Despite the security measures we have in place to comply with applicable laws and rules, our facilities and systems, and those of our third-party service providers (as well as their third-party service providers), may be vulnerable to security breaches, acts of cyber terrorism or sabotage, vandalism or theft, computer viruses, loss or corruption of data or programming or human errors or other similar events. Furthermore, the size and complexity of our information systems, and those of our third-party vendors (as well as their third-party service providers), make such systems potentially vulnerable to security breaches from inadvertent or intentional actions by our employees or vendors, or from attacks by malicious third parties. While we have agreements requiring our third-party service providers to use best practices for data security, we have no operational control over them. Because such attacks are increasing in sophistication and change frequently in nature, we and our third-party service providers may be unable to anticipate these attacks or implement adequate preventative measures, and any compromise of our systems, or those of our third-party vendors (as well as their third-party service providers), may not be discovered and remediated promptly. Changes in consumer behavior following a security breach or perceived security breach, act of cyber terrorism or sabotage, vandalism or theft, computer virus, loss or corruption of data or programming or human error or other similar event affecting a competitor, large retailer or financial institution may materially and adversely affect our business.
If our security and information systems, or those of our vendors, are compromised or if our employees fail to comply with these laws, regulations, or contract terms, and this information is obtained by unauthorized persons or used inappropriately, it could materially and adversely affect our reputation and could disrupt our operations and result in costly litigation, judgments, or penalties arising from violations of federal and state laws and payment card industry regulations, including those promulgated by industry groups, such as the Payment Card Industry Security Standards Council, National Automated Clearing House Association, or NACHA, Canadian Payments Association and individual credit card issuers. Under laws, regulations and contractual obligations, a cyber incident could also require us to notify customers, employees or other groups of the incident or could result in adverse publicity, loss of sales and profits, or an increase in fees payable to third parties. We could also incur penalties or remediation and other costs that could materially and adversely affect the operation of our business and results of operations. We maintain insurance coverage to address cyber incidents, and have also implemented processes, procedures and controls to help mitigate these risks; however, these measures do not guarantee that our reputation and financial results will not be adversely affected by such an incident.
We rely heavily on information systems, and any material failure, interruption or weakness may prevent us from effectively operating our business and damage our reputation.
We increasingly rely on information systems, including our technology-enabled platform through which we distribute workouts to our consumer base,
processing systems and other information systems managed by third parties, to interact with our customers, billing information and other personally identifiable information, collection of cash, legal and regulatory compliance, management of our supply chain, accounting, staffing, payment of obligations, ACH transactions, credit and debit card transactions and other processes and procedures. Our ability to efficiently and effectively manage our business depends significantly on the reliability and capacity of these systems, and any potential failure of third parties to provide quality uninterrupted service is beyond our control.
Our operations depend upon our ability, and the ability of our third-party service providers (as well as their third-party service providers), to protect our computer equipment and systems against damage from physical theft, fire, power loss, telecommunications failure or other catastrophic events, as well as from internal and external security breaches, viruses,
attacks and other disruptions. The failure of these systems to operate effectively, stemming from maintenance problems, upgrading or transitioning to new platforms, expanding our systems as we grow, a breach in security or other unanticipated problems could result in interruptions to or delays in our business and customer service and reduce efficiency in our operations. In addition, the implementation of technology changes and upgrades to maintain current and integrate new systems may also cause service interruptions, operational delays due to the learning curve associated with using a new system, transaction processing errors and system conversion delays and may cause us to fail to comply with applicable laws. If our information systems, or those of our third-party service providers (as well as their third-party service providers), fail and our or our providers’ third-party
back-up
or disaster recovery plans are not adequate to address such failures, our revenues and profits could be reduced, and the reputation of our brand and our business could be materially and adversely affected.