Additionally, due to the ongoing
COVID-19
pandemic, certain functional areas of our workforce remain in a remote work environment and outside of our corporate network security protection boundaries, which imposes additional risks to our business, including increased risk of industrial espionage, phishing and other cybersecurity attacks, and unauthorized dissemination of proprietary or confidential information.
Because techniques used to obtain unauthorized access to or to sabotage information systems change frequently and may not be known until launched against us, we may be unable to anticipate or prevent these attacks, react in a timely manner, or implement adequate preventive measures, and we may face delays in our detection or remediation of, or other responses to, security breaches and other privacy- and security-related incidents. Unauthorized parties may in the future gain access to systems or facilities used in our business through various means, including gaining unauthorized access into our systems or facilities or those of Business Partners and Experts that utilize our services, attempting to fraudulently induce our employees, Business Partners, Experts, or others into disclosing user names, passwords, payment card information, or other sensitive information, which may in turn be used to access our IT systems, or attempting to fraudulently induce our employees, Business Partners, or others into manipulating payment information, resulting in the fraudulent transfer of funds to bad actors.
In addition, users of our services could have vulnerabilities on their own devices that are entirely unrelated to our systems and platform but could mistakenly attribute their own vulnerabilities to us. Further, breaches experienced by other companies may also be leveraged against us. For example, credential stuffing attacks are becoming increasingly common and sophisticated actors can mask their attacks, making them increasingly difficult to identify and prevent. Certain efforts may be state-sponsored or supported by significant financial and technological resources, making them even more difficult to detect, remediate, and otherwise respond to.
Although we have developed systems and processes that are designed to protect the data of Business Partners, Experts, and Consumers that utilize our platform, protect our systems, prevent data loss, and prevent other security breaches and security incidents, these security measures may not fully protect our systems and we cannot guarantee the security of our systems or the information we handle. The IT and infrastructure used in our business or by the third parties we work with may be vulnerable to or compromised by cyberattacks or security breaches, computer malware, viruses, phishing and other social engineering, ransomware, credential stuffing attacks, hacking and other efforts by individuals or groups of hackers and sophisticated organizations, including state-sponsored organizations or nation-states. Such incidents could result in unauthorized parties accessing data, including personal information and other sensitive and proprietary information of Business Partners, Experts, and Consumers; our employees’ personal information; or our other sensitive and proprietary data, accessible through those systems. Employee error, malfeasance or other errors in the storage, use, or transmission of any of these types of data could result in an actual or perceived privacy or security breach or other security incident. Although we have policies restricting the access to the personal information we store, there is a risk that these policies may not be effective in all cases.
Any actual or perceived breach of privacy, or any actual or perceived security breach or other incidents, could interrupt our operations, result in our platform being unavailable, result in loss or improper access to, or acquisition or disclosure of, data, result in fraudulent transfer of funds, harm our reputation, commercial relationships, and competitive position, damage our relationships with third-party partners, or result in claims, regulatory investigations and proceedings and significant legal, regulatory, and financial exposure, including ongoing monitoring by regulators, and any such incidents or any perception that our security measures are inadequate could lead to loss of Business Partners, Expert or Consumer confidence in, or decreased use of, our platform, any of which could have an adverse effect our business, financial condition, and results of operations. Any actual or perceived breach of privacy or security, or other security incident, impacting any entities with which we share or disclose data (including, for example, our third-party technology providers) could have similar effects. Further, any cyberattacks or actual or perceived security and privacy breaches and other incidents directed at, or suffered by, our competitors could reduce confidence in our industry as a whole and, as a result, reduce confidence in us. We also expect to incur significant costs in an effort to detect and prevent privacy and