A cyber incident is considered to be any adverse event that threatens the confidentiality, integrity or availability of information resources. More specifically, a cyber incident is an intentional attack or an unintentional event that can include gaining unauthorized access to systems to disrupt operations, corrupt data or steal confidential information about customers, franchisees, suppliers or employees. Many retailers and other companies have recently experienced serious cyber incidents and breaches of their information technology systems. As our reliance on technology has increased, so have the risks posed to our systems, both internal and those we have outsourced, and we may further be negatively impacted to the extent outdated or legacy systems cease to function appropriately. We have in the past been and in the future may also be subject to negative impacts to our business caused by cyber incidents relating to our third-party service providers or the service providers of those third parties or our franchisees.
The primary risks that could directly result from the occurrence of a cyber incident include operational interruption, damage to our relationships with customers, franchisees and employees, private data exposure, including payment card or other financial data, publicity impact and regulatory fines. In addition to maintaining insurance coverage to address cyber incidents, we have also implemented processes, procedures and controls to help mitigate these risks. The costs related to cyber or other security threats or disruptions may not be fully insured or indemnified by others, including by our service providers and these measures, as well as our increased awareness of the risk of a cyber incident, do not guarantee that our reputation and financial results will not be materially and adversely affected by such an incident. Our business continuation or disaster recovery programs may not be sufficient to mitigate the harm that could result from such disaster or disruption, and insurance and other safeguards may only partially reimburse us for our losses, if at all. The continued rise in AI technologies may intensify our cybersecurity risks.
We depend on the performance of suppliers, aggregators, service providers and other third parties in our business operations. Third-party business processes we utilize include information technology, gift card authorization and processing, payment processing, benefits, and other accounting and business services. The failure of our suppliers, aggregators, service providers and other third parties to maintain adequate controls or comply with our expectations and standards could have a material adverse effect on our business. Our and our franchisees' operations depend upon our ability and the ability of franchisees, third-party service providers and the service providers of those third parties (as well as franchisees' third-party service providers and the service providers of those third parties) to protect computer equipment and systems against damage from theft, fire, power loss, telecommunications failure and other catastrophic or unanticipated events, as well as internal and external security incidents, viruses, denial-of-service attacks, phishing attacks, ransomware attacks and other intentional or unintentional disruptions. The rapid evolution and continued increased adoption of AI technologies amplifies these concerns.
A significant portion of our retail sales depends on the continuing operation of our information technology and communications systems, including DOM OS, our online and mobile ordering platforms and our credit card processing systems. The failure of these systems to operate effectively, stemming from maintenance problems, upgrading or transitioning to new platforms, a compromise in our security or other unanticipated problems has at times in the past and in the future could result in interruptions to or delays in our and our franchisees' operations, and some of our systems are not fully redundant. The occurrence of a natural disaster, intentional sabotage or other unanticipated problems could result in lengthy interruptions in service. Remote working could also exacerbate certain risks to our business, including an increased risk of cyber incidents and improper dissemination of personal or confidential information.
In addition, the implementation of technology changes and upgrades to maintain and upgrade our systems, errors or vulnerabilities in our systems, or damage to or failure of our systems, including because of systems becoming obsolete, could result in interruptions in our services and non-compliance with certain laws or regulations, which could reduce our sales, revenues and profits and damage our business and brand.
Because we and our franchisees accept electronic forms of payment from customers including credit cards, our business requires the collection and retention of customer data, including sensitive financial data and other personally identifiable information in various information systems that are maintained by third parties with whom we and our franchisees contract to provide payment processing. A weakness in such third party's systems or software products (or in the systems or software products in the service providers of those third parties) may provide a mechanism for a cyber threat. In recent years, a significant number of companies have experienced data breaches in which customer information was stolen through vendor access channels. Cyber-attacks and data breaches at a payment processing contractor could compromise confidential information or adversely affect our ability to deliver products and services to our customers. There is also a potential heightened risk of cyber security incidents as a result of geopolitical events outside of our control. These problems could negatively affect our results of operations, and remediation could result in significant, unplanned capital investments.
We also maintain important internal Company data, such as personally identifiable information about our employees and franchisees and information relating to our operations. In addition, more than 85% of our U.S. retail sales in 2025 were derived from digital channels, primarily through our online ordering website and mobile applications, where customers enter personally identifiable information that we retain. Our use and retention of personally identifiable information is regulated by foreign, federal and state laws and regulations, as well as by certain third-party agreements. For example, the State of California has adopted the California Privacy Rights Act of 2020, an amendment to the California Consumer Privacy Act, and numerous other states have adopted similar comprehensive data protection laws, which may require companies to change their practices for handling of personal data, including allowing consumers to request that we delete certain personal data. In addition, the State of New York promulgated the New York SHIELD Act, like laws in several other states, which imposes obligations on businesses to implement physical, administrative and technical security measures to protect personal data.
As privacy and information security laws and regulations change, we may incur additional costs aimed at ensuring that we are in compliance with those laws and regulations, and our current and future planned uses of personal and other data may be adversely affected by future adopted privacy and information security laws, regulations and rulings. If our security and information systems are compromised or if we, our employees or franchisees fail to comply with these laws, regulations or contract terms, or to successfully implement processes related to requirements, laws and regulations governing cyber incidents, it could require us to notify customers, employees or other groups. This could result in adverse publicity, loss of sales and cash flows, increased fees payable to third parties and fines, penalties or remediation and other costs that could adversely affect our reputation, business and results of operations. Any other material disruption or other adverse event affecting one or more of our digital ordering platforms, including, for instance, power loss, technological or systems failures, user error or cyber-attacks, could similarly result in adverse publicity, loss of sales and cash flows and other costs, which could in turn materially and adversely affect our reputation, business and results of operations.