Hackers, computer programmers and internal users may be able to penetrate our network security and create system disruptions, cause shutdowns and misappropriate our confidential information or that of our employees and third parties, including our customers. Therefore, we could incur significant expenses addressing problems created by security breaches to our network. This risk is heightened because we collect and store customer information for marketing purposes, as well as debit and credit card information. We must, and do, take precautions to secure customer information and prevent unauthorized access to our database of confidential information. However, if unauthorized parties, including external hackers or computer programmers, gain access to our database, they may be able to steal this confidential information. Our failure to secure this information could result in costly litigation, adverse publicity or regulatory action, or result in customers discontinuing the use of debit or credit cards in our stores or e-commerce websites, or customers not shopping in our stores or on our e-commerce websites altogether. While we maintain cyber risk insurance, the costs relating to certain kinds of security incidents could be substantial, and our insurance may not be sufficient to cover all losses related to any future incidents involving our data or systems. These consequences could have a material adverse effect on our financial condition and results of operations. In addition, sophisticated hardware and operating system software and applications that we procure from third parties may contain defects in design or manufacture that could unexpectedly interfere with our operations. The cost to alleviate security risks and defects in software and hardware and to address any problems that occur could negatively impact our sales, distribution and other critical functions, as well as our financial results.
In recent years, there has been increasing regulatory enforcement and litigation activity in the area of privacy, data protection and information security in various states in which we operate, including for example, the California Consumer Privacy Act of 2018 (the "CCPA"), which became effective on January 1, 2020. The CCPA requires certain companies to satisfy certain requirements regarding the handling of personal and sensitive data, including its use, protection and the ability of California residents whose data is stored to know specifically what data types each company has collected on them and, if they so choose, the right to demand that such companies delete their data. Failure to comply with the CCPA requirements could result in civil penalties. The CCPA also provides a private right of action that allows consumers to seek, either individually or as a class, statutory or actual damages and injunctive and other relief, if their sensitive personal information is subject to unauthorized access and exfiltration, theft or disclosure as a result of a business's failure to implement and maintain required reasonable security procedures. New legislation or regulation such as the CCPA, including any potential comprehensive federal privacy legislation, as well as any associated inquiries or investigations or any other government actions, could be costly to comply with, result in negative publicity, increase our operating costs, require significant management time and attention, and subject us to remedies that may harm our business, including fines or demands or orders that we modify or cease existing business practices.
We operate Aptos Retail on a software-as-a-service platform, and we use this system for integrated point-of-sale, merchandising, planning, sales audit, customer relationship management, inventory control, loss prevention, purchase order management and business intelligence. Accordingly, we depend on this system, and the third-party provider of this service, for many aspects of our operations. If this service provider or this system fails, or if we are unable to continue to have access to this system on commercially reasonable terms, or at all, our operations would be severely disrupted until an equivalent system could be identified, licensed or developed, and integrated into our operations. This disruption would have a material adverse effect on our business.