because of the increased use of and reliance on digital banking products and other digital services, including mobile banking products, such as mobile payments, and other internet- and cloud-based products and applications, and the development of additional remote connectivity solutions, which increase cybersecurity risks and exposure. In addition, global events and geopolitical instability and the related sanctions imposed by the U.S. and other countries, and increased geopolitical tensions between the U.S. and China, may lead to increased nation state targeting of financial institutions in the U.S. and abroad.
Technologies, systems, networks, and other devices of the sponsor, as well as those of its employees, service providers, partners or other third parties with whom the sponsor interacts, have been and may continue to be the subject of cyber-attacks and other security incidents, including computer viruses, hacking, malware, ransomware, supply chain attacks, vulnerabilities, credential stuffing, account takeovers, insider threats, business email compromise scams or phishing or other forms of social engineering. Such cyber-attacks and other security incidents are designed to lead to various harmful outcomes, such as unauthorized transactions in obligor accounts, unauthorized or unintended access to or release, gathering, monitoring, disclosure, loss, destruction, corruption, disablement, encryption, misuse, modification or other processing of confidential or sensitive information (including personal information), intellectual property, software, methodologies or business secrets, disruption, sabotage or degradation of service, systems or networks, an attempt to extort the sponsor, its third-party service providers or its business partners or other damage. Cyber-attacks and other security incidents that occur in the supply chain of third parties with which the sponsor interacts could also negatively impact the sponsor’s ability to service the receivables, which could adversely affect the timing and amount of payment on your notes. These threats may derive from, among other things, error, fraud or malice on the part of the sponsor’s employees, insiders, or third parties or may result from accidental technological failure or design flaws. Any of these parties may also attempt to fraudulently induce employees, service providers, obligors, partners, or other third party users of the sponsor’s systems or networks to disclose confidential or sensitive information (including personal information) in order to gain access to the sponsor’s systems, networks or data or those of the sponsor’s obligors, partners or third parties with whom the sponsor interacts, or to unlawfully obtain monetary benefit through misdirected or otherwise improper payment. For instance, any party that obtains the sponsor’s confidential or sensitive information (including personal information) through a cyber-attack or other security incident may use this information for ransom, to be paid by the sponsor or a third party, as part of a fraudulent activity that is part of a broader criminal activity, or for other illicit purposes. Additionally, the failure of the sponsor’s employees, third-party service providers or business partners, or their respective supply chains, to exercise sound judgment and vigilance when targeted with social engineering or other cyber-attacks may increase the sponsor’s vulnerability.
For example, on July 29, 2019, the sponsor’s direct parent, the Corporation, announced that on March 22 and 23, 2019 an outside individual gained unauthorized access to the sponsor’s systems (the “2019 Cybersecurity Incident”). This individual obtained certain types of personal information relating to people who had applied for the sponsor’s credit card products and to its cardholders. While the 2019 Cybersecurity Incident has been remediated, it resulted in fines, litigation, consent orders, settlements, government investigations and other regulatory enforcement inquiries. Cyber and information security risks for large financial institutions such as the sponsor continue to increase due to the proliferation of new technologies, the industry-wide shift to reliance upon the internet to conduct financial transactions, and the increased sophistication and activities of malicious actors, organized crime, perpetrators of fraud, hackers, terrorists, activists, extremist parties, formal and informal instrumentalities of foreign governments, state-sponsored or nation-state actors and other external parties and the growing use of AI by threat actors.
In addition, obligors on receivables serviced by the sponsor access the sponsor’s products and services using personal devices that are necessarily external to the sponsor’s security control systems. There has also been a significant proliferation of consumer information available on the internet resulting from breaches of third-party entities, including personal information, log-in credentials and authentication data. These third-party breach events could create a threat for obligors on receivables serviced by the sponsor if their Capital One log-in credentials are the same as or similar to the credentials that have been compromised on other internet sites. This threat could include the risk of unauthorized account access, data loss and fraud. The use of AI, “bots” or other automation software can increase the velocity and efficacy of these types of attacks. As the sponsor’s employees are operating under its hybrid work model, its remote interaction with employees, service providers, partners and other third parties on systems, networks and environments over which the sponsor has less control (such as through employees’ personal devices) increases its cybersecurity risk exposure. The sponsor will likely face an increasing number of attempted cyber-attacks as it expands its mobile and other internet-based products and services, as well as its usage of mobile and cloud technologies and as it provides more of these services to a greater number of retail banking customers and auto finance customers.
24