Risks Related to our Technology and Data
Our business relies heavily on information systems and technology, and any failure, interruption or weakness in our or our third-party service providers’ information systems or technology may prevent us from effectively operating our business and damage our reputation. A failure to adequately update our existing systems and implement new systems could harm our businesses and adversely affect our results of operation.
We increasingly rely on information technology (‘IT’) systems, including our point-of-sale processing systems in our Houses, restaurants and other businesses and other information systems managed by third-party service providers, to interact with our members and customers and collect, maintain, store, transfer, disclose and otherwise process customer and member information and other PII, including for our operations, collection of cash, management of our supply chain, accounting, staffing, payment obligations, Automated Clearing House (‘ACH’) transactions, credit and debit card transactions, and other processes and procedures. We leverage our internal IT systems, and those of our third-party service providers, to enable, sustain, and support our business interests.
Given the communication channels through which we engage with our members, customers and employees and other aspects of our business, it is important that we and our third-party service providers maintain uninterrupted operation of our business-critical computer systems. Our operations depend upon our ability, and the ability of third-party service providers, to protect our computer equipment and other systems against damage, failure, interruption and other security incidents. However, our systems, and those of our third-party service providers, including back-up systems, are subject to damage, interruption, disruption or outage from, among other things, physical theft, human error, power outages and loss, computer and telecommunications failures, computer viruses and worms, installation of malicious software, internal or external security or data breaches, phishing, ransomware, malware, social engineering attacks, credential stuffing, denial-of-service attacks, catastrophic events and natural disasters such as fires, floods, earthquakes, tornadoes and hurricanes, wars, terrorism, fraud, negligence, misconduct or errors by our employees or other third parties, including state-sponsored organizations with significant financial and technological resources, and other disruptive problems or security breaches. If our or our third-party service providers’ systems are damaged or cease to function properly, we may have to make significant investments to fix or replace them, and we may suffer interruptions in our operations in the interim. Any interruption in such systems could have a material adverse effect on our business, financial condition, liquidity, results of operation, cash flows or prospects.
The failure of these systems to operate effectively, maintenance problems, upgrading or transitioning to new platforms, expanding our systems as we grow, security breaches or other security incidents of our and our third-party service providers’ systems or other unanticipated problems could result in interruptions to, or delays in, our business and member and customer service, unauthorized access or misuse of data, including PII, and may reduce efficiency in our operations.
In addition, the implementation of technology changes and upgrades to maintain current systems and integrate new systems, as well as transitions from one service provider to another, may also cause service interruptions, disruptions or outages, operational delays due to the learning curve associated with using a new system, transaction processing errors and system conversion delays and may cause us to fail to comply with applicable laws, rules, regulations, policies, industry standards, contractual obligations and other legal requirements related to data privacy, protection and security. If our information systems or those of our third-party service providers fail, and our or our third-party service providers’ back-up or disaster recovery plans are not adequate to address such failures, such events may adversely affect our business and operations. If we need to move to a different third-party system, our operations, including electronic funds transfer drafting, could be interrupted. In addition, remediation of such problems could result in significant, unplanned operating or capital expenditures, which may have an adverse effect on our business and operations.
40