We rely on multiple information technology systems and a number of third-party vendor platforms (collectively, "IT Systems") in order to run and manage our daily operations, including for fuel pricing, loyalty programs, payroll, accounting, budgeting, reporting, and store operations. Such IT Systems allow us to manage various aspects of our business, communicate with customers, and to provide reliable analytical information to our management. The future operation, success and growth of our business depends on streamlined processes made available through our uninhibited access to information systems, global communications, internet activity and other network processes. Like most other companies, despite our current cybersecurity risk management framework (see "Cybersecurity" for additional detail) and process controls, our IT Systems and those of our third-party service providers, may be vulnerable to information security breaches, ransomware or extortion, mishandled data, acts of vandalism, computer viruses and interruption or loss of valuable business data. Stored data might be improperly accessed due to a variety of events beyond our control, including, but not limited to, damage and interruption from power loss or natural disasters, computer system and network failures, loss of telecommunications services, physical and electronic loss of access to data and information, terrorist attacks, hackers, security breaches or other security incidents, and computer viruses or attacks. We rely on third-parties to provide maintenance and support of our IT Systems, and to store our data (including customer data) and a failure of any of these third-parties to provide adequate and timely support, or compromise of these third-parties' systems, could adversely affect the operation of our IT Systems. We have technology security initiatives and disaster recovery plans in place to mitigate our risk to these vulnerabilities, but these measures may not be adequately designed or implemented to ensure that our operations are not disrupted or the data security breaches do not occur.
Hackers and data thieves are increasingly sophisticated and operate large-scale and complex attacks which may remain undetected until after they occur. Such attacks also may be further enhanced in frequency or effectiveness through threat actors' use of artificial intelligence. Any breach of our network or those of our vendors may result in damage to our reputation, the loss of valuable business data, the misappropriation of our valuable intellectual property or trade secret information, misappropriation of our customers' or employees' personal information, key personnel being unable to perform duties or communicate throughout the organization, loss of retail sales, significant costs for data restoration and other adverse impacts on our business. Despite our existing security procedures and controls, if our network or the network of one of our service providers was compromised, it could give rise to unwanted media attention, materially damage our customer relationships, harm our business, reputation, results of operations, cash flows and financial condition, result in fines or litigation, and may increase the costs we incur to protect against such information security breaches, such as increased investment in technology, the costs of compliance with consumer protection laws and costs resulting from consumer fraud. In addition, successful cyberattacks, data breaches, or data security incidents, at one of our vendors, other convenience store operators, large retailers or other market participants, whether or not we are directly impacted, could lead to a general loss of customer confidence or affect our supply chain which could negatively affect us, including harming the market perception of the effectiveness of our security measures or harming the reputation of the industry in general, which could result in reduced use of our products and services.
The costs of mitigating cybersecurity risks are significant and are likely to increase in the future. These costs include, but are not limited to, retaining the services of cybersecurity providers; compliance costs arising out of existing and future cybersecurity, data protection and privacy laws and regulations; costs related to maintaining redundant networks, data backups and other damage-mitigation measures; and extra administrative costs to mitigate risk and deal with any system breaches. While we maintain cyber liability insurance, our insurance may not be sufficient to protect against all losses we may incur due to policy exclusions or if we suffer significant or multiple attacks.