The financial services industry as a whole is characterized by rapidly changing technologies and we are dependent on the security and efficacy of our infrastructure, computer and data management systems, as well as those of third parties with whom we interact. In the ordinary course of our business, we receive, process, retain, transmit and store proprietary information and sensitive or confidential data, including certain public and nonpublic personal information concerning employees and borrowers. Additionally, we enter into relationships with third-party vendors to assist with various aspects of our business, some of which require the exchange of personal employee or borrower information.
We and our third-party vendors may not be able to anticipate or implement effective preventive measures against all cybersecurity incidents, such as security breaches or unauthorized access of our information technology systems or the information technology systems of third-party vendors that receive, process, retain and transmit electronic information on our behalf. The techniques used to obtain unauthorized, improper or illegal access to our systems and those of our third-party vendors, our data, our employees' customers' and loan applicants' data or to disable, degrade or sabotage service are constantly evolving, and have become increasingly complex and sophisticated. Furthermore, such techniques change frequently and are often not recognized or detected until after they have been launched and security attacks can originate from a wide variety of sources, including employees or third parties such as computer hackers, persons involved with organized crime or associated with external service providers, or foreign state or foreign state-supported actors. Those parties may also attempt to fraudulently induce employees, customers or other users of our systems to disclose sensitive information in order to gain access to our data or that of our borrowers. These risks may increase in the future as we continue to increase our reliance on the internet and use of web-based product offerings.
Cybersecurity risks have significantly increased in recent years. We and our third-party vendors that collect, store, process, retain and transmit confidential or sensitive information, including borrower personal and transactional data or employee data (including service providers located offshore who conduct support services for us), are vulnerable as targets of unauthorized parties using malicious code and viruses or otherwise attempting to breach the security of our or our vendors' systems and data. We and our third-party vendors have in the past and may in the future experience system disruptions and failures caused by software failure, fire, power loss, telecommunications failures, employee misconduct, human error, unauthorized intrusion, security breaches, acts of vandalism, traditional computer hackers, computer viruses and disabling devices, phishing attacks, malicious or destructive code, denial of service or information, natural disasters, health pandemics and other similar events, which may result in the unauthorized release, gathering, monitoring, misuse, loss or destruction of confidential, proprietary or other sensitive information of ours, our employees or customers, and otherwise interrupt or delay our ability to provide services to our customers. For example, we experienced a cybersecurity incident in January 2024 that resulted from unauthorized access to our systems (as described further in Item 1C. Cybersecurity) (the "Cybersecurity Incident"). Developments in technological capabilities and the implementation of technology changes or upgrades could also result in a compromise or breach of the technology that we use to protect our employees' and customers' personal information and transaction data. Although we have established, and continue to establish on an ongoing basis, defenses to identify and mitigate cybersecurity incidents, any loss, unauthorized access to, or misuse of confidential or personal information could disrupt our operations, damage our reputation, increased costs to prevent, respond to, or mitigate cybersecurity incidents, and expose us to claims from customers, financial institutions, regulators, employees and other persons, any of which could have an adverse effect on our business, financial condition and results of operations. Any of the foregoing may be exacerbated by a delay or failure to detect a cybersecurity incident or the full extent of such incident. Further, the continuing and evolving nature of cybersecurity incidents has resulted in increased regulatory focus on prevention. To the extent we face increased regulatory requirements related to cybersecurity, we may be required to expend significant additional resources to meet such requirements.
A successful penetration, compromise, breach or circumvention of the security of our or our third-party vendors' information technology systems through electronic, physical or other means, or a defect in the integrity of our or our third-party vendors' systems or cybersecurity has in the past and could in the future have a material negative impact on our business, including through significant disruption of our operations, misappropriation of our proprietary, confidential or sensitive information, including personal information of our borrowers or employees, damage to our computers or operating systems and to those of our borrowers and counterparties, and subject us to significant costs, litigation, disputes, reporting obligations, regulatory action, investigation, fines, penalties, remediation costs, damages and other liabilities. In addition, our remediation efforts may not be successful and we may not have adequate insurance to cover these losses. Any of the foregoing events could result in violations of applicable privacy and other laws, financial loss to us or to our borrowers, loss of confidence in our security measures, customer dissatisfaction, significant litigation exposure and harm to our reputation, and diversion of management attention, all of which could materially adversely affect our business, financial condition and results of operations.