We and third parties collect, process, transfer, host, store, analyze, retain, provide access to and dispose of account information, payment transaction information, and certain types of personally identifiable and other information pertaining to our customers and colleagues in connection with our cards and other products and in the normal course of our business.
Global financial institutions like us, as well as our customers, colleagues, regulators, service providers and other third parties, have experienced a significant increase in information security and cybersecurity risk in recent years and will likely continue to be the target of increasingly sophisticated cyberattacks, including computer viruses, malicious or destructive code, ransomware, social engineering attacks (including phishing, impersonation and identity takeover attempts), artificial intelligence-assisted deepfake attacks and disinformation campaigns, corporate espionage, hacking, website defacement, denial-of-service attacks, exploitation of vulnerabilities and other attacks and similar disruptions from the misconfiguration or unauthorized use of or access to computer systems and company accounts. These threats have arisen from external parties, as well as insiders who knowingly or unknowingly engage in or enable malicious cyber activities. There are a number of motivations for cyber threat actors, including criminal activities such as fraud, identity theft and ransom, corporate or nation-state espionage, political agendas, public embarrassment with the intent to cause financial or reputational harm, intent to disrupt information technology systems and supply chains, and to expose and exploit potential security and privacy vulnerabilities in corporate systems and websites. Cyber threat actors, including state-sponsored and nation state actors, have rapidly evolved their techniques and increasingly utilize advanced capabilities, including the integration of advanced forms of artificial intelligence and other new technology, which can increase the efficacy, severity, frequency and ease of execution of cyberattacks.
Our and our partners' networks and systems are subject to constant attempts to disrupt business operations and capture, destroy, manipulate or expose various types of information relating to corporate trade secrets, customer information (including Card Member, travel and loyalty program data), colleague information and other sensitive business information (including acquisition activity, non-public financial results and intellectual property). For example, we and other U.S. financial services providers have been the target of attacks, such as denial of service attacks, social engineering and the impersonation of current or prospective employees and contractors. We develop and maintain systems and processes aimed at detecting and preventing information security and cybersecurity incidents and fraudulent activity, including our cyber crisis response procedures, which require significant investment, maintenance and ongoing monitoring and updating as technologies and regulatory requirements change, new vulnerabilities and exploits are discovered and as efforts to overcome security measures become more sophisticated.
Despite our efforts and the efforts of third parties that process, transmit or store our data and data of our customers and colleagues or support our operations, such as service providers, merchants and regulators, the possibility of information, operational and cybersecurity incidents, malicious social engineering, password mismanagement, corporate espionage, fraudulent or other malicious activities and human error or malfeasance cannot be eliminated entirely and will evolve as new and emerging technology is deployed by threat actors, including the use of artificial intelligence and quantum computing, and we increasingly use platforms that are outside of our network and control environments. For example, we are aware that certain of our third-party service providers and joint ventures have been the victims of ransomware and other cyberattacks, in some instances that affected our data or services provided to us. In addition, recently introduced products and services, such as checking accounts and non-card lending, may lead to an increase in the number or types of cyberattacks and our exposure to fraud and other malfeasance. Risks associated with such incidents and activities include theft of funds and other monetary loss, disruption of our operations and the unauthorized disclosure, release, gathering, monitoring, misuse, modification, loss or destruction of confidential, proprietary, trade secret or other information (including account data information). An incident may not be detected until well after it occurs and the severity and potential impact may not be fully known for a substantial period of time after it has been discovered. We are subject to varied cybersecurity regulations and incident reporting requirements, which could require us to disclose incidents that may not have been resolved or fully investigated at the time of disclosure, leading to customer confusion, regulatory scrutiny and negative publicity and exacerbating risks related to the incident itself. Our ability to address incidents may also depend on the timing and nature of assistance that may be provided from relevant governmental or law enforcement agencies.
Information, operational or cybersecurity incidents, fraudulent activity and other actual or perceived failures to maintain confidentiality, integrity, availability of services and data, privacy and/or security has led to increased regulatory scrutiny and may lead to regulatory investigations and intervention (such as mandatory card reissuance), consent decrees, increased litigation (including class action litigation), response costs (including notification and remediation costs), fines, negative assessments of us and our subsidiaries by banking regulators and rating agencies, reputational and financial damage to our brand, negative impacts to our partner relationships, and reduced usage of our products and services, all of which could have a material adverse impact on our business. The disclosure of sensitive company information could also undermine our competitive advantage and divert management attention and resources.
Successful cyberattacks, data breaches, disruptions or other incidents related to the actual or perceived failures to maintain confidentiality, integrity, availability of services and data, privacy and/or security at other large financial institutions, large retailers, travel and hospitality companies, government agencies or other market participants, whether or not we are impacted, could lead to a general loss of customer confidence that could negatively affect us, including harming the market perception of the effectiveness of our security measures or harming the reputation of the financial system in general, which could result in reduced use of our products and services. Such events could also result in legislation and additional regulatory requirements. Although we maintain cyber insurance, there can be no assurance that liabilities or losses we may incur will be covered under such policies or that the amount of insurance will be adequate.