RISKS RELATED TO THE SERVICER AND OTHER TRANSACTION PARTIES.
The sponsor faces risks related to its operational, technological and organizational infrastructure, including risks arising from the theft, loss or misuse of information (including as a result of a cyber-attack), which could adversely affect the liquidity or market value of your notes and the timing and amount of payments on your notes
Similar to other large financial institutions, the sponsor is exposed to operational risk that can manifest itself in many ways, such as errors in execution or inadequate processes, inaccurate models, faulty or disabled technological infrastructure and fraud by employees or persons outside of the company. In addition, the sponsor is heavily dependent on the security, capability and continuous availability of the technology systems that it uses to manage its internal financial and other systems, monitor risk and compliance with regulatory requirements, provide services to its customers, develop and offer new products and communicate with stakeholders.
If the sponsor does not maintain the necessary operational, technological and organizational infrastructure to operate its business, including to maintain the security of that infrastructure, the sponsor’s business and reputation could be materially adversely affected, which could adversely affect the liquidity or market value of your notes. The sponsor is also subject to disruptions to its operating systems arising from events that are wholly or partially beyond its control, which may include, computer viruses, electrical or telecommunications outages, design flaws in foundational components or platforms, availability and quality of vulnerability patches from key vendors, cyber-attacks (including Distributed Denial of Service (“DDOS”) attacks and other attacks on its infrastructure), natural disasters, public health emergencies (including COVID-19 or similar outbreaks), other damage to property or physical assets, or events arising from local or larger scale politics, including terrorist acts and civil unrest. The sponsor also relies on the business infrastructure and systems of third parties with which it does business and to whom it outsources the operation, maintenance and development of its information technology and communications systems.
On July 29, 2019, the sponsor’s direct parent, the Corporation, announced that on March 22, 2019 and March 23, 2019, an outside individual gained unauthorized access to its systems. This individual obtained certain types of personal information relating to people who had applied for the Corporation’s credit card products and to the Corporation’s credit card customers (the “Cybersecurity Incident”). The Corporation may incur significant costs in connection with the Cybersecurity Incident and any future cybersecurity incidents, including infrastructure investments or remediation efforts. Technologies, systems, networks and devices of the sponsor or its employees, service providers or other third parties with whom the sponsor interacts may continue to be the subject of attempted unauthorized access, mishandling or misuse of information, DDOS attacks, computer viruses, website defacement, hacking, malware, ransomware, phishing or other forms of social engineering, and other forms of cyber-attacks designed to obtain confidential information, destroy data, disrupt or degrade service, sabotage systems or cause other damage, and other events. These threats, such as the Cybersecurity Incident, may derive from error, fraud or malice on the part of the sponsor’s employees, insiders or third parties or may result from accidental technological failure. In addition, the sponsor’s customers access its products and services using computers, smartphones, tablets and other mobile devices that are beyond the sponsor’s security control systems.
The methods and techniques employed by perpetrators of fraud and others to attack, disable, degrade or sabotage platforms, systems and applications change frequently, are increasingly sophisticated and often are not fully recognized or understood until after they have occurred, and some techniques could occur and persist for an extended period of time before being detected. For example, although the Corporation immediately fixed the configuration vulnerability that was exploited in the Cybersecurity Incident once it discovered the unauthorized access, a period of time elapsed between the occurrence of the unauthorized access and the time when the Corporation discovered it. The sponsor will likely face an increasing number of attempted cyber-attacks as it expands its mobile and other internet-based products and services, as well as its usage of mobile and cloud technologies and as the sponsor provides more of these services to a greater number of retail clients.
A disruption or breach, including as a result of a cyber-attack such as the Cybersecurity Incident, or media reports of perceived security vulnerabilities at the sponsor or at the sponsor’s third-party service providers, could result in significant legal and financial exposure, regulatory intervention, litigation and remediation costs, supervisory liability, damage to the sponsor’s reputation or loss of confidence in the security of the sponsor’s systems, products and services, which could adversely affect its business and adversely affect the market value or liquidity of your notes. If future cyber-attacks are successful or if obligors are unable to access their accounts online for other reasons, it could adversely impact the sponsor’s ability to service customer accounts or loans (including the receivables), complete financial transactions for obligors or customers or otherwise operate any of the sponsor’s
27