Security breaches could negatively impact our business by causing disruption to our operations, a compromise of confidential guest information, or confidential team member information, and could subject us to loss and harm our business.
Our business requires the collection, transmission and retention of large volumes of guest and team member data, including credit and debit card numbers and other personally identifiable information, in various information technology systems that we maintain and in those maintained by third parties with whom we contract to provide services. The integrity and protection of that guest and team member data is critical to us. Further, our guests and team members have a high expectation that we and our service providers will adequately protect their personal information.
Like many other retail and restaurant companies, we have experienced, and will likely continue to experience, attempts to compromise our information technology systems. Additionally, the techniques and sophistication used to conduct cyber-attacks and breaches of information technology systems, as well as the sources and targets of these attacks, change frequently and are often not recognized until such attacks are launched or have been in place for a period of time. While we continue to make significant investment in physical and technological security measures, team member training, and third party services, designed to anticipate cyber-attacks and prevent breaches, our information technology networks and infrastructure or those of our third party vendors and other service providers could be vulnerable to damage, disruptions, shutdowns, data loss, or breaches due to criminal conduct, team member error, negligence or malfeasance, utility failures, natural disasters or other catastrophic events. Due to these scenarios we cannot provide assurance that we will be successful in preventing such cyber-attacks, breaches or data loss.
Additionally, the information security and privacy requirements imposed by governmental regulation are evolving and we are expected to fulfill such requirements. Our systems may not be able to satisfy these requirements and expectations or may require significant additional investments or time in order to do so. Efforts to hack or breach security measures, failures of systems or software to operate as designed or intended, viruses, operator error or inadvertent releases of data all threaten our and our service providers’ information systems and records. A breach in the security of our information technology systems or those of our service providers could lead to an interruption in the operation of our systems, resulting in operational inefficiencies and a loss of profits. Additionally, a significant theft, loss or misappropriation of, or unauthorized access to, our guests’ data or other proprietary data or other breach of our information technology systems could result in fines, legal claims or proceedings, regulatory investigations and actions, or liability for failure to comply with privacy and information security laws, which could disrupt our operations, damage our reputation and expose us to claims from guests and team members, any of which could have a material adverse effect on our business, financial condition and results of operations.
System interruptions or a material failure of our systems could damage our business, reputation and brand and substantially harm our business, financial condition and results of operations.
Our omni-channel approach will in large part rely on our information technology systems to operate successfully, including the implementation of our delivery strategy. As we expand our delivery business channels, our exposure to such risks will increase.
Our systems, which in some cases rely on third-party providers, may experience service interruptions, degradation or other performance problems because of hardware and software defects or malfunctions, distributed denial-of-service and other cyberattacks, infrastructure changes, human error, earthquakes, hurricanes, floods, fires, natural disasters, power losses, disruptions in telecommunications services, fraud, military or political conflicts, terrorist attacks, computer viruses, ransomware, malware, or other events. Our systems also may be subject to break-ins, sabotage, theft, and intentional acts of vandalism as a result of criminal third parties (including state-sponsored organizations with significant financial and technological resources), third parties we do business with and team members. Our reliance on third parties increases our exposure to such
57