We rely on information technology and other systems (including those maintained by third parties with whom we contract to provide data services) to maintain and transmit large volumes of customer financial information, credit card settlements, credit card funds transmissions, mailing lists, reservation information, and other personally identifiable information. We also maintain important internal company data such as personally identifiable information about our employees and information relating to our operations. The systems and processes we have implemented to protect customers, employees and company information are subject to the ever-changing risk of compromised security. Attempts by others to gain unauthorized access to information technology and other systems and the data contained therein are becoming increasingly sophisticated and difficult to anticipate and prevent. As a result, we face cybersecurity risks including cyber and physical security breaches, system failure, phishing attacks, computer viruses, worms, ransomware, malicious software programs and negligent or intentional misuse by customers, company employees, or employees of our third-party information system service providers. The steps we take to deter, detect, and mitigate these risks may not be successful. Cybercriminals, including hackers and those working in the capacity of State actors or on behalf of a cybercrime group, may circumvent security measures, and our insurance coverage for protecting against claims, liability and damages caused by cybersecurity risks and incidents, including those related to third-party information system service providers, may not be sufficient. Our third-party information system service providers face risks relating to cybersecurity similar to ours, and we do not directly control any of such parties' information security operations.
Despite the security measures we currently have in place, our facilities and systems and those of our third-party information system service providers may be vulnerable to security breaches, acts of vandalism, phishing attacks, computer viruses, worms, ransomware, malicious software programs, misplaced or lost data, programming or human errors and other events. Cyber-attacks are becoming increasingly more difficult to anticipate, prevent and detect due to their rapidly evolving nature and, as a result, the technology we use to protect our systems from being breached or compromised could become outdated due to advances in computer capabilities or other technological developments.
We have experienced data security incidents in the past, and expect to experience additional incidents in the future; however, to date no such incidents have been material to our business, operating results, or financial condition. Any future perceived or actual electronic or physical security breach involving the misappropriation, loss, or other unauthorized disclosure of confidential or personally identifiable information, including penetration of our network security, whether by us or by a third-party information system service provider, could disrupt our business, damage our reputation and our relationships with our customers or employees, expose us to risks of litigation, significant fines and penalties and liability, result in the deterioration of our customers' and employees' confidence in us, and adversely affect our business, results of operations and financial condition. Since we do not control third-party information system service providers and cannot guarantee that no electronic or physical computer break-ins and security breaches will occur in the future, any perceived or actual unauthorized disclosure of personally identifiable information regarding our employees, customers or website visitors could harm our reputation and credibility and reduce our ability to attract and retain employees and customers. As these threats develop and grow, we may find it necessary to make significant further investments to protect data and our infrastructure, including the implementation of new computer systems or upgrades to existing systems, deployment of additional personnel and protection-related technologies, engagement of third-party consultants, and training of employees. The future occurrence of any of the cyber incidents described above could have a material adverse effect on our business, results of operations and cash flows.