We rely heavily on internal and outsourced technologies, communications, and information systems to conduct our business. Additionally, in the normal course of business, we collect, process and retain sensitive and confidential information regarding our customers. As our reliance on technology has increased, so have the potential risks of a technology–related operational interruption (such as disruptions in our customer relationship management, general ledger, deposit, loan, or other systems) or the occurrence of cyber–attacks (such as unauthorized access to our systems, computer viruses, ransom ware, or other malicious code). These risks have increased for all financial institutions as new technologies, advancement consumer applications and the increase adoption of mobile devices, have become commonly used to conduct financial and other business transactions, during a time of increased technological sophistication of organized crime, perpetrators of fraud, hackers, terrorists and others. In addition to cyber–attacks or other security breaches involving the theft of sensitive and confidential information, hackers recently have engaged in attacks against large financial institutions, particularly denial of service attacks, which are designed to disrupt key business services, such as customer–facing web sites. Although we have programs in place related to business continuity, disaster recovery and information security to maintain the confidentiality, integrity, and availability of our systems, business applications and customer information, we are not able to anticipate or implement effective preventive measures against all cyber–security threats, especially because the techniques used change frequently and because attacks can originate from a wide variety of sources, both domestic and foreign.
We also face risks related to cyber–attacks and other security breaches in connection with credit card and debit card transactions that typically involve the transmission of sensitive information regarding our customers through various third parties, including merchant acquiring banks, payment processors, payment card networks and our processors. Some of these parties have in the past been the target of security breaches and cyber–attacks, and because the transactions involve third parties and environments such as the point of sale that we do not control or secure, future security breaches or cyber–attacks affecting any of these third parties could impact us through no fault of our own, and in some cases, we may have exposure and suffer losses for breaches or attacks relating to them. Further cyber–attacks or other breaches in the future, whether affecting us or others, could intensify consumer concern and regulatory focus and result in reduced use of payment cards and increased costs, all of which could have a material adverse effect on our business.
To the extent we are involved in any future cyber–attacks or other breaches, we may be required to expend significant additional resources to modify our protective measures or to investigate and remediate vulnerabilities or other exposures, and we may be subject to litigation and financial losses that are either not insured against or not fully covered through any insurance we maintain. We could also suffer significant damage to our reputation. Although we are insured against many of these risks, including privacy breach response costs, notification expenses, breach support and credit monitoring expenses, cyber extortion and cyber terrorism, there can be no assurances that such insurance will be sufficient to cover all costs arising from a data or information technology breach and our exposure may exceed our coverage.