Like other technology-based businesses, our platform may be subject to attacks from computer viruses, break-ins, phishing attacks, ransomware attacks, unauthorized use, attempts to overload services with denial-of-service and other attacks. Any attack or disruption could negatively impact our ability to attract new consumers, dealers or customers and could deter current consumers, dealers or customers from using our solutions, or subject us to lawsuits, regulatory fines or other action or liability.
- Availability: We rely on technology systems' availability to deliver services to consumers, dealers, OEMs, employees and partners. If we experience a disruption that results in performance or availability degradation, up to and including the complete shutdown of our sites or mobile applications, revenue could be impacted and consumers, dealers or customers may lose trust and confidence in us, decrease their use of our solutions or stop using our solutions entirely.
- Data Protection (Consumers/Dealers/OEMs): We process, store, share and disclose certain limited personal information and other data provided by consumers, dealers and OEMs, including names, addresses and certain location information used in geo-fencing. Failure to protect consumer or customer data or to provide consumers or customers with appropriate notice of our privacy practices, could negatively impact our reputation and competitive position, and could result in litigation with third parties, and liabilities imposed by U.S. federal and state regulatory agencies or courts. In addition, we could be subject to evolving laws and regulatory standards that impose data use obligations, data breach notification requirements, specific data security obligations, restrictions on solicitation or other consumer privacy-related requirements.
- Data Protection (Internal): We process and store company information that may be considered sensitive or valuable intellectual property in the normal operations of human resources, finance, legal, marketing, software development, product management, mergers and acquisitions and other business functions. Failure to protect sensitive company information or intellectual property may result in loss of competitive advantage, reputation damage, direct and indirect costs and other liabilities. Failure to protect material financial information including financial performance and merger and acquisition data could also subject us to liabilities imposed by U.S. federal and state regulatory agencies or courts.
We rely on, among other security measures, firewalls, anti-malware, intrusion prevention systems, distributed denial-of-service mitigation services, web content filtering, encryption and authentication technology licensed from third parties. We also depend on the security of our networks and partially on the security of our third-party service providers.
Although we believe that our resiliency planning and security controls are appropriate to our exposures to system outages, service interruptions, security incidents and breaches, there is no guarantee that these plans and controls will prevent all such incidents. Techniques used to disable or degrade service or gain unauthorized access to systems or data change frequently and may not be recognized until damage is detected. We maintain cyber risk insurance, but this insurance may not be sufficient to cover all losses from any future disruption, security incident or breach. Despite our resiliency planning and security controls, if our technology systems, or those of our third-party providers, are damaged, breached, interrupted, or cease to function properly for any reason, and, if our resiliency planning and security controls do not effectively resolve the incident on a timely basis, we may suffer interruptions in our ability to manage or conduct business and we may be exposed to reputational, competitive and business harm as well as litigation and regulatory action, which may materially and adversely impact our business, financial condition, or results of operations.