We process and maintain certain information that is confidential, proprietary, personal, or otherwise sensitive, including financial and confidential business information. Our information technology systems, devices, storage and applications, as well as those maintained by our third-party providers, are susceptible to damage, disruptions and shutdowns due to computer viruses, cyberattacks, ransomware or malware attacks, phishing, denial of service attacks, malicious social engineering, attacks by foreign actors, and other attempts to gain unauthorized access. Our systems and the systems maintained by our third-party providers have been subject to attempts to gain unauthorized access, breaches, and other system disruptions, and these and similar incidents could happen again. These events could, from time to time, cause material service outages, allow inappropriate or block legitimate access to systems or information, or result in other material interruptions to our business, our customers and other stakeholders could be impacted, and our reputation could be harmed. The techniques used to obtain unauthorized access, disable or degrade service or sabotage systems change frequently and the frequency and sophistication of cyber-attacks globally have increased over time. As a result, we may be unable to anticipate these attacks or techniques or to implement adequate measures to recognize, detect or prevent the occurrence of any of the events described above or to adequately mitigate their effects. We also may not discover the occurrence of any of the events described above for a significant period of time after the event occurs. These risks, as well as the number and frequency of cybersecurity events globally, may also be heightened during times of geopolitical tension or instability between countries.
We operate a robust information security program that includes: access control tools; detection and response tools; security awareness, penetration testing, vulnerability management, and incident response programs; data encryption; formal risk management, including 3rd party risk management; and cyber insurance. We depend on and interact with the information technology networks and systems of third parties for many aspects of our operations, including our customers and service providers such as cloud service providers and third-party delivery services. These third parties are subject to risks resulting from data breaches, cyberattacks, and other events or actions that could damage or disrupt their networks or systems, which could adversely affect our operations and have an impact on our business.
Any failure to identify and address such defects or errors or prevent a cyber-attack could result in service interruptions, operational difficulties, loss of revenues or market share, liability to our customers or others, the diversion of corporate resources, injury to our reputation or increased service and maintenance costs. Addressing such issues could prove to be impossible or very costly and responding to the resulting claims or liability could similarly involve substantial cost, and the costs related to cybersecurity threats or disruptions may not be fully insured or indemnified by other means. While we have dedicated significant resources to security and privacy and to incident response capabilities, our response processes may not be adequate, may fail to accurately assess the severity of an incident, may not be sufficient to prevent or limit harm, or may fail to sufficiently remediate an incident in a timely fashion, any of which could harm our business, reputation, results of operations and financial condition.