Jack Henry & Associates (JKHY) Risk Factors

Our business relies upon receiving, processing, storing, and transmitting sensitive information relating to our operations, associates, and clients. If we fail to maintain a sufficient digital security infrastructure, address security vulnerabilities and new threats, or deploy adequate technologies to secure our systems against attack, we may be subject to security breaches that compromise confidential information, adversely affect our ability to operate our business, damage our reputation and business, adversely affect our results of operations and financial condition, and expose us to liability. We rely on third parties for various business purposes, and these third parties face similar security risks. A security failure by one of these third parties could expose our data or subject our information systems to interruption of operations and security vulnerabilities. Our information systems rely on hardware, software, and other technological elements, whether developed in-house or provided by third parties, that occasionally need to be patched or updated to address existing or potential security vulnerabilities. If these vulnerabilities are not remediated in a timely manner, our systems and data may be at risk of compromise or interruption. Our services and infrastructure are increasingly reliant on the internet. Computer networks and the internet are vulnerable to disruptive problems such as denial of service attacks or other cyber-attacks carried out by cyber criminals or state-sponsored actors. We anticipate that unauthorized parties will continue to attempt to obtain access to confidential information or to destroy data, often through the introduction of computer viruses, ransomware or malware, cyber-attacks, and other means, which are constantly evolving and at times difficult to detect. Those same parties may also attempt to fraudulently induce associates, clients, vendors, or other users of our systems through phishing schemes or other social engineering methods to disclose sensitive information to gain access to our data or that of our clients or their customer/members. Any such coordinated attacks, if successful, can lead to data loss and exfiltration, disruption to systems and services, and damage to our reputation as a secure financial technology company. We are also subject to the risk that our associates may intercept and transmit unauthorized confidential or proprietary information or that corporate-owned computers used by associates are stolen, or client data media is lost in shipment. An interception, misuse, or mishandling of personal, confidential, or proprietary information being sent to or received from a client or third party could result in legal liability, remediation costs, regulatory action, and reputational harm, any of which could adversely affect our results of operations and financial condition. Like other financial institution service providers, we frequently face third-party attempts to discover and exploit system weaknesses or to circumvent our security measures. We anticipate that attempts to attack our systems, services, and infrastructure, and those of our clients, third-party service providers and other vendors, may grow in frequency and sophistication. We cannot be certain that our security controls and infrastructure will be adequate to continue to protect our systems and data and our efforts may not be sufficient to combat all current and future technological risks and threats. Advances in computer capabilities, new discoveries in the field of cryptography, the use of artificial intelligence, or other events or developments may render our security measures inadequate. Security risks may result in liability to our clients or other third parties, damage to our reputation, and may deter financial institutions from purchasing our products. The significant amount of capital and other resources we currently expend to protect against the threat of security breaches may prove insufficient to prevent a breach. We cannot ensure that any limitation-of-liability provisions in our client and user agreements, contracts with third-party vendors, or other contracts are sufficient to protect us from liabilities or damages with respect to claims relating to a security breach or similar matters. The insurance coverage we maintain to address data security risks may be insufficient to cover all types of claims or losses that may arise, and there is no assurance that such insurance coverage will continue to be available to us on economically reasonable terms, or at all. In the event of a security breach, we may need to spend substantial additional capital and resources alleviating problems caused by such breach. Under state, federal, and foreign laws requiring consumer notification of security breaches, the costs to remediate security breaches can be substantial. Addressing security problems may result in interruptions, delays, or cessation of service to users, any of which could harm our business.