EXHIBIT 99.6
Information related to certain material risks
related to Total System Services, Inc.’s business, operations and financial condition
Unless the context otherwise requires, all references herein to “TSYS,” the “Company,” “we,” “our,” or “us” refer to Total System Services, Inc. and its consolidated subsidiaries and references to “management” refer to the management of TSYS.
RISK FACTORS
This section highlights specific risks that could affect our business and us. Although this section attempts to highlight key factors, please be aware that other risks may prove to be important in the future. New risks may emerge at any time and we cannot predict such risks or estimate the extent to which they may affect our financial performance. In addition to the factors discussed elsewhere or incorporated by reference in this report, among the other factors that could cause actual results to differ materially are the following:
Security breaches of our systems, including as a result of cyber-attacks, may damage client relations, our reputation and expose us to financial liability.
In order to provide our services, we process, store and transmit sensitive business information and personal consumer information which may include credit and debit card numbers, names and addresses, social security numbers, driver’s license numbers, bank account numbers and other types of personal information or sensitive business information. Under the card network rules, various federal, state and international laws, and client contracts, we are responsible for information provided to us by financial institutions, merchants, ISOs and others and for our failure to protect this information. Some of this information is also processed and stored by financial institutions, merchants and other entities, as well as third-party service providers to whom we outsource certain functions and other agents, which we refer to collectively as our associated third parties. The confidentiality of the sensitive business information and personal consumer information that resides on our systems and our associated third parties’ systems is critical to our business. While we maintain controls and procedures designed to protect the sensitive data we collect, we cannot be certain that these measures will be successful or sufficient to counter all current and emerging information security threats that we face on a daily basis.
Certain of our computer systems and certain of our associated third parties’ computer systems have been, and could be in the future, breached, and our data protection measures have not and may not in the future prevent unauthorized access. Information security risks for us and our competitors have substantially increased in recent years in part due to the proliferation of new technologies and the increased sophistication, resources and activities of hackers, terrorists, activists, organized crime, and other external parties, including hostile nation-state actors. The techniques used by these bad actors to breach and otherwise obtain unauthorized access, disable or degrade service, sabotage systems or utilize payment systems in an effort to perpetrate financial fraud change frequently and are often difficult to detect. Although we are not aware of any material breach of our computer systems or of our associated third parties’ computer systems that have had a material impact on us or caused us to incur material losses relating to cyber-attacks or other information security breaches to date, we and others in our industry are regularly the subject of sophisticated and numerous attempts by bad actors to gain unauthorized access to these computer systems and data or to obtain, change or destroy confidential data (including personal consumer information of individuals) through a variety of means, including, but not limited to, computer viruses, malware and phishing. In the future, these attacks may result in unauthorized individuals obtaining access to our confidential information or confidential information provided to us by financial institutions, merchants, ISOs and others, or otherwise accessing, damaging, or disrupting our computer systems or infrastructure. In addition, we expect bad actors to utilize increasingly sophisticated technology and techniques in the future to exploit vulnerabilities that may, or may not, be generally known. As a result, we must continuously develop and enhance our controls, processes, and practices designed to protect our computer systems, software, data and networks from attack, damage, or unauthorized access. This continuous development and enhancement will require us to expend additional resources, including to investigate and remediate significant information security vulnerabilities detected. Despite our investments in security measures, we are unable to assure that any security measures will be effective and will not be subject to breach, or system or human error. In addition, insider or employee cyber and security threats also pose a risk to all large companies, including ours. If one or more of the events described above were to occur, our computer systems or our associated third parties’ computer systems could be breached and the information stored there could be accessed, publicly disclosed, lost, changed, controlled or stolen. While we maintain insurance coverage that may cover certain aspects of cyber risks, such insurance coverage may be insufficient to cover all losses.