AFG uses computer systems and services, which may include or utilize AI applications, to store, retrieve, evaluate and utilize company and customer data and information. Systems failures or outages could compromise AFG's ability to perform business functions in a timely manner, which could harm its ability to conduct business and hurt its relationships with business partners and customers. In the event of a disaster such as a natural catastrophe, an industrial accident, a blackout, a malicious software attack, a terrorist attack or war, AFG's systems may be inaccessible to employees, customers or business partners for an extended period of time. Even if AFG's employees are able to report to work, they may be unable to perform their duties for an extended period of time if AFG's data or systems are disabled or destroyed.
Businesses in the United States and in other countries have increasingly become the targets of "cyber-attacks," "ransomware," "phishing," "hacking" or similar illegal or unauthorized intrusions into computer systems and networks. Such events are often highly publicized, can result in significant disruptions to information technology systems and the theft of significant amounts of information as well as funds from online financial accounts, and can cause negative publicity and extensive damage to the reputation of the targeted business, in addition to leading to significant expenses associated with investigation, remediation and customer protection measures. The sophistication of cybersecurity threats, including through the use of AI, continues to increase and proliferate. Like others in the insurance industry, AFG experiences cyber-attacks and other attempts to gain unauthorized access to its systems on a regular basis and anticipates continuing to be subject to such attempts. AFG's administrative and technical controls as well as other preventative actions used to reduce the risk of cyber incidents and protect AFG's information may be insufficient to detect or prevent future unauthorized access, other physical and electronic break-ins, cyber-attacks or other security breaches to AFG's computer systems or those of third parties with whom AFG does business. Third parties with which AFG conducts business have also experienced, and may experience in the future, similar illegal or unauthorized intrusions into their computer systems and networks, which could adversely affect AFG's ability to conduct business, its results of operations and reputation, in addition to exposing it to legal liability or regulatory action.
AFG has outsourced certain technology and business process functions to third parties over which it has no control and may continue to do so in the future. Outsourcing of certain technology and business process functions to third parties may expose AFG to increased risk related to data security or service disruptions. If AFG does not effectively develop, implement and monitor these relationships, third-party providers do not perform as anticipated, technological or other problems are incurred, or outsourcing relationships relevant to AFG's business process functions are terminated or interrupted, AFG may not realize expected productivity improvements or cost efficiencies and may experience operational difficulties, increased costs and a loss of business.
The increased risks identified above could expose AFG to data loss, disruption of service, monetary and reputational damages, competitive disadvantage and significant increases in compliance costs and costs to improve the security and resiliency of AFG's computer systems. The compromise of personal, confidential or proprietary information could also subject AFG to legal liability or regulatory action under evolving cyber-security, data protection and privacy laws and regulations enacted by the U.S. federal and state governments, Canada, the EU or other jurisdictions or by various regulatory organizations or exchanges. As a result, AFG's ability to conduct business and its results of operations might be materially and adversely affected.