employees. Our IT department regularly monitors the performance of our apps, platforms and infrastructure to enable us to respond quickly to potential problems, including potential cybersecurity threats.

With the continuous advancement of new technologies and the expansion of business scenarios, we have been steadily enhancing our cybersecurity protection capabilities and privacy protection standards. We have increased investment in the following areas to enhance cybersecurity and data security protection capabilities.

We have continuously strengthened our overall cybersecurity protection capabilities and further improved its in-depth defense system. We have developed key security capabilities including DDoS protection and application-layer security protection, effectively ensuring the stable and efficient operation of its business systems.

To effectively address increasingly severe data security risks, we have continuously invested resources to enhance our data security governance framework. We have established and continuously refined data security management policies and processes to effectively implement security requirements. We have strengthened data security lifecycle management, conducted data processing activities in adherence to the data minimization principle, and focused on enhancing process controls over critical stages such as data usage and external data transfer to mitigate security risks including data leakage and abuse. Meanwhile, we have continued to upgrade our data security technical capabilities by adopting measures including encryption, data pseudonymization, and access controls to improve the security of data processing across our products and services. We have also conducted regular data security training and awareness programs for critical business functions and roles to strengthen employees’ security risk awareness and capabilities, and to protect user data and the company’s data assets.

Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]

Governance

Our board of directors is responsible for overseeing the cybersecurity risk management and be informed on risks from cybersecurity threats.

The chief executive officer, the chief financial officer, and the principal officer in charge of the cybersecurity matters are responsible for discussing material cybersecurity incidents or threats with specific constituencies before sign-off, ensuring thorough review of information and disclosures. This involves our disclosure committee (comprising of the principal accounting officer or the head of financial reporting, the head of the legal department, the principal investor relations officer, the principal officer in charge of cybersecurity matters, and appropriate business unit heads of our company, as adjusted from time to time by the then incumbent committee members), as a whole, and the executive directors of our company; and other members of senior management and external legal counsel, to the extent appropriate. The chief executive officer, the chief financial officer, and the principal officer in charge of the cybersecurity matters are also responsible for assessing, identifying and managing material risks from cybersecurity threats to our company and monitoring the prevention, detection, mitigation and remediation of material cybersecurity incident, maintaining oversight of the disclosure in Form 6-K for material cybersecurity incidents (if any) and meeting with the disclosure committee (i) in connection with each current report to furnish information concerning any material cybersecurity incident, report the status of any material cybersecurity incidents or material risks from cybersecurity threats to our company, if any, and the relevant disclosure issues and (ii) in connection with each annual report, present the disclosure concerning cybersecurity matters in Form 20-F, along with a report highlighting particular disclosure issues, if any, and hold a Q&A session. Our board of directors is responsible for maintaining oversight of the disclosure related to cybersecurity matters in the periodic reports of our company.

Our Chief Operating Officer currently serves as the principal officer in charge of the cybersecurity matters of our company, who holds the certificate a Certified Information Systems Auditor and has over 20 years of experience in the fields of IT and cybersecurity.

As the top decision-making body for cybersecurity, the Information Security Governance Committee is chaired by the Chief Operating Officer and exercises overall oversight of information security governance.

The Information Security Department performs security management and supervisory functions. All relevant business departments collaborate to implement security measures, continuously improving the overall security posture.

Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] board of directors
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] Our board of directors is responsible for maintaining oversight of the disclosure related to cybersecurity matters in the periodic reports of our company.
Cybersecurity Risk Role of Management [Text Block] The chief executive officer, the chief financial officer, and the principal officer in charge of the cybersecurity matters are responsible for discussing material cybersecurity incidents or threats with specific constituencies before sign-off, ensuring thorough review of information and disclosures. This involves our disclosure committee (comprising of the principal accounting officer or the head of financial reporting, the head of the legal department, the principal investor relations officer, the principal officer in charge of cybersecurity matters, and appropriate business unit heads of our company, as adjusted from time to time by the then incumbent committee members), as a whole, and the executive directors of our company; and other members of senior management and external legal counsel, to the extent appropriate. The chief executive officer, the chief financial officer, and the principal officer in charge of the cybersecurity matters are also responsible for assessing, identifying and managing material risks from cybersecurity threats to our company and monitoring the prevention, detection, mitigation and remediation of material cybersecurity incident, maintaining oversight of the disclosure in Form 6-K for material cybersecurity incidents (if any) and meeting with the disclosure committee (i) in connection with each current report to furnish information concerning any material cybersecurity incident, report the status of any material cybersecurity incidents or material risks from cybersecurity threats to our company, if any, and the relevant disclosure issues and (ii) in connection with each annual report, present the disclosure concerning cybersecurity matters in Form 20-F, along with a report highlighting particular disclosure issues, if any, and hold a Q&A session.

Our Chief Operating Officer currently serves as the principal officer in charge of the cybersecurity matters of our company, who holds the certificate a Certified Information Systems Auditor and has over 20 years of experience in the fields of IT and cybersecurity.

Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] Chief Operating Officer
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Our Chief Operating Officer currently serves as the principal officer in charge of the cybersecurity matters of our company, who holds the certificate a Certified Information Systems Auditor and has over 20 years of experience in the fields of IT and cybersecurity.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] The chief executive officer, the chief financial officer, and the principal officer in charge of the cybersecurity matters are responsible for discussing material cybersecurity incidents or threats with specific constituencies before sign-off, ensuring thorough review of information and disclosures.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true