We rely heavily on communications and information systems to conduct our business and maintain the security of confidential information and complex transactions, which subjects us to an increasing risk of cyber incidents from these activities due to a combination of new technologies and the increasing use of the Internet to conduct financial transactions, as well as a potential failure, interruption or breach in the security of these systems, including those that could result from attacks or planned changes, upgrades and maintenance of these systems. Such cyber incidents could result in failures or disruptions in our customer relationship management, securities trading, general ledger, deposits, computer systems, electronic underwriting servicing or loan origination systems; or unauthorized disclosure of confidential and non-public information maintained within our systems. We also utilize relationships with third parties to aid in a significant portion of our information systems, communications, data management and transaction processing. These third parties with which we do business may also be sources of cybersecurity or other technological risks, including operational errors, system interruptions or breaches, unauthorized disclosure of confidential information and misuse of intellectual property, and have experienced cyber attacks. If our third-party service providers encounter any of these issues, we could be exposed to disruption of service, reputation damages, and litigation risk, any of which could have a material adverse effect on our business.
During the second quarter in 2023, a third-party vendor of the Bank confirmed that data specific to the Bank's customers was likely obtained in a security incident targeting the vendor's instance of the MOVEit Transfer Application. As a result of this, an unauthorized party likely obtained information in the vendor's possession about substantially all of the Bank's customers, including social security numbers and account numbers. Hilltop Securities was notified by the same vendor that certain of its data was also likely obtained in the incident; however, based on the review conducted to date, we do not have indication that protected or confidential information was present within the information obtained related to Hilltop Securities. Given the widespread use of the MOVEit Transfer Application, additional vendors of ours may have been impacted. We have incurred, and may continue to incur, expenses related to this incident, and we remain subject to risks and uncertainties as a result of the incident, including litigation and additional regulatory scrutiny.
The continued occurrence of cybersecurity incidents across a range of industries has resulted in increased legislative and regulatory scrutiny over cybersecurity and calls for additional data privacy laws and regulations at both the state and federal levels. For example, in 2018, the State of California adopted the California Consumer Privacy Act of 2018, which imposes requirements on companies operating in California and provides consumers with a private right of action if covered companies suffer a data breach related to their failure to implement reasonable security measures. These laws and regulations could result in increased operating expenses or increase our exposure to the risk of litigation or regulatory inquiries or proceedings.
Although we devote significant resources to maintain and regularly upgrade our systems and networks to safeguard critical business applications, there is no guarantee that these measures or any other measures can provide absolute security. Our computer systems, software and networks may be adversely affected by cyber incidents such as unauthorized access; loss or destruction of data (including confidential client information); account takeovers; unavailability of service; computer viruses or other malicious code; cyber attacks; and other events. In addition, our protective measures may not promptly detect intrusions, and we may experience losses or incur costs or other damage related to intrusions that go undetected or go undetected for significant periods of time, at levels that adversely affect our financial results or reputation. Further, because the methods used to cause cyber attacks change frequently, or in some cases cannot be recognized until launched, we may be unable to implement preventative measures or proactively address these methods until they are discovered. Cyber threats may derive from human error, fraud or malice on the part of employees or third parties, or may result from accidental technological failure. For example, during the second quarter of 2018, we became the victim of a "spear phishing" attack on one of our employees in which we suffered a $4.0 million wire fraud loss and sensitive customer information was stolen. As a result of this attack, we incurred costs to provide identity protection services, including credit monitoring, to customers who may have been impacted and other legal and professional services, and may also incur expenses in the future including legal and professional expenses and claims for damages. Additional challenges are posed by external extremist parties, including foreign state actors, in some circumstances, as a means to promote political ends. If one or more of these events occurs, it could result in the disclosure of confidential client or customer information, damage to our reputation with our clients, customers and the market, customer dissatisfaction, additional costs such as repairing systems or adding new personnel or protection technologies, regulatory penalties, fines, remediation costs, exposure to litigation and other financial losses to both us and our clients and customers. Such events could also cause interruptions or malfunctions in our operations. We maintain cyber risk insurance, but this insurance may not be sufficient to cover all of our losses from any future breaches of our systems.
We continue to evaluate our cybersecurity program and will consider incorporating new practices as necessary to meet the expectations of regulatory agencies in light of such cybersecurity guidance and regulatory actions and settlements for cybersecurity-related failures and violations by other industry participants. Such procedures include management-level engagement and corporate governance, risk management and assessment, technical controls, incident response planning, vulnerability testing, vendor management, intrusion detection monitoring, patch management and staff training. Even if we implement these procedures, however, we cannot assure you that we will be fully protected from a cybersecurity incident, the occurrence of which could adversely affect our reputation and financial condition.