We receive, maintain, and store non-public personal information of our customers. The technology and other controls and processes designed to secure our customer information and to prevent, detect, and remedy any unauthorized access to that information were designed to obtain reasonable, not absolute, assurance that such information is secure and that any unauthorized access is identified and addressed appropriately. We, and our service providers, are regularly subject to and expect to continue to experience cyberattacks that are increasingly sophisticated (including using artificial intelligence), that are often designed to evade detection, and/or that seek to damage or disrupt our network, as well as those of our service providers, and other information systems. Certain of these cyberattacks, including phishing attacks, have resulted in unauthorized access by third parties to information that we receive, maintain and store in the course of our business. Although these cyberattacks have not resulted in material financial impacts or disruptions to our business, given the accelerating scope, sophistication, and frequency of cyberattacks, there can be no assurance that the cybersecurity incidents we have experienced or any future incident will not materially impact our security, operations and financial results. Future cyberattacks, or the perception thereof, could result in a loss of data, operational disruptions, and even lost business and goodwill. Additionally, we could incur significant costs associated with the recovery from a cyber-attack, and these costs may exceed, or the events to which they relate, may be excluded from, coverage under, our cyber insurance.
If customer information is inappropriately accessed and used by a third party or an employee for illegal purposes, such as identity theft, we may be responsible for any losses the affected applicant or borrower may have incurred as a result of misappropriation. In such an instance, we may be liable to a governmental authority for fines or penalties associated with a lapse in the integrity and security of our customers' information. Additionally, if we are the target of a successful cyberattack, we may experience reputational harm that could impact our standing with our borrowers and adversely impact our financial results.
We regularly update our existing information technology systems and install new technologies when deemed necessary and regularly provide employee awareness training around phishing, malware, and other cyber risks and physical security to address the risk of cyber-attacks and other security breaches. However, such preventative measures may not be sufficient to prevent future cyberattacks or a breach of customer information. Additionally, most of our employees work remotely or in a hybrid arrangement and will continue to do so for the foreseeable future. Remote and hybrid working arrangements at our Company (and at many third-party providers) increase cybersecurity risks due to the challenges associated with managing remote computing assets and security vulnerabilities that are present in many non-corporate and home networks. While we have designed our controls and processes to operate in a remote working environment, there is a heightened risk such controls and processes may not detect or prevent unauthorized access to our information systems. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or effective in protecting our information technology systems and confidential information.
In addition, we need to comply with increasingly complex and rigorous regulatory standards enacted to protect business and personal data in the United States, Europe and elsewhere. For example, the European Union adopted the General Data Protection Regulation ("GDPR"), which became effective on May 25, 2018, and the State of California adopted the California Consumer Privacy Act of 2018 ("CCPA") and the California Privacy Rights Act of 2020 ("CPRA"). The GDPR, CCPA, and CPRA, among others, impose additional obligations on companies regarding the handling of personal data, provide certain individual privacy rights to persons whose data is stored and create new audit requirements for higher risk data. Compliance with existing, proposed and recently enacted laws (including implementation of the privacy and process enhancements called for under the GDPR) and regulations can be costly; any failure to comply with these regulatory standards could subject us to legal and reputational risks.