Our business involves the collection, storage, processing and transmission of confidential information, customer, employee, service provider and other personal data, as well as information required to access customer assets. Any actual or perceived security breach of our or our third-party partners may:
- harm our reputation and brand; - result in our systems or services being unavailable and interrupt our operations; - result in improper disclosure of data and violations of applicable privacy and other laws; - result in significant regulatory scrutiny, investigations, fines, penalties, and other legal, regulatory and financial exposure; - cause us to incur significant remediation costs; - lead to theft or irretrievable loss of our or our customers' assets; - reduce customer confidence in, or decreased use of, our products and services; - divert the attention of management from the operation of our business; - result in significant compensation or contractual penalties from us to our customers or third parties as a result of losses to them or claims by them; and - adversely affect our business and operating results.
Further, any actual or perceived breach or cybersecurity attack directed at other similar institutions, whether or not we are directly impacted, could lead to a general loss of customer confidence in the use of our technology, which could negatively impact us including the market perception of the effectiveness of our security measures and technology infrastructure.
An increasing number of organizations, including large businesses, technology companies and financial institutions, as well as government institutions, have disclosed breaches of their information security systems, some of which have involved sophisticated and highly targeted attacks, including on their websites, mobile applications, and infrastructure. Attacks upon systems across a variety of industries are increasing in their frequency, persistence, and sophistication, and, in many cases, are being conducted by sophisticated, well-funded, and organized groups and individuals, including state actors. The techniques used to obtain unauthorized, improper, or illegal access to systems and information (including customers' personal data and digital assets), disable or degrade services, or sabotage systems are constantly evolving, may be difficult to detect quickly, and often are not recognized or detected until after they have been launched against a target. These attacks may occur on our systems or those of its third-party service providers or partners. Certain types of cyberattacks could harm us even if our systems are left undisturbed. For example, attacks may be designed to deceive employees and service providers into releasing control of our systems to a hacker, while others may aim to introduce computer viruses or malware into our systems with a view to stealing confidential or proprietary data. Additionally, certain threats are designed to remain dormant or undetectable until launched against a target and we may not be able to implement adequate preventative measures.
Although we do not have a past history of material security breaches or cyberattacks, and do not believe we are a target of such breaches or attacks, we have developed systems and processes designed to protect the data we manage, prevent data loss and other security breaches, and effectively respond to known and potential risks. We expect to continue to expend significant resources to bolster these protections, but there can be no assurance that these security measures will provide absolute security or prevent breaches or attacks. Threats can come from a variety of sources, including criminal hackers, hacktivists, state-sponsored intrusions, industrial espionage, and insiders. Certain threat actors may be supported by significant financial and technological resources, making them even more sophisticated and difficult to detect. As a result, our costs and the resources it devotes to protecting against these advanced threats and their consequences may increase over time.
Although we maintain insurance coverage that we believe is adequate for our business, it may be insufficient to protect us against all losses and costs stemming from security breaches, cyberattacks, and other types of unlawful activity, or any resulting disruptions from such events. Outages and disruptions of our systems, including any caused by cyberattacks, may harm our reputation and our business, operating results, and financial condition.