The Company faces evolving cybersecurity risks that threaten the confidentiality, integrity, and availability of its IT Systems and information, including from diverse threat actors, such as state-sponsored organizations, opportunistic hackers and hacktivists, as well as through diverse attack vectors, such as social engineering/phishing, malware (including ransomware), malfeasance by insiders, human or technological error, and as a result of bugs, misconfigurations and vulnerabilities in software or hardware.
The Company has been subject to cyberattacks and other security incidents in the past, including, but not limited to, phishing and malware incidents, and the Company expects cyberattacks to increase in number, frequency and sophistication going forward. Although prior cyberattacks have not been material, future attacks may have a material adverse effect on the Company's business operations, reputation and financial results. As the prevalence of cyberattacks continues to increase, the Company's IT systems, and those of third parties, such as service providers and software providers, are subject to increased risks and threats, and the Company may incur additional costs to maintain and upgrade its security measures and to attempt to monitor various third parties' security measures. There can be no assurance that the Company's or any critical third party's cybersecurity risk management program and processes, including its policies, controls or processes, will be fully implemented, complied with or effective to adequately anticipate, identify, detect, investigate or prevent certain cyberattacks or security incidents, including due to the increasing use by attackers of tools and techniques – such as artificial intelligence - that are designed to circumvent controls, avoid detection, obfuscate or remove forensic evidence and that evade counter-measures. A significant attack or incident could result in transactional errors, business disruptions, loss of or damage to intellectual property, loss of customers and business opportunities, unauthorized access to or disclosure of confidential or personal information (which could cause a breach of applicable data protection legislation), litigation (including class action) or regulatory investigations and fines, penalties or intervention, reputational damage, reimbursement or other compensatory costs, and additional compliance costs, any of which could have a material adverse effect on the Company's business, financial condition, results of operations and cash flows. The COVID-19 pandemic has presented additional operational and cybersecurity risks due to continued work-from-home arrangements at the Company and third-party providers, which presents additional opportunities for threat actors to engage in social engineering (for example, phishing) and to exploit vulnerabilities in non-corporate networks. Any resulting costs or losses may not be covered by, or may exceed the coverage limits of, the Company's cyber insurance.
The Company is increasingly reliant on third parties, including in the supply chain, to provide software, support and management and a host of related and other products and services across an array of business and operational functions, such as human resources, sales, electronic communications, data storage, finance, risk management and compliance, among many others. The security and privacy measures these third parties implement may not be sufficient to anticipate, identify, detect or prevent cyberattacks or security incidents that could have a material adverse effect on the Company's business, financial condition, results of operations and cash flows. While the Company's agreements with third-party service providers typically contain provisions that seek to mitigate or otherwise limit the Company's exposure to liability for damages from a cyberattack, there can be no assurance of compliance with such provisions or that such provisions will withstand legal challenges or cover all or any such damages.
In addition, a growing number of new global privacy, cybersecurity and data protection rules are being enacted and existing ones are being updated and strengthened. These laws impose obligations on companies regarding the handling of personal data and provide certain individual privacy rights to persons whose data is stored, transferred or processed. Any failure to comply with these laws and regulatory standards could subject the Company to legal and reputational risk. For example, in May 2018, the European Union (EU) implemented the General Data Protection Regulation (GDPR) that stipulates data protection and privacy regulations for all individuals within the EU and the European Economic Area (EEA). The Company has significant operations in the EEA and is subject to the GDPR. The GDPR imposes several stringent requirements for controllers and processors of personal data and could make it more difficult and/or more costly for the Company to use and share personal data, including placing obstacles on the transfer of personal data from Europe to the United States. In addition, the California Consumer Privacy Act (the "CCPA"), which became effective on January 1, 2020, is similar in many respects to the GDPR but also includes a private right of action and potential statutory damages exposure for certain types of data breaches. In addition, in 2023, the California Privacy Rights Act (the "CPRA") expanded upon the CCPA, creating additional compliance obligations around user choice, data subject rights, and transparency, among others. Other states in the U.S. have also been proposing and enacting laws similar to the CCPA/CPRA. Although the Company takes reasonable efforts to comply with all applicable laws and regulations, there can be no assurance that the Company will not be subject to regulatory action, including fines and litigation (including class actions), in the event of a statutory violation or security incident. To comply with the rules imposed by the GDPR, CCPA, CPRA and other applicable data protection legislation, the Company may be required to put in place additional mechanisms which could adversely affect its business, financial condition, results of operations and cash flows.