Signet is increasingly using mobile devices, social media and other online activities to connect with customers, staff and other stakeholders. Therefore, in the ordinary course of business, Signet relies upon information technology networks and systems, some of which are managed by third parties, to process, transmit and store electronic information, and to manage or support a variety of business processes and activities, including eCommerce sales, supply chain, merchandise distribution, customer invoicing and collection of payments.
Signet also uses information technology systems to record, process and summarize financial information and results of operations for internal reporting purposes and to comply with regulatory financial reporting, legal and tax requirements. Signet collects and stores this financial and other sensitive data, including intellectual property, proprietary business information, the propriety business information of its customers and suppliers, as well as personally identifiable information of Signet's customers and employees, in data centers and on information technology networks. Although we seek to prevent and detect attempts by unauthorized users to gain access to our IT systems, and incur significant costs to do so, our information technology network infrastructure has in the past been and may in the future be vulnerable to attacks by hackers, including state-sponsored organizations with significant financial and technological resources, breaches due to employee error, fraud or malice or other disruptions (including, but not limited to, computer viruses and other malware, denial of service, and ransomware), which may involve a privacy breach requiring us to notify regulators, customers or employees and enlist identity theft protection.
The secure operation of these networks, and the processing and maintenance of this information is critical to Signet's business operations and strategy. Despite security measures and business continuity plans, Signet may not timely anticipate evolving techniques used to effect security breaches that may result in damage, disruptions or shutdowns of Signet's and its third-party vendors' networks and infrastructure due to attacks by hackers, including phishing or other cyber-attacks, or breaches due to employee error or malfeasance, or other non-hostile disruptions during the process of upgrading or replacing computer software or hardware, power outages, computer viruses, telecommunication or utility failures or natural disasters or other catastrophic events. The occurrence of any of these events could compromise Signet's or the third-party's networks and the information stored there, including personal, proprietary or confidential information about Signet, its customers or its third-party vendors, and personally identifiable information of Signet's customers and employees could be accessed, manipulated, publicly disclosed, lost or stolen, exposing its customers to the risk of identity theft and exposing Signet or its third-party vendors to a risk of loss or misuse of this information.
Signet and its third-party vendors have experienced successful attacks and breaches from time to time, however, to date, these attacks or breaches have not had a material impact on Signet's business or operations. Any such malfunction, access, disclosure or other loss of information could result in legal claims or proceedings, liability or regulatory penalties under laws protecting the privacy of personal information, significant breach-notification costs, lost sales and a disruption to operations (including the Company's ability to process consumer transactions and manage inventories), media attention, and damage to Signet's reputation, which could adversely affect Signet's business. In addition, it could harm Signet's reputation and ability to execute its business through service and business interruptions, management distraction and/or damage to physical infrastructure, which could adversely impact sales, costs and earnings. If Signet is the target of a material cybersecurity attack resulting in unauthorized disclosure of its customer data, the Company may be required to undertake costly notification and credit monitoring procedures. Compliance with these laws will likely increase the costs of doing business.
In addition, if Signet's online activities or other customer-facing technology systems do not function as designed or are deemed to not comply with applicable state and federal regulations concerning automated outbound contacts such as text messages and the sale,advertisement and promotion of the jewelry it sells, the Company may experience a loss of customer confidence, data security breaches, regulatory fines, lawsuits, lost sales or be exposed to fraudulent purchases.
The regulatory environment related to information security, data collection and privacy is becoming increasingly demanding, with new and changing requirements applicable to Signet's business, including the General Data Protection Regulation and the California Consumer Privacy Act, and compliance with those requirements could result in additional costs, such as costs related to organizational changes, implementing additional protection technologies, training employees and engaging consultants. In addition, the Company could be subject to claims, fines, penalties or other liabilities for a failure to comply.
Failure to manage these risks could have a material adverse effect on Signet's results of operations, financial condition and cash flow.