Operating our business requires the collection, use, storage, retention, adaptation, alteration, processing, disclosure, transfer, transmission, and protection ("Processing") of large volumes of personal information (which may also be referred to as "personal data" or "personally identifiable information") of guests, Team Members, and others, and other sensitive, proprietary, and confidential information, including credit and debit card numbers. Our reliance on technology has grown as we have grown, and the scope and severity of risks posed to our systems from compromises to our information technology systems and cyber threats has increased in part due to the continued evolution and sophistication of attacks as well as the legal and regulatory framework pertaining to privacy and data security matters.
From time to time, we have been, and likely will continue to be, the target of attempts to compromise our information technology systems and data, such as credential stuffing, distributed denial-of-service attacks, ransomware, viruses, malware, phishing attacks, break-ins, social engineering, security breaches, or other cybersecurity incidents to our data, network, or systems. In addition, if any of our critical suppliers or distributors is the subject of a cyber or ransomware attack, we could experience a significant disruption in our supply chain and possibly shortages of key ingredients. The techniques and sophistication used to conduct cyber-attacks and breaches of information technology systems, as well as the sources and targets of these attacks, change frequently and are often not recognized until such attacks are launched or have been ongoing for a period of time. While we continue to make significant investment in physical and technological security measures, Team Member training, and third-party services designed to anticipate cyber-attacks and prevent breaches, our information technology networks and infrastructure, and those of third parties with which we have business relationships, could be vulnerable to damage, disruptions, shutdowns, or breaches of personal or confidential information. Efforts to hack or breach security measures, failures of systems or software to operate as designed or intended, viruses, operator error, or inadvertent releases of data all threaten our and our business partners' information systems and records. Due to these scenarios, we cannot provide assurance that we will be successful in adequately responding to, or preventing, such breaches or data loss.
Any intentional attack or an unintentional event that results in unauthorized access to systems to disrupt operations, corrupt data, or steal or expose intellectual property, personal or confidential information of our guests, Team Members, or ourselves could result in widespread negative publicity, damage to our reputation, a loss of guests, disruption of our business, and/or legal liabilities, resulting in operational inefficiencies and a loss of sales.
The majority of our restaurant sales are paid with credit or debit cards, but we accept certain other payment methods such as Apple Pay and gift cards, and we may offer new payment options in the future. The use of these payment options subjects us to rules, regulations, contractual obligations, and compliance requirements, including payment network rules and operating guidelines, data security standards and certification requirements, and rules governing electronic funds transfers. These requirements and related interpretations may change over time, which has made and could continue to make compliance more difficult or costly. In connection with credit or debit card transactions, we collect and transmit confidential information, including payment information, to card processors. The systems currently used for transmission and approval of electronic payment transactions, and the technology utilized in electronic payments themselves, all of which can put electronic payment at risk, are determined and controlled by the payment card industry, not by us, through enforcement of compliance with the Payment Card Industry - Data Security Standards (as modified from time to time, "PCI DSS"). We must abide by the PCI DSS in order to accept electronic payment transactions. If we fail to abide by the PCI DSS, we could be subject to fines, penalties, or litigation, which could adversely affect our results of operations. Furthermore, the payment card industry requires vendors to be compatible with smart chip technology for payment cards ("EMV-Compliant"), or else bear full responsibility for certain fraud losses, referred to as the EMV Liability Shift. To become EMV-Compliant, merchants often utilize EMV-Compliant payment card terminals at the point-of-sale and obtain a variety of certifications. We may become subject to claims for purportedly fraudulent transactions arising out of the actual or alleged theft, whether physical or electronic, of credit, debit, or gift card information, and we may also be subject to lawsuits or other proceedings relating to these types of incidents.