Operations Risks
We rely on our IT systems to manage numerous aspects of our business. A cyber-based attack of these systems could disrupt our ability to deliver services to our customers and could lead to increased overhead costs, decreased sales, and harm to our reputation.
We rely on IT networks and systems to operate and manage our business, including FireTRAC, which combines proprietary data and technology to deliver certain insights on fire risks. Our IT networks and systems process, transmit and store personal and financial information, and proprietary information of our business. The technology also allows us to coordinate our business across our operation bases and communicate with our employees and externally with customers, suppliers, partners, and other third parties. While we believe we take reasonable steps to secure these IT networks and systems, and the data processed, transmitted, and stored thereon, such networks, systems, and data may be susceptible to cyberattacks, viruses, malware, or other unauthorized access or damage (including by environmental, malicious, or negligent acts), which could result in unauthorized access to, or the release and public exposure of, our proprietary information or our users’ personal information. In addition, cyberattacks, viruses, malware, or other damage or unauthorized access to our IT networks and systems could result in damage, disruptions, or shutdowns to our platform. Any of the foregoing could cause substantial harm to our business, require us to make notifications to our customers, governmental authorities, or the media, and could result in litigation, investigations or inquiries by government authorities, or subject us to penalties, fines, and other losses relating to the investigation and remediation of such an attack or other unauthorized access or damage to our IT systems and networks.
Our service, data and systems may be critical to operations or involve the storage, processing and transmission of sensitive data, including valuable intellectual property, other proprietary or confidential data, regulated data, and personal information of employees, and others. Successful breaches, employee malfeasance, or human or technological error could result in, for example, unauthorized access to, disclosure, modification, misuse, loss, or destruction of our or other third-party data or systems; theft of sensitive, regulated, or confidential data including personal information and intellectual property; the loss of access to critical data or systems; service or system disruptions or denials of service.
Our ability to attract and retain customers, to efficiently operate our business, and to compete effectively depends in part upon the sophistication, security, and reliability of our technology network, including our ability to provide features of service that are important to our customers, to protect our confidential business information and the information provided by our customers, and to maintain customer confidence in our ability to protect our systems and to provide services consistent with their expectations. As a result, we are subject to risks imposed by data breaches and operational disruptions, including through cyberattack or cyber-intrusion, by computer hackers, foreign governments, cyber terrorists and activists, cyber criminals, malicious employees or other insiders of the Company or third-party service providers, and other groups and individuals.
Data breaches of companies and governments continue to increase as the number, intensity, and sophistication of attempted attacks and intrusions from around the world have increased and we, our customers, and third parties increasingly store and transmit data by means of connected IT systems. Additionally, risks such as code anomalies, “Acts of God”, data leakage, cyber-fraud, and human error pose a direct threat to our services, systems, and data and could result in unauthorized or block legitimate access to sensitive or confidential data regarding our operations, customers, employees, and suppliers, including personal information.
We also depend on and interact with the technology and systems of third parties, including our customers and third-party service providers such as cloud service providers. Such third parties may host, process, or have access to information we maintain about our company, customers, employees, and vendors or operate systems that are critical to our business operations and services. Like us, these third parties are subject to risks imposed by data breaches, cyberattacks, and other events or actions that could damage, disrupt, or close down their networks or systems. We have security processes, protocols, and standards in place, including contractual provisions requiring such security measures, that are applicable to such third parties and are designed to protect information that is held by them, or to which they have access, as a result of their engagements with us. Nevertheless, a cyberattack could defeat one or more of such third parties’ security measures, allowing an attacker to obtain information about our company, customers, employees, and vendors or disrupt our operations. These third parties may also experience operational disruptions or human error that could result in unauthorized access to sensitive or confidential data regarding our operations, customers, employees, and suppliers, including personal information.
19