Our business requires the collection and retention of large volumes of data about our customers, employees, suppliers and business partners, including customer credit card numbers and other personally identifiable information of our customers and employees, in various information systems that we maintain and in those maintained by third-party service providers. The integrity and protection of that data is important to our business and is subject to privacy laws enacted by various jurisdictions. The regulatory environment and the requirements imposed on us by the payment card industry surrounding information, security and privacy are evolving and may be inconsistent. Our systems may be unable to meet changing regulatory and payment card industry requirements and employee and customer expectations, or may require significant additional investments or time in order to do so. Our information systems and records, including those maintained by service providers, may be subject to cyber-attacks, security breaches, system failures, viruses, operator error or inadvertent releases of data. Any perceived or actual electronic or physical security breach involving the misappropriation, loss, or other unauthorized disclosure of confidential or personally identifiable information, including penetration of our network security, whether by us or by a third party, could disrupt our business, damage our reputation and our relationships with our customers or employees, expose us to risks of litigation, significant fines and penalties and liability, result in the deterioration of our customers' and employees' confidence in us, and adversely affect our business, results of operations and financial condition.
Cyber-attacks and security breaches may include, but are not limited to, attempts to access information, including customer and company information, computer malware such as viruses, denial of service, ransomware attacks that encrypt,exfiltrate, or otherwise render data unusable or unavailable in an effort to extort money or other consideration as a condition to purportedly returning the data to a usable form, operator errors or misuse, or inadvertent releases of data, and other forms of electronic security breaches. The techniques and sophistication used to conduct cyberattacks and compromise information technology infrastructure, as well as the sources and targets of these attacks, change and are often not recognized until such attacks are launched or have been in place for some time. In addition, there has been an increase in state sponsored cyberattacks which are often conducted by capable, well-funded groups. The rapid evolution and increased adoption of artificial intelligence technologies amplifies these concerns. The steps we have taken to mitigate these risks may not be sufficient and a significant theft, loss or fraudulent use of customer, employee or company data maintained by us or by a service provider could have an adverse effect on our reputation and employee relationships and could result in remedial and other expenses, fines or litigation. A breach in the security of our information systems or those of our service providers could lead to an interruption in the operation of our systems or loss, disclosure or misappropriation of our business information or other unintended consequences. If any of these risks materialize, they could have an adverse effect on our business, results of operations and cash flows.