In the standard course of business, we receive and maintain confidential information about customers, associates and other third parties. In addition, third parties also receive and maintain certain confidential information. The protection of this information is critical to our business and subjects us to numerous laws, rules and regulations domestically and in foreign jurisdictions. The retail industry in particular has been the target of many cyber-attacks and it is possible that an individual or group could defeat our security measures, or those of a third-party service provider, and access confidential information about our business, customers and associates. Further, like other companies in the retail industry, during the ordinary course of business, we and our vendors have in the past experienced, and we expect to continue to experience, cyber-attacks of varying degrees and types, including phishing, and other attempts to breach, or gain unauthorized access to, our systems. In addition, recent sanctions issued by the U.S. government related to the on-going hostilities in Ukraine, could increase the risk of retaliatory state-sponsored cyber-attacks, phishing and other scams, fraud, money laundering, theft and other criminal activity. To date, these attacks have not had a material impact on our operations, but we cannot provide assurance that cyber attacks will not have a material impact in the future. We have experienced, and expect to continue to experience increased costs associated with protecting confidential information through the implementation of security technologies, processes and procedures, including training programs for associates to raise awareness about phishing, malware and other cyber risks, especially as we implement new technologies, such as new payment capabilities or updates to our mobile apps and websites. Additionally, the techniques and sophistication used to conduct cyber-attacks and breaches of information technology systems change frequently and increase in complexity and are often not recognized until such attacks are launched or have been in place for a period of time. We may not have the resources or technical sophistication to anticipate, prevent, or immediately identify and remediate cyber-attacks. Furthermore, the global regulatory environment is increasingly complex and demanding with frequent new and changing requirements surrounding , information security and privacy, including the China Cybersecurity Law, the California Consumer Privacy Act, and the European Union’s General Data Protection Regulation. We may incur significant costs related to compliance with these laws and failure to comply with these regulatory standards, and others, could have a material adverse impact on our business. In addition, as a result of COVID-19, a portion of our corporate associate population continues to work-from-home on a full or part-time basis. We have also implemented a flexible work policy allowing all of our corporate associates to work remotely from time to time, as have certain of our third-party vendors. Offsite working by associates, increased use of public Wi-Fi, and use of office equipment off premises may be necessary, and may make our business more vulnerable to cybersecurity breach attempts,. phishing and other scams, fraud, money laundering, theft and other criminal activity. If we, or a third-party partner, were to fall victim to a successful cyber-attack, suffer intentional or unintentional data and security breaches by associates or third-parties, it could have a material adverse impact on our business, especially an event that compromises customer data or results in the unauthorized release of confidential business or customer information. In addition, if we are unable to avert a denial of service attack that renders our site inoperable, it could result in negative consequences, such as lost sales and customer dissatisfaction. Additional negative consequences that could result from these and similar events may include, but are not limited to: •remediation costs, such as liability for stolen assets or information, potential legal settlements to affected parties, repairs of system damage, and incentives to customers or business partners in an effort to maintain relationships after an attack; •increased cybersecurity protection costs, which may include the costs of making organizational changes, deploying additional personnel and protection technologies, training associates, and engaging third party experts and consultants; •lost revenues resulting from the unauthorized use of proprietary information or the failure to retain or attract customers following an attack; •litigation and legal risks, including costs of litigation and regulatory, fines, penalties or actions by domestic or international governmental authorities; •increased insurance premiums; •reputational damage that adversely affects customer or investor confidence; and •damage to the Company’s competitiveness, stock price, and long-term shareholder value. Although we maintain cybersecurity insurance, there can be no assurance that it will be sufficient for a specific cyber incident, or that insurance proceeds will be paid to us in a timely fashion.