We rely on information technology systems and any damage to, or failure or interruption of, those systems could have a material adverse effect on our business.
We are dependent on various information technology systems, including, but not limited to, networks, applications, and outsourced services in connection with the operation of our business. A failure of our information technology systems to perform as we anticipate could disrupt our business and result in transaction errors, processing inefficiencies, and loss of sales, any of which could harm our business. In addition, our information technology systems may be vulnerable to damage or interruption from circumstances, some of which are beyond our control, including fire, natural disasters, systems failures, viruses, and security breaches. Any such failure, damage, or interruption could have a material adverse effect on our business.
Cybersecurity incidents, or real or perceived errors, failures, or bugs in our systems or other technology disruptions or failure to comply with laws and regulations relating to privacy and the protection of data relating to our confidential information or our customers’ and consumers’ personal information could negatively impact our business, our reputation and our relationships with customers.
Our continued success depends in part on our systems, applications, and software continuing to operate to meet the changing needs of our customers. We rely on our technology for substantially all aspects of our business operations. We use mobile applications, social networking, and other online activities to connect with our customers, consumers, co-manufacturers, suppliers, and employees. Our business involves the storage and transmission of numerous classes of sensitive or confidential information and intellectual property, including customers’, consumers’, and suppliers’ information, private information about employees, and financial and strategic information about us and our business partners. Further, as we pursue new initiatives that enhance our operations and cost structure, potentially including acquisitions, we may also be required to expand and improve our information technologies, resulting in a larger technological presence and corresponding exposure to cybersecurity risk. Like all technology and information systems, such use gives rise to cybersecurity risks, including security breaches, espionage, system disruption through material errors, failures, vulnerabilities, or bugs, particularly when new features or capabilities are released, theft, and inadvertent release of information. Our technology and information systems may be subject to computer viruses or malicious code, break-ins, phishing impersonation attacks, attempts to overload our servers with denial-of-service or other attacks, ransomware, and similar incidents or disruptions from unauthorized use of our computer systems, as well as unintentional incidents causing data leakage, any of which could lead to interruptions, delays, or website or mobile app shutdowns. For example, in 2018 we were subject to a phishing attack, which resulted in an unauthorized third party accessing our servers, and we could experience similar incidents in the future, particularly as hackers utilize increasingly sophisticated measures to bypass information security systems. Electronic security attacks designed to gain access to personal, sensitive, or confidential data are constantly evolving, and such attacks continue to grow in sophistication. If we fail to assess and identify cybersecurity risks associated with new initiatives or acquisitions, we may become increasingly vulnerable to such risks. While we have implemented measures to prevent such security breaches and cyber incidents, our preventative measures and incident response efforts may not be effective. The theft, destruction, loss, misappropriation, or release of sensitive or confidential information or intellectual property, or interference with our information technology systems or the technology systems of third parties on which we rely, could result in business disruption, negative publicity, reputational harm, violation of privacy laws, loss of customers, and liability, all of which could have a material adverse effect on our business, operating results, and financial condition. Additionally, as a result of a breach or other security incident, we could be subject to demands, claims, and litigation by private parties and investigations, related actions, and penalties by regulatory authorities. Moreover, we could incur significant costs in notifying affected persons and entities and otherwise complying with the multitude of foreign, federal, state, and local laws and regulations relating to the unauthorized access to, or use or disclosure of, personal information.
In addition, we are subject to numerous federal, state, local and foreign laws, rules, and regulations relating to the collection, processing, storing, sharing, disclosure, use, and security of personal information and other data. We are also potentially subject to specific contractual requirements contained in agreements with third parties governing our use and protection of personal information and other data. We strive to comply with applicable laws, policies, legal, and contractual obligations and industry standards relating to privacy and data protection, to the extent possible. Nevertheless, such laws, regulations, and other obligations may require us to change our business practices and may negatively impact our ability to expand our business and pursue business opportunities. We may incur significant expenses to comply with the laws, regulations, and other obligations that apply to us. Additionally, the privacy- and
41