expenses, regulatory penalties and litigation by customers and other parties whose information was subject to such attacks, all of which could have a material adverse effect on our business, prospects, results of operations and cash flows. If our information technology systems become damaged or otherwise cease to function properly, our service and results of operations may be adversely affected and we may have to make significant investments to repair or replace them. Furthermore, any extended downtime from power supply disruptions or information technology system outages which may be caused by cyber security attacks or other reasons at Studio City may lead to an adverse impact on our operating results if we are unable to deliver services to customers for an extended period of time.
Despite the security measures we currently have in place, our facilities and systems and those of our third-party service providers may be vulnerable to security breaches, acts of vandalism, phishing attacks, computer viruses, misplaced or lost data, programming or human errors, other cybercrimes and other events. Cybersecurity risks continue to intensify globally, with cybercriminals employing increasingly sophisticated methods of cyber-attack. There were a number of well-publicized attacks on large corporations, including several in our industry. Cyber-attacks are becoming increasingly more difficult to anticipate and prevent due to their rapidly evolving nature and, as a result, the technology we use to protect our systems could become outdated. The occurrence of any of the cyber incidents described above could cause reputational harm to us, expose us to legal proceedings and have a material adverse effect on our business, results of operations and cash flows.
Any perceived or actual electronic or physical security breach involving the misappropriation, loss, or other unauthorized disclosure of confidential or personally identifiable information, whether by us or by a third party, could disrupt our business, damage our reputation and relationships with our customers, suppliers and staff, expose us to risks of litigation, significant fines and penalties and liability, result in the deterioration of our customers’, suppliers’ and staff’s confidence in us, and adversely affect our business, results of operations and financial condition. Any perceived or actual unauthorized disclosure of personally identifiable information of our staff, customers, suppliers or website visitors could harm our reputation and credibility and reduce our ability to attract and retain staff, customers and suppliers. We are also subject to enactment of new laws or amendments to existing laws with more stringent requirements in relation to cybersecurity. For example, a new Cybersecurity Law was introduced in Macau in 2019 which also applies to our businesses in Macau. See “Item 4. Information on the Company — B. Business Overview — Regulations — Cybersecurity Regulations.” As any of the above cybersecurity threats develop and grow and our obligations under cybersecurity regulations increase, we may find it necessary to make significant further investments to protect our data and infrastructure, including the implementation of new computer systems or upgrades to existing systems, deployment of additional personnel and protection-related technologies, engagement of third-party consultants, and training of personnel.
Finally, while we have implemented a cybersecurity risk management program, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information. See also “Item 16K. Cybersecurity.”
Failure to protect the integrity and security of company staff, supplier and customer information and comply with cybersecurity, data privacy, data protection or any other laws and regulations related to data may materially and adversely affect our business, financial condition and results of operations, and/or result in damage to reputation and/or subject us to fines, penalties, lawsuits, restrictions on our use or transfer of data and other risks.
Our businesses collect, use and transmit large volumes of data, including credit card numbers and personal information in various information systems relating to our customers, suppliers and staff, and such personal information may be collected and/or used in, and transmitted to or from, multiple jurisdictions. We may be subject to a variety of cybersecurity, data privacy, data protection and other laws and regulations related to data, including those relating to the collection, use, sharing, retention, security, disclosure, and transfer of confidential and private information, such as personal information and other data. These laws and regulations apply not only to
27