Many of our information technology systems (whether cloud-based or hosted in proprietary servers), including those used for our point-of-sale, web and mobile platforms, online and mobile payment systems, delivery services, rewards programs, and administrative functions, contain personal, financial, or other information that is entrusted to us by our customers, business partners, and employees. Many of our information technology systems also contain Starbucks proprietary and other confidential information related to our business, such as business plans and product development initiatives and designs, and confidential information about third parties, such as licensees and business partners. Similar to many other retail companies and because of the prominence of our brand, we have in the past experienced, and we expect to continue to experience, cyber-attacks, including phishing, and other attempts to breach, or gain unauthorized access to, our systems and databases. To date, these attacks have not had a material impact on our operations, but we cannot provide assurance that they will not have an impact in the future. Our third-party providers' and business partners' information technology systems and databases are likewise subject to such risks. The number and frequency of these attempts varies from year to year and increases as the scale and scope of our technology footprint and digital operations increases. In addition, to conduct our business, we provide customer and employee data, as well as Starbucks proprietary information and other confidential information important to our business, to third parties, including licensees and business partners. Individuals performing work for Starbucks and such third parties also may access some of this data, including on personally-owned digital devices. To the extent we, a third party, or such an individual were to experience a breach of our or their information technology systems that results in the unauthorized access, theft, use, destruction or other compromises of customers' or employees' data or confidential information of the Company stored in or transmitted through such systems, including through cyber-attacks or other external or internal methods, it could result in a material loss of revenues from the potential adverse impact to our reputation and brand, a decrease in our ability to retain customers or attract new ones, the imposition of potentially significant costs (including loss of data or payment for recovery of data) and liabilities, loss of business, loss of business partners and licensees, and the disruption to our supply chain, business, and plans. Unauthorized access, theft, use, destruction, or other compromises are becoming increasingly sophisticated and may occur through a variety of methods, including attacks using malicious code, vulnerabilities in software, hardware, or other infrastructure (including systems used by our supply chain), system misconfigurations, phishing, deepfakes, ransomware, malware, or social engineering. The rapid evolution and increased adoption of artificial intelligence technologies may intensify our cybersecurity risks. Our logging capabilities, or the logging capabilities of third parties, are not always complete or sufficiently granular, affecting our ability to fully understand the scope of security breaches.
Such security breaches also could result in a violation of applicable U.S. and international privacy, cyber, and other laws or trigger data breach notification laws, including new disclosure rules promulgated by the SEC, and subject us to private consumer, business partner or licensee, or securities litigation and governmental investigations and proceedings, any of which could result in our exposure to material civil or criminal liability. These risks also exist in acquired businesses, joint ventures, or companies we invest in or partner with that use separate information systems or that have not yet been fully integrated into our information systems.
Significant capital investments and other expenditures could also be required to investigate security incidents, remedy cybersecurity problems, recuperate lost data, prevent future compromises, and adapt systems and practices to react to the changing threat environment. These include costs associated with notifying affected individuals and other agencies, additional security technologies, trainings, personnel, experts, and credit monitoring services for those whose data has been breached. These costs, which could be material, could adversely impact our results of operations in the period in which they are incurred, including by interfering with the pursuit of other important business strategies and initiatives, and may not meaningfully limit the success of future attempts to breach our information technology systems.
Media or other reports of existing or perceived security vulnerabilities in our systems, or those of our third-party business partners or service providers, can also adversely impact our brand and reputation and materially impact our business. Additionally, the techniques and sophistication used to conduct cyber-attacks and compromise information technology systems, as well as the sources and targets of these attacks, change frequently and are often not recognized until such attacks are launched or have been in place for a period of time. The rapid evolution and increased adoption of artificial intelligence technologies by attackers amplifies these concerns. We continue to make significant investments in technology, third-party services, and personnel to develop and implement systems and processes that are designed to anticipate cyber-attacks and to prevent or minimize breaches of our information technology systems or data loss, but these security measures cannot provide assurance that we will be successful in preventing such breaches or data loss.