- Our operations rely on the secure processing, storage and transmission of confidential, sensitive and other types of data and information in our information systems and networks and those of our third-party service providers, including our vendors. Cyber threats continue to further evolve and continue to be more difficult to detect and successfully defend against. As a result, cyber threats have in the past and may in the future defeat the measures that we or our third-party service providers take to anticipate, detect, avoid, or mitigate such threats.
- Our businesses often have access to material non-public information concerning the Company's customers, including sovereigns, public and private companies, and other third parties around the world, the unauthorized disclosure of which could affect the trading markets for such customers' securities and could damage such customers' competitive positions. Some of our own products and services also include material non-public information that could affect trading markets. Unauthorized disclosure of this information as a result of cyber attacks and other unauthorized occurrences on our information systems and networks could cause our customers to lose faith in our ability to protect confidential information and therefore cause customers to cease doing business with us.
- The cyber threats we and our third-party service providers (including our vendors) face are rapidly evolving and are becoming increasingly sophisticated and include denial of service attacks, ransomware, spyware, phishing/smishing/vishing attacks, business compromise attacks, employee errors, negligence or malfeasance, the use of malicious codes or worms, payment fraud, and other unauthorized occurrences on, or conducted through, our or our third-party service providers' (including our vendors') information systems and networks, originating from a wide variety of sources, including criminals, terrorists, nation states, financially motivated actors, internal actors, and external service providers. The cyber risks the Company faces range from cyber attacks common to most industries, to more sophisticated and targeted attacks, including attacks carried out by state-sponsored actors, intended to obtain unauthorized access to certain information or information systems or networks due in part to our prominence in the global marketplace, such as our ratings on debt issued by sovereigns and corporate issuers, our impending methodology changes in our benchmarks businesses, or the composition of our indices. Our third-party service providers, including our vendors, are also the subject of a variety of cyber attacks, including attacks carried out by state-sponsored actors.
- We and our third-party service providers, including our vendors, experience cyber attacks, data breaches and other cyber threats of varying degrees on a regular basis. The volume of such attacks, breaches and threats have increased over the years and we expect that volume to continue to increase. Breaches of our or our third-party service providers' (including our vendors') information systems and networks may cause material interruptions or malfunctions in our or such third-party's websites, applications or data processing, or may compromise the confidentiality and integrity of material information regarding us, our business or our customers. Although cyber attacks and data breaches on the Company and its third-party service providers have not had a material adverse effect on the Company, there can be no assurance that there will not be a material adverse effect in the future.
- In the ordinary course of business, we are exposed to vulnerabilities in widely deployed third-party software. While such vulnerabilities have not resulted in a material adverse effect on the Company, they require us to devote time and resources to remediation on a regular basis. Notwithstanding our efforts, there can be no assurance that we will not suffer a material adverse effect resulting from vulnerabilities in widely deployed third-party software.
- Misappropriation, improper modification, destruction, corruption or unavailability of our data and information, including personal data, due to cyber incidents, attacks or other security breaches, or the perception of such an occurrence, could damage our brand and reputation, result in litigation, regulatory actions, sanctions or other statutory penalties, lead to loss of customer confidence in our security measures and reliability, which would harm our ability to retain customers and gain new ones, result in financial losses that are either not insured against or not fully covered through any insurance maintained by us, and lead to increased expenses related to addressing or mitigating the risks associated with any such incidents. We may be required to expend significant resources to mitigate the impact of any errors, interruptions, delays or cessations of service and we may have insufficient recourse against our third-party service providers, including our vendors. Additionally, our failure to timely or accurately communicate cyber incidents to relevant parties, including as a result of a failure of our third-party service providers, including our vendors, to inform us of incidents impacting their information systems or networks in a timely manner could result in regulatory or litigation risk, and reputational harm.
- We devote significant resources to maintain and regularly update our systems and processes that are designed to protect the security of our information systems, software, networks and other technology assets and the confidentiality, integrity and availability of information belonging to the enterprise and our customers, clients and employees. However, such measures may be circumvented or become obsolete, and additional measures that we take to prevent or mitigate cyber incidents may be expensive or ineffective. Accordingly, there can be no assurance that our security measures will be sufficient to protect our information or information systems and networks.
- While we conduct cyber due diligence during the acquisition process, following the completion of acquisitions, we have identified weaknesses and vulnerabilities in acquired entities' information systems and networks, which expose us to unexpected liabilities or make our own information systems or networks more vulnerable to a cyber attack. Such weaknesses and vulnerabilities have been, and may continue to be identified as we complete integration of IHS Markit Ltd. information systems and networks.
- Any of the foregoing could have a material adverse effect on our business, financial condition or results of operations.