Our business relies on information systems and other technology ("information systems"), some of which are managed or hosted by third parties, to support aspects of our global business operations, including, but not limited to, procurement, supply chain management, manufacturing, design, distribution, invoicing, financial transactions with banks and financing institutions and other transactions with various third-party providers. We also use information systems to accumulate, analyze and report our operational results. In connection with our use of information systems, we obtain, create and maintain confidential and personal information. Additionally, we rely upon information systems in our marketing and communication efforts. Due to our reliance on our information systems, we have established various levels of security as well as backup and disaster recovery procedures. Despite our security measures and business continuity plans, our information technology systems may be vulnerable to damage, disruption or shutdowns caused by cyber-attacks, including state-sponsored attacks, computer viruses, malware, ransomware, phishing attacks or breaches due to errors or malfeasance by employees and others who have access, or gain access, to these systems. The occurrence of any of these events could compromise the confidentiality, operational integrity and accessibility of these systems and the data that resides within them and our business processes and operations may be negatively impacted in the event of a substantial or prolonged disruption of service caused by such events. THOR, along with others within the RV industry, including suppliers, dealers and third-party providers, have been the target of cyber-attacks in the past, and such attacks are expected to continue and evolve in the future. While we continually employ capabilities, processes and other security measures designed to reduce and mitigate the risk of cyber-attacks, we rely on our suppliers, independent dealers and third-party providers to do the same for their operations; however, we may not be aware of all vulnerabilities and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances to mitigate all potential risks.
The methods and technologies used to obtain unauthorized access to our information systems are constantly changing as are laws and regulations concerning data protection and privacy. While we have implemented and regularly review robust security measures and processes designed to prevent and detect unauthorized access to our information systems, we may not be able to anticipate and effectively prevent unauthorized access or data loss in the future. The misuse, leakage, unauthorized access or falsification of information could result in a violation of privacy laws, including the European Union's General Data Protection Regulation ("GDPR") and laws applicable in North America and the United States, and damage to our reputation which could, in turn, have a significant, negative impact on our results of operations, as a result of fines, remediation costs or other direct or indirect ramifications.