The performance and reliability of Air Wisconsin's, American's, and third-party service providers' technology is critical to Air Wisconsin's ability to compete effectively. Any internal technological error, failure or large-scale external interruption in the information systems, networks, hardware, software and technological infrastructure Air Wisconsin depends on, such as U.S. air traffic control systems, power, telecommunications or the internet (collectively, "IT Systems"), may disrupt Air Wisconsin's internal network, impact its ability to conduct its business and safely operate its flights, lower its utilization of aircraft, and result in increased costs or penalties. Air Wisconsin's IT Systems (including American systems or those provided by third parties) may be vulnerable to a variety of sources of interruption due to events beyond its control, including natural disasters, terrorist attacks, telecommunications or IT System failures, computer viruses, cyber criminals and other security issues.
In addition, Air Wisconsin faces numerous and evolving cybersecurity risks that threaten the security, confidentiality, integrity and availability of its IT Systems, including from diverse threat actors such as state-sponsored organizations, opportunistic hackers and hacktivists, as well as through diverse attack vectors, such as social engineering/phishing, security breaches, malfeasance by insiders, human or technological error, computer viruses, malicious or destructive code, misconfigurations, "bugs" or other vulnerabilities in commercial software that is integrated into Air Wisconsin's, American's, or third-party service providers' IT Systems, products or services, malware (including ransomware) and other attacks, including through fraud or other means of deception. The methods used to obtain unauthorized access, disable or degrade service or attack or sabotage systems are constantly evolving, and threat actors are becoming increasingly sophisticated in using techniques and tools – including artificial intelligence – that circumvent security controls, evade detection and remove forensic evidence. As a result Air Wisconsin may be unable to anticipate or to detect, investigate, remediate or recover from attacks or incidents for long periods of time. Further, Air Wisconsin may not be able to prevent all data breaches, misuses of data or other cybersecurity incidents.
There can be no assurance that our cybersecurity risk management program and processes, including Air Wisconsin's policies, controls or procedures, will be fully implemented, complied with or effective in protecting our IT Systems. Because Air Wisconsin relies on third-party vendors and service providers for functions critical to its business, including information technology infrastructure and services, successful cyberattacks that disrupt or result in unauthorized access to third-party IT Systems can materially impact its operations and financial results. Remote and hybrid working arrangements at Air Wisconsin (and at many third-party service providers) also increase cybersecurity risks due to the challenges associated with managing remote computing assets and security vulnerabilities that are present in many non-corporate and home networks.
Certain Air Wisconsin third-party service providers have experienced cybersecurity incidents, and Air Wisconsin expect such incidents to continue in varying degrees. While to date no incidents have had a material impact on Air Wisconsin's operations or our financial results, we cannot guarantee that material incidents will not occur in the future. Any cybersecurity incident or other adverse impact to the availability, integrity or confidentiality of Air Wisconsin's IT Systems could compromise our ability to operate flights or technology systems, result in legal claims or proceedings, regulatory investigations and enforcement actions, liability or regulatory penalties, disruption to its operations, damage to its reputation, and/or significant incident response, system restoration or remediation and future compliance costs. Any or all of the foregoing could adversely affect our business, results of operations and financial condition.
Laws, regulations and other requirements relating to the privacy, security and handling of information about individuals, and the application and interpretation of those requirements, are constantly evolving. There has been heightened legal and regulatory focus on data privacy and security, including in relation to cybersecurity incidents, and it is possible that new laws or regulations or interpretations may require us to incur significant costs, implement new processes or change our handling of information and business operations. Any failure or perceived failure to comply with laws, regulations and other requirements relating to the privacy, security and handling of information could result in legal claims or proceedings, regulatory investigations or enforcement actions. We could incur significant costs in investigating and defending such claims and, if found liable, pay significant damages or fines or be required to make changes to our business. If any of these events were to occur, our business, results of operations, and financial condition could be materially adversely affected.