Any disruptions, failures or inaccuracies of the sponsor’s operational processes, technology systems and models, including those associated with improvements or modifications to such technology systems and models, could cause the sponsor to be unable to market and manage its products and services, manage its risk, meet its regulatory obligations or report its financial results in a timely and accurate manner, all of which could have a negative impact on the sponsor’s auto finance business, including its ability to service the receivables in the receivables pool, which could adversely affect the liquidity or market value of your notes and the timing and amount of payments on your notes.
A cyber-attack or other security incident, including one that results in the theft, loss, manipulation or misuse of information (including personal information), or the disabling of systems and access to information critical to business operations may cause the sponsor to suffer damage to its reputation, legal exposure and disruptions to its servicing of receivables, which could adversely affect the liquidity or market value of your notes and the timing and amount of payments on your notes
The sponsor’s ability to provide its products and services, many of which are internet-based, and communicate with its obligors, depends upon the management and safeguarding of information systems and infrastructure, networks, software, data, technology, methodologies and business secrets, including those of its service providers. The sponsor’s products and services involve the collection, authentication, management, usage, storage, transmission and eventual destruction of sensitive and confidential information, including personal information, regarding its obligors and their accounts, its employees, its partners and other third parties with which it does business. The sponsor also has arrangements in place with third parties through which it shares and receives information about the third parties’ customers who are or may become obligors of the sponsor. The financial services industry, including the sponsor, is particularly at risk because of the use of and reliance on digital banking products and other digital services, including mobile banking products, such as mobile payments, and other internet- and cloud-based products and applications, and the development of additional remote connectivity solutions, which increase cybersecurity risks and exposure. Consumer acceptance and use of such digital banking products and services has substantially increased since the onset of the COVID pandemic.
Technologies, systems, networks, and other devices of the sponsor, as well as those of its employees, service providers, partners or other third parties with whom the sponsor interacts, have been and may continue to be the subject of cyber-attacks and other security incidents, including computer viruses, hacking, malware, ransomware, supply chain attacks, vulnerabilities, credential stuffing, or phishing or other forms of social engineering. Such cyber-attacks and other security incidents are designed to lead to various harmful outcomes, such as unauthorized transactions in obligor accounts, unauthorized or unintended access to or release, gathering, monitoring, disclosure, loss, destruction, corruption, disablement, encryption, misuse, modification or other processing of confidential or sensitive information (including personal information), intellectual property, software, methodologies or business secrets, disruption, sabotage or degradation of service, systems or networks, or other damage. These threats may derive from, among other things, error, fraud or malice on the part of the sponsor’s employees, insiders, or third parties or may result from accidental technological failure or design flaws. Any of these parties may also attempt to fraudulently induce employees, service providers, obligors, partners, or other third party users of the sponsor’s systems or networks to disclose confidential or sensitive information (including personal information) in order to gain access to the sponsor’s systems, networks or data or those of the sponsor’s obligors, partners or third parties with whom the sponsor interacts, or to unlawfully obtain monetary benefit through misdirected or otherwise improper payment. For instance, any party that obtains the sponsor’s confidential or sensitive information (including personal information) through a cyber-attack or other security incident may use this information for ransom, to be paid by the sponsor or a third party, as part of a fraudulent activity that is part of a broader criminal activity, or for other illicit purposes.
For example, on July 29, 2019, the sponsor’s direct parent, the Corporation, announced that on March 22 and 23, 2019, an outside individual gained unauthorized access to its systems (the “Cybersecurity Incident”). This individual obtained certain types of personal information relating to people who had applied for credit card products and to credit card customers. While the Cybersecurity Incident has been remediated, it has resulted in fines, litigation, settlements, government investigations and other regulatory enforcement inquiries, as well as consent orders with the Federal Reserve and the OCC. The OCC lifted its consent order on August 31, 2022 and the Federal Reserve lifted its consent order on July 5, 2023. Cyber and information security risks for large financial institutions such as the sponsor continue to increase due to the proliferation of new technologies, the industry-wide shift to reliance upon the internet to conduct financial transactions, and the increased sophistication and activities of
23