to provide features of service that are important to our customers, to protect our confidential business information and the information provided by our customers, and to maintain customer confidence in our ability to protect our systems and to provide services consistent with their expectations. As a result, we are subject to risks imposed by data breaches and operational disruptions, including through cyberattack or cyber-intrusion, by computer hackers, foreign governments, cyber terrorists and activists, cyber criminals, malicious employees or other insiders of the Company or third-party service providers, and other groups and individuals.
Data breaches of companies and governments continue to increase as the number, intensity, and sophistication of attempted attacks and intrusions from around the world have increased and we, our customers, and third parties increasingly store and transmit data by means of connected IT systems. Additionally, risks such as code anomalies, “Acts of God,” data leakage, cyber-fraud, and human error pose a direct threat to our services, systems, and data and could result in unauthorized or block legitimate access to sensitive or confidential data regarding our operations, customers, employees, and suppliers, including personal information.
We also depend on and interact with the technology and systems of third parties, including our customers and third-party service providers such as cloud service providers. Such third parties may host, process, or have access to information we maintain about our company, customers, employees, and vendors or operate systems that are critical to our business operations and services. Like us, these third parties are subject to risks imposed by data breaches, cyberattacks, and other events or actions that could damage, disrupt, or close down their networks or systems. We have security processes, protocols, and standards in place, including contractual provisions requiring such security measures, that are applicable to such third parties and are designed to protect information that is held by them, or to which they have access, as a result of their engagements with us. Nevertheless, a cyberattack could defeat one or more of such third parties’ security measures, allowing an attacker to obtain information about our company, customers, employees, and vendors or disrupt our operations. These third parties may also experience operational disruptions or human error that could result in unauthorized access to sensitive or confidential data regarding our operations, customers, employees, and suppliers, including personal information.
A disruption to our complex, global technology infrastructure, including those impacting our computer systems and website, could result in the loss of confidential business or customer information, require substantial repairs or replacements, resulting in significant costs, and lead to the temporary or permanent transfer by customers of some or all of their business to our competitors. The foregoing could harm our reputation and adversely impact our operations, customer service, and results of operations. Additionally, a security breach could require us to devote significant management resources to address the problems created. A significant data breach or any failure, or perceived failure, by us to comply with any federal, state, or foreign privacy laws, regulations, or other principles or orders to which we may be subject could adversely affect our reputation, brand, and business, and may result in claims, investigations, proceedings, or actions against us by governmental entities, litigation, including class action litigation, from our customers, fines, penalties, or other liabilities, or require us to change our operations or cease using certain data sets. Depending on the nature of the information compromised, we may also have obligations to notify users, law enforcement, government authorities, payment companies, consumer reporting agencies, or the media about the incident and may be required to expend additional resources in connection with investigating and remediating such an incident, and otherwise complying with applicable privacy and data security laws.
These types of adverse impacts could also occur in the event the confidentiality, integrity, or availability of company and customer information was compromised due to a data loss by us or a trusted third party. We or the third parties with which we share information may not discover any security breach and loss of information for a significant period of time after the security breach occurs.
We have invested and continue to invest in technology security initiatives, information-technology risk management, business continuity, and disaster recovery plans, including investments to retire and replace end-of-life systems. The development and maintenance of these measures is costly and requires ongoing
22