We regularly collect, process, transmit and store significant amounts of confidential information regarding our customers, employees and others and concerning our business, operations, plans and strategies. In some cases, this confidential or proprietary information is collected, compiled, processed, transmitted or stored by third parties on our behalf.
Information security risks have generally increased in recent years because of the proliferation of new technologies, the use of the Internet and telecommunications technologies to conduct financial and other transactions and the increased sophistication and activities of perpetrators of cyber-attacks and mobile phishing. Mobile phishing, a means for identity thieves to obtain sensitive personal information through fraudulent e-mail, text or voice mail, is an emerging threat targeting the customers of financial entities. A failure in or breach of our operational or information security systems, or those of our third-party service providers, as a result of cyber-attacks or information security breaches or due to employee error, malfeasance or other disruptions could adversely affect our business, result in the disclosure or misuse of confidential or proprietary information, damage our reputation, increase our costs and/or cause losses.
If this confidential or proprietary information were to be mishandled, misused or lost, we could be exposed to significant regulatory consequences, reputational damage, civil litigation and financial loss.
In recent years, several financial services firms suffered successful cyber-attacks launched both domestically and from abroad, resulting in the disruption of services to clients, loss or misappropriation of sensitive or private information, and reputational harm. Further, information security risks for financial institutions like us are significant in part because of the evolving proliferation of new technologies, the use of the internet, mobile devices, and cloud technologies to conduct financial transactions and the increased sophistication and activities of hackers, terrorists, organized crime and other external parties, including foreign state actors. In addition, our clients often use their own devices, such as computers, smart phones and tablets, to manage their accounts, which may heighten the risk of system failures, interruptions or security breaches. If we fail to continue to upgrade our technology infrastructure and monitor our vendors to ensure effective information security relative to the type, size and complexity of our operations, we could become more vulnerable to cyber-attack and, consequently, subject to significant regulatory penalties.
Although we employ a variety of physical, procedural and technological safeguards to protect this confidential and proprietary information from mishandling, misuse or loss, these safeguards do not provide absolute assurance that mishandling, misuse or loss of the information will not occur, and that if mishandling, misuse or loss of information does occur, those events will be promptly detected and addressed. Similarly, when confidential or proprietary information is collected, compiled, processed, transmitted or stored by third parties on our behalf, our policies and procedures require that the third party agree to maintain the confidentiality of the information, establish and maintain policies and procedures designed to preserve the confidentiality of the information, and permit us to confirm the third party's compliance with the terms of the agreement. However, these safeguards do not provide absolute assurance that mishandling, misuse or loss of the information will not occur, and that if mishandling, misuse or loss of information does occur, those events will be promptly detected and addressed. As information security risks and cyber threats continue to evolve, we may be required to expend additional resources to continue to enhance our information security measures and/or to investigate and remediate any information security vulnerabilities.