We are dependent on information technology ("IT") systems and networks for a significant portion of our direct-to-consumer sales, including our e-commerce sites and retail business credit card transaction authorization and processing. We are responsible for storing data relating to our customers and employees and also rely on third-party vendors for the storage, processing and transmission of personal and Company information. Consumers, lawmakers and consumer advocates alike are increasingly concerned over the security of personal information transmitted over the Internet, consumer identity theft and privacy and the retail industry, in particular, has been the target of many recent cyber-attacks. In addition to taking the necessary precautions ourselves, we generally require that third-party service providers implement reasonable security measures to protect our employees' and customers' identity and privacy. We do not, however, control these third-party service providers and cannot guarantee the elimination of electronic or physical computer break-ins or security breaches in the future. Cyber security breaches, including physical or electronic break-ins, security breaches due to employee error or misconduct, attacks by "hackers," phishing scams, malicious software programs such as viruses and malware, and other breaches outside of our control, could result in unauthorized access or damage to our IT systems and the IT systems of our third-party service providers. Despite our efforts and the efforts of our third-party service providers to secure our and their IT systems, attacks on these systems do occur from time to time. As the techniques used to obtain unauthorized access to IT systems become more varied and sophisticated (as cybercriminals are finding new ways to launch their attacks) and if the occurrence of such security breaches becomes more frequent, we and our third-party service providers may be unable to adequately anticipate these techniques and implement appropriate preventative measures. While we maintain cyber risk insurance to provide some coverage for certain risks associated with cyber security incidents, there is no assurance that such insurance would cover all or a significant portion of the costs or consequences associated with a cyber security incident. A significant breach of customer, employee or Company data could damage our reputation, our relationship with customers and our brands, and could result in lost sales, sizable fines, significant breach-notifications and other costs and lawsuits, as well as adversely affect our results of operations.
Additionally, we may incur increased costs and experience a significant strain on our resources to account for implementation of additional required security measures and technologies to protect personal data and confidential information or to comply with current and new state, federal and international laws governing the unauthorized disclosure of confidential information which are continuously being enacted and proposed, such as the General Data Protection Regulation ("GDPR") in the EU and the UK, various consumer privacy and data privacy and protection acts in the United States, including, but not limited to, the American Data Privacy and Protection Act, the California Consumer Privacy Act as amended by the California Privacy Rights Act, the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Utah Consumer Privacy Act, the Connecticut Data Privacy Act, the Iowa Consumer Data Protection Act, the Montana Consumer Data Privacy Act, the Oregon Consumer Privacy Act, the Washington MY Health My Data Act, the Florida Digital Bill of Rights, the Texas Data Privacy and Security Act and the Personal Information Protection Law in China.
Lastly, increased scrutiny by federal regulators (such as the FTC) and state attorney generals focused on the retail industry may lead to increased privacy and cyber security costs such as organizational changes, deploying additional personnel, acquiring and implementing enhanced privacy and security technologies on e-commerce sites, mandatory employee training for those handling customer and employee personal data, and engaging third-party experts and consultants, and the unauthorized use of proprietary information may lead to lost revenues.