Our third-party hotel managers are dependent on information technology networks and systems, including the internet, to access, process, transmit and store proprietary and customer information. These complex networks include reservation systems, vacation exchange systems, hotel management systems, customer databases, call centers, administrative systems, and third-party vendor systems. These systems require the collection and retention of large volumes of personally identifiable information of hotel guests, including credit card numbers and passport numbers. Our hotel managers may store and process such customer information as well as proprietary information both on systems located at the hotels that we own and other hotels that they operate and manage, their corporate locations and at third-party owned facilities, including, for example, in a third-party hosted cloud environment. These information networks and systems are vulnerable to numerous and evolving cybersecurity risks that threaten the confidentiality, integrity and availability of systems and information such as system, network or internet failures; computer hacking or operational disruption (e.g., due to ransomware); cyber-terrorism; viruses, worms or other malicious software programs; social engineering (e.g., phishing); employee error, negligence, malfeasance or fraud; and misconfigurations, "bugs" or other vulnerabilities in software and hardware.
These threats can be introduced in any number of ways, including through third parties accessing our hotel managers' information networks and systems or by exploiting vulnerabilities in third-party software, technologies, tools, services or systems. The risks from these cyber threats are significant. Marriott International, the manager of a majority of our hotels, experienced a material data security breach involving the unauthorized access to the Starwood guest reservation database between 2014 and 2018. The UK Information Commissioner's Office has fined Marriott £18.4 million, and Marriott remains subject to other lawsuits and investigations arising around the world. Marriott has also experienced other, lesser data breaches since 2018 as well. No assurances can be made as to the outcome of these data breach lawsuits or investigations.
We rely on the security systems of our managers to maintain hotel operations and to protect proprietary and hotel customer information. Any compromise of our managers' or their critical third-party networks could result in a disruption to our managers' operations, such as the disruption in fulfilling guest reservations, delayed bookings or sales, lost guest reservations, or compromises to information. Any of these events could, in turn, result in disruption of the operations of the hotels that we own that are managed by them, increased costs (e.g., to comply with regulatory requirements or to remediate systems), potential litigation (including class actions), and regulatory enforcement and liability. All our major hotel management companies and a majority of our third-party operators maintain insurance against cyber threats. However, these policies provide varying limits and may be subject to sub-limits for certain types of claims, and it is not expected that these policies will provide a total recovery of all potential losses. In addition, public disclosure, or loss of customer or proprietary information, such as disclosed by Marriott in November 2018, may result in damage to the manager's reputation and a loss of confidence among hotel guests and result in reputational harm for the hotels owned by us and managed by them, which may have a material adverse effect on our future business, financial condition and results of operations.
In addition to the information technologies and systems of our managers used to operate our hotels, we have our own corporate technologies and systems that are used to access, store, transmit, and manage or support a variety of our business processes and proprietary information. There can be no assurance that the security measures we, our managers or third-party providers have taken to protect systems and information will be fully implemented, complied with or effective in detecting or preventing failures, inadequacies or interruptions in system services or that system security will not be breached through physical or electronic break-ins, computer viruses, and attacks by hackers or insiders. This is particularly so because cyberattack methodologies change frequently or are often not recognized until launched. We, our managers and third-party providers may be unable to identify, investigate or remediate cyber events or incidents because attackers are increasingly using sophisticated techniques and tools (including artificial intelligence and machine learning) that can avoid detection, circumvent security controls, and even remove or obfuscate forensic evidence. Further, any adoption of artificial intelligence by us or by third parties may pose new security challenges.
Disruptions in service, system shutdowns and security breaches in the information technologies and systems we, our managers or third-party providers maintain, including unauthorized access to or disclosure of confidential information, could have a material adverse effect on our business or financial reporting, subject us to liability claims or regulatory penalties, which amounts could be significant as the White House, SEC, and other regulators have increased their focus on companies' cybersecurity vulnerabilities and risks, and increase the costs of compliance and remediation. We currently maintain cyber insurance, which includes coverage for third-party liability (damages and settlements to third parties) and first-party loss (costs incurred by us in response to a network security or privacy event). However, as with our operator's coverage, our policy is subject to limits and sub-limits for certain types of claims and we do not expect that this policy will cover all the losses that we could experience from these exposures.
In addition, data privacy and cybersecurity rules, regulations and industry standards are rapidly evolving. Evolving U.S. privacy and security laws, such as the California Consumer Privacy Act and similar laws being enacted or already in force in other states, are imposing significant requirements on companies and, in the California Consumer Privacy Act's case, providing a private right of action with statutory damages available to plaintiffs for certain types of data breaches. Failure to comply with current and future laws, industry standards and other legal obligations or any security incident resulting in operational disruptions and/or the unauthorized access to, or acquisition, release or transfer of personal information may result in governmental enforcement actions, litigation, fines and penalties and adverse publicity and could cause a material adverse effect on both the managers of our hotels and our business and results of operations. We and our managers also may be required to invest significant resources to comply with regulatory requirements, to enhance our information security controls, and to investigate and remediate any security vulnerabilities.