Our highly automated and networked organization is subject to cyber-terrorism and a variety of other cyber-security threats. These threats come in a variety of forms, such as viruses and malicious software. Such threats can be difficult to prevent or detect, and if experienced, could interrupt or damage our operations, harm our reputation or have a material effect on our operations. Our technology and telecommunications systems are highly integrated and connected with other networks. Cyber-attacks involving these systems could be carried out remotely and from multiple sources and could interrupt, damage or otherwise adversely affect the operations of these critical systems. Cyber-attacks could result in the modification or theft of data, the distribution of false information or the denial of service to users. The risks of cyber-attacks could be exacerbated by geopolitical tensions, including hostile actions taken by nation-states and terrorist organizations. We obtain, utilize and maintain data concerning individuals and organizations with which we have a business relationship. Threats to data security can emerge from a variety of sources and change in rapid fashion, resulting in the ongoing need to expend resources to secure our data in accordance with customer expectations and statutory and regulatory requirements.
Our businesses must comply with regulations to control the privacy of customer, employee and third-party data, and state, federal and international regulations regarding data privacy, are becoming increasingly more onerous. A misuse or mishandling of confidential or proprietary information could result in legal liability, regulatory action and reputational harm. We could be subject to liability if confidential customer information is misappropriated from our technology systems. Despite the implementation of security measures, these systems may be vulnerable to physical break-ins, computer viruses, programming errors, attacks by third parties or similar disruptive problems. Any well-publicized compromise of security could deter people from entering into transactions that involve transmitting confidential information to our systems, which could have a material adverse effect on our business and reputation. We rely on services and products provided by many vendors. In the event that one or more of our vendors fails to protect personal information of our customers, claimants or employees, we may incur operational impairments, or could be exposed to litigation, compliance costs or reputational damage. We maintain cyber-liability insurance coverage to offset certain potential losses, subject to policy limits, such as liability to others, costs of related crisis management, data extortion, applicable forensics and certain regulatory defense costs, fines and penalties.
While, to date, we are not aware of having experienced a material breach of our cyber security systems,administrative, internal accounting and technical controls as well as other preventive actions may be insufficient to prevent physical and electronic break-ins, denial of service, cyber-attacks, business email compromises, ransomware or other security breaches to our systems or those of third parties with whom we do business.
We believe that we have established and implemented appropriate security measures to provide reasonable assurance that our information technology systems are secure and appropriate controls and procedures to enable us to identify and respond to unauthorized access to such systems. While we have not experienced material cyber-incidents to date, the occurrence and effects of cyber-incidents may remain undetected for an extended period. We periodically engage third parties to evaluate and test the adequacy of our security measures, controls and procedures. Despite these security measures, controls and procedures, disruptions to and breaches of our information technology systems are possible.