We necessarily collect, use and hold personal and financial information concerning individuals and businesses with which we have a banking relationship. This information includes non-public, personally identifiable information that is protected under applicable federal and state laws and regulations. Additionally, certain of these data processing functions are outsourced to third-party providers. Our facilities and systems, and those of our third-party service providers, may be vulnerable to threats to data security, security breaches, acts of vandalism and other physical security threats, computer viruses or compromises, ransomware attacks, misplaced or lost data, programming and/or human errors or other similar events. Any security breach involving the misappropriation, loss or other unauthorized disclosure of our confidential business, employee or customer information, whether originating with us, our vendors or retail businesses, could severely damage our reputation, expose us to the risks of civil litigation and liability, require the payment of regulatory fines or penalties or undertaking of costly remediation efforts with respect to third parties affected by a security breach, disrupt our operations, and have an adverse effect on our business, financial condition and results of operations. In addition, any damage, failure or security breach that causes breakdowns or disruptions in our general ledger, deposit, loan or other systems could damage our reputation, result in a loss of customer business, subject us to additional regulatory scrutiny, or expose us to civil litigation and possible financial liability, any of which could have an adverse effect on our business, financial condition and results of operations.
It is difficult or impossible to defend against every cyber risk and controls employed by our information technology department and our other employees and vendors could prove inadequate. Increasing sophistication of cyber-criminals and terrorists make keeping up with new threats difficult and could result in a breach. Cybersecurity risks appear to be growing and, as a result, the cyber-resilience of banking organizations is of increased importance to federal and state banking agencies and other regulators. New or revised laws and regulations may significantly impact our current and planned privacy, data protection and information security-related practices, the collection, use, sharing, retention and safeguarding of consumer and employee information, and current or planned business activities. Compliance with current or future privacy, data protection and information security laws to which we are subject could result in higher compliance and technology costs and could restrict our ability to provide certain products and services, which could materially and adversely affect our profitability. In the last few years, there have been an increasing number of cyber incidents, including several well-publicized cyber-attacks that targeted other U.S. companies, including financial services companies much larger than us. These cyber incidents have been initiated from a variety of sources, including terrorist organizations and hostile foreign governments. As technology advances, the ability to initiate transactions and access data has also become more widely distributed among mobile devices, personal computers, automated teller machines, remote deposit capture sites and similar access points, some of which are not controlled or secured by us. It is possible that we could have exposure to liability and suffer losses as a result of a security breach or cyber-attack that occurred through no fault of Veritex. Further, the probability of a successful cyber-attack against us or one of our third-party service providers cannot be predicted. As cyber threats continue to evolve and increase, we may be required to spend significant additional resources to continue to modify or enhance our protective and preventative measures or to investigate and remediate any information security vulnerabilities. Our systems and those of our third-party vendors may also become vulnerable to damage or disruption due to circumstances beyond our or their control, such as from catastrophic events, power anomalies or outages, natural disasters, network failures, and viruses and malware.