We are regularly the target of attempted cyber intrusions, and we anticipate continuing to be subject to such attempts as cyber intrusions become increasingly sophisticated and more difficult to predict and protect against. Geopolitical conflict, including Russia’s invasion of Ukraine, has also increased the risk of cyber incidents. As such, we commit substantial resources to continuously monitor and further develop our networks and infrastructure to prevent, detect, and address the risk of unauthorized access, misuse, computer viruses and other events. Our security programs and measures do not prevent all intrusions. Cyber intrusions require a significant amount of time and effort to assess and remedy, and our incident response efforts may not be effective in all cases. Although we believe that the probability of occurrence of a significant cybersecurity incident is less than likely, if such an incident were to occur, the impact on the Company could be substantial. The Company experienced a cyber intrusion in the first quarter of 2021 that was promptly detected, and the third-party software vulnerability was quickly remediated. There was no impact to the Company’s operations, services or financial statements. A subsidiary of WMI provided notice to potentially affected individuals, U.S. state and federal regulators, and Canadian regulators. As a result of the cyber intrusion, regulatory investigations may result in costs, fines, penalties, or other obligations. A subsidiary of WMI was named as a defendant in a class action lawsuit related to this incident. Such case was dismissed in 2022, but an appeal by the plaintiffs is currently pending. The Company intends to vigorously defend itself against any such proceedings and does not expect that the outcome of any proceedings related to the 2021 incident will have a material adverse effect on the Company’s business, financial condition, results of operations or cash flows; however, assessing and responding to this intrusion required a significant amount of time and management attention. While the magnitude of future cyber intrusions that result in a theft, destruction, loss, misappropriation, or release of sensitive and/or confidential information or intellectual property, or material interference with our information technology systems or the technology systems of third parties on which we rely cannot be predicted, such incidents could result in material business disruption, direct financial loss, negative publicity, brand damage, alleged violation of privacy laws, loss of customers, potential regulatory enforcement or private litigation liability and competitive disadvantage. We maintain insurance for cyber incidents; however, due to policy terms, limits and exclusions, such insurance may not apply in all cases, and it may not be adequate to cover all liabilities incurred.
As the Company pursues its strategy to grow through acquisitions and to pursue new initiatives that improve our operations and cost structure, the Company is also expanding and improving its information technologies, resulting in a larger technological presence, utilization of “cloud” computing services, and corresponding exposure to cybersecurity risk. Certain new technologies, such as use of autonomous vehicles, remote-controlled equipment, virtual reality, automation and artificial intelligence, present new and significant cybersecurity safety risks that must be analyzed and addressed before implementation. If we fail to assess and identify cybersecurity risks associated with acquisitions and new initiatives, we may become increasingly vulnerable to such risks.
Increased state, federal and international laws and regulations related to cybersecurity protections and disclosures may require additional resources for compliance, and any inability, or perceived inability, to adequately address new requirements could subject us to regulatory enforcement, private litigation, and public criticism, disrupt our operations, cause us to lose customers, result in additional costs and legal liability, damage our reputation, and otherwise harm our business.
Increasing regulatory focus on privacy and data protection issues and expanding laws could negatively impact our business, subject us to criticism and expose us to increased liability.
The legislative and regulatory framework for privacy and data protection issues worldwide is rapidly evolving and is likely to remain uncertain for the foreseeable future. We collect certain personally identifiable information and other sensitive information in connection with providing services to our customers. We are subject to a variety of laws and regulations, and may become subject to additional pending laws and regulations, that govern the collection and use of such information obtained from individuals and businesses. These laws and regulations are inconsistent across jurisdictions and are subject to evolving interpretations. Government officials, regulators, privacy advocates and class action attorneys are increasingly scrutinizing how companies collect, process, use, store, share, transmit and destroy personal data. We must continually monitor the development and adoption of, and commit substantial time and resources to comply with, new and emerging laws and regulations. These laws and regulations provide disclosure obligations for businesses that collect personal information, individual rights relating to personal information, collection and storage requirements, automated decision-making transparency, and potential liability expansion. Any inability, or perceived inability, to adequately address privacy and data protection concerns, even if unfounded, or comply with applicable laws, regulations, policies, industry standards, contractual obligations, or other legal obligations, including at newly acquired companies, could