We collect and store confidential, personal information relating to our customers for various business purposes, including marketing and financial purposes, and credit card information for processing payments. For example, we handle, collect and store personal information in connection with our customers staying at our hotels and enrolling in Caesars Rewards. We may share this personal and confidential information with vendors or other third parties in connection with processing of transactions, operating certain aspects of our business, or for marketing purposes. Our collection and use of personal data are governed by state and federal privacy laws and regulations as well as the applicable laws and regulations in other countries in which we operate. Privacy law is subject to frequent changes and varies significantly by jurisdiction. We may incur significant costs in order to ensure compliance with the various applicable privacy requirements. In addition, privacy laws and regulations may limit our ability to market to our customers.
We assess and monitor the security of collection, storage, and transmission of customer information on an ongoing basis, including utilizing commercially available software and technologies to monitor, assess and secure our network. Further, some of the systems currently used for transmission and approval of payment card transactions and the technology utilized in payment cards themselves, all of which can put payment card data at risk, are determined and controlled by the payment card industry, and other such systems are determined and controlled by us. Although we had taken steps designed to safeguard our customers' confidential personal information and important internal company data, on September 14, 2023, we announced that we identified suspicious activity in our information technology network resulting from a social engineering attack on one of our outsourced IT support vendors and that we determined that the unauthorized actor acquired a copy of, among other data, our loyalty program database, which includes driver's license numbers and/or social security numbers for a significant number of members in the database (the "Data Incident"). We took steps to ensure that the stolen data was deleted by the unauthorized actor and are working with industry-leading third-party IT advisors, to harden our systems and implement corrective measures to protect against future attacks that could pose a threat to our systems. We have also taken steps to require that the specific outsourced IT support vendor involved in this matter implemented corrective measures to protect against future attacks that could pose a threat to our systems. While we took these actions, we cannot assure that the stolen data was deleted by the unauthorized actor or that our network and other systems and those of third parties, such as service providers, will not be compromised, damaged, or disrupted by a third-party breach of our system security or that of a third-party provider or as a result of purposeful or accidental actions of third parties, our employees, or those employees of a third party, power outages, computer viruses, system failures, natural disasters, or other catastrophic events in the future. Our third-party information system service providers face risks relating to cybersecurity similar to ours, and we do not directly control any of such parties' information security operations. As an example, the Data Incident arose from a social engineering attack on one of our outsourced IT vendors. Advances in computer and software capabilities, encryption technology, new tools, and other developments may increase the risk of a future security breach. As a result of the Data Incident, customer information and other data was accessed by an unauthorized actor. Any future security breach may also result in customer information or other proprietary data being accessed or transmitted by or to a third party. Despite the measures we have implemented to safeguard our information, including actions taken following the Data Incident, there can be no assurance that we are adequately protecting our information.
As a result of the Data Incident, we have become subject to multiple lawsuits and inquiries from state regulators and we may become subject to additional lawsuits, claims and inquiries related to the Data Incident. While the Data Incident did not impact our customer-facing operations, we are unable to predict the full impact of the Data Incident, including any regulatory effects or changes in guest behavior in the future, including whether a change in our guests' behavior could negatively impact our financial condition and results of operations on an ongoing basis.
We have cybersecurity insurance to respond to a breach which is designed to cover expenses associated with a cybersecurity incident, including costs related to notification, credit monitoring, investigation, crisis management, public relations and legal advice. We also carry other insurance which may cover ancillary aspects of cybersecurity events. While we have submitted claims for insurance coverage relating to the costs incurred as a result of the Data Incident, we are not certain of the extent to which such coverage or third-party indemnification will cover of such future costs.
Any future data security breaches giving rise to a loss, disclosure of, misappropriation of, or access to customers' or other proprietary information or other breach of our information security could result in additional legal claims or legal proceedings, including regulatory investigations and actions, or liability for failure to comply with privacy and information security laws, including for failure to protect personal information or for misusing personal information could damage our reputation, and expose us to additional claims from customers, financial institutions, regulators, payment card associations, employees, and other persons, any of which could have an adverse effect on our financial condition, results of operations, and cash flow. Any such damages and claims arising from a future breach may not be completely covered or may exceed the amount of any insurance available.