We use information technology systems, infrastructure and networks, other operational systems and third-party systems and services to store, retrieve, transmit, evaluate, use and delete customer, employee, and company data and information. Our business is highly dependent on our ability to access these systems to perform necessary business functions. In the event of a natural disaster, unauthorized access, a terrorist attack, malware, cyber-attacks or other disruptions, our systems and networks may be inaccessible to our employees, customers or business partners for an extended period of time, and we may be unable to meet our business obligations for an extended period of time if our data or systems are disabled, manipulated, destroyed or otherwise compromised. Additionally, some of our systems and networks are older, legacy-type systems that are less efficient, more susceptible to cybersecurity risks and require an ongoing commitment of significant resources to maintain or upgrade. System and network failures, outages, degraded performance and other disruptions have in the past compromised and in the future may compromise our ability to perform business functions in a timely manner, which could adversely impact our ability to conduct business and our relationships with our business partners and customers, and expose us to legal claims as well as regulatory investigations and sanctions, any of which could have a material adverse effect on our business, results of operations, financial condition and liquidity. See "Cybersecurity-Cybersecurity Risk Management" below.
The systems and networks we maintain and third-party systems and networks we use have in the past been, and will likely in the future be, subject to or targets of unauthorized or fraudulent access, including physical or electronic break-ins or unauthorized tampering, and cybersecurity threats, such as "denial of service" attacks, phishing, untargeted but sophisticated and automated attacks, ransomware and other disruptive software. Also, like other companies, we face an increasing challenge of attracting and retaining highly qualified security personnel to assist us in combating these security threats. Cybersecurity threats and attacks can originate from a broad range of sources including terrorists, nation states, state-sponsored actors, financially motivated actors, internal actors, or third-parties (including third-party providers), and the techniques used in these threats and attacks may change, develop and evolve rapidly, including the use of emerging technologies, such as broader forms of artificial intelligence, and are frequently or are often not recognized until after they have been launched.
The frequency and sophistication of such threats and attacks continue to increase and often become further heightened in connection with geopolitical tensions. In light of these geopolitical events and dynamics, state-sponsored parties or their supporters have in the past and may in the future, launch cyberattacks, and attempt to cause supply chain disruptions, or carry out other geopolitically motivated actions that may adversely disrupt or degrade our operations and may result in data compromise.
If we or our vendors fail to prevent, detect, address and mitigate such incidents, we may suffer significant financial and reputational harm. There is no assurance that our security measures or those of our vendors, including information security policies, administrative, technical and physical controls and other actions designed as preventative, will provide fully effective protection from such events. We maintain insurance to cover operational risks, such as cyber risk and technology outages, but this insurance may not cover all costs associated with the consequences of information systems or personal, confidential or proprietary information being compromised. We cannot be certain that insurance coverage will continue to be available to us on economically reasonable terms, or at all, or that any insurer will not deny coverage of a future claim.
In the case of a successful ransomware or extortion attack in which our data and information systems are compromised and applicable restore control processes to restore access are not effective, our information or systems could be held hostage until a ransom, which may be significant, is paid and payment of a ransom does not guarantee that the affected information and system will be able to be restored. In some cases, such a compromise may not be immediately detected, which may make it difficult to restore critical services, mitigate damage to assets and maintain the integrity and security of data, including our policyholder, employee, agent and other confidential information processed through our systems and networks. Additionally, since we rely heavily on information technology and systems and on the integrity and timeliness of data to run our businesses and service our customers, any cybersecurity event resulting in a compromise of systems or data has in the past and may in the future impede or interrupt our ability to conduct business operations, offer products to and service our customers, and comply with applicable laws and regulations and otherwise may materially and adversely affect our business, results of operations, financial condition and liquidity.
We routinely transmit, receive and store personal, confidential and proprietary information by email and other electronic means. Although we attempt to keep such information confidential and secure, we have experienced unintentional and intentional unauthorized access to and transmissions of such information and may be unable to prevent future occurrences of unintentional or intentional unauthorized access to and transmissions of such information, especially with customers, vendors, service providers, counterparties and other third parties who do not or may not have or use appropriate controls to protect personal, confidential or proprietary information. Failure by us or any of our third-party vendors to secure or appropriately handle personal, confidential or proprietary information has in the past and could in the future cause a loss of data or compromised data integrity, give rise to remediation or other expenses, expose us to liability under U.S. and international laws and regulations, and subject us to litigation, investigations, sanctions, and regulatory and law enforcement action, and result in reputational harm and loss of business, which could have a material adverse effect on our business, results of operations, financial condition and liquidity.
Regulators' or others' scrutiny of cybersecurity and information privacy, including new laws or regulations and for evolving expectations, could increase our compliance costs and operational burdens, particularly as regulatory and legislative focus on cybersecurity and information privacy matters intensifies, which could lead to more enforcement actions. Regulators, customers, or others may act against us for any cybersecurity failures. New and currently unforeseen laws and regulatory issues could also arise from the increased use of emerging technologies, data analytics and digital services, including the use of AI. If we are found not to be in compliance with these laws and regulations, we could be subjected to significant civil and criminal liability and exposed to financial and reputational harm.
For additional information on data protection and cybersecurity regulations and cybersecurity generally, see "Business-Regulation-U.S. Regulation-Privacy and Cybersecurity," "Business-Regulation-International Regulation-Privacy, Data Protection and Cybersecurity," and "Cybersecurity-Cybersecurity Risk Management."