In connection with sales, we transmit confidential credit and debit card information which is encrypted using point-to-point encryption. We also have access to, collect or maintain certain private or confidential information regarding our customers, employees and their dependents, and vendors, as well as our business. Some of this information is stored electronically in connection with our e-commerce and mobile applications, some of which may leverage third-party service providers. Additionally, we may share information with and depend upon select vendors to assist us in conducting our business. While we have implemented procedures and technology intended to protect such information and require appropriate controls of our vendors, external attackers could compromise such controls and result in unauthorized disclosure of such information, as attacks are becoming increasingly sophisticated, may include attacks on our third-party business partners, and do not always or immediately produce detectable indicators of compromise. Moreover, inadvertent or malicious internal personnel actions could result in a defeat of security measures and a compromise of our or our third-party vendors’ information systems. Furthermore, if a vendor is the victim of a cyberattack, including a ransomware attack, such attack could have a corresponding material effect on our ability to do business with that vendor or to receive information that may be required to timely prepare our financial statements. Due to the political tensions involving China, the conflict between Russia and Ukraine and the conflict in the Middle East, there is an increased likelihood that escalation of tensions could result in cyberattacks that could directly or indirectly impact our operations. Like other retailers, we and our vendors have experienced threats to, and incidents involving, data and systems, including by perpetrators of attempted random or targeted malicious attacks; computer malware, ransomware, bots, or other destructive or disruptive hardware and/or software; and attempts to misappropriate our and our customers’ information and cause system failures and disruptions, although to date none have been material to our business. If attackers obtain customer, employee or vendor passwords through unrelated third-party breaches, and if impacted customers, employees, or vendors do not employ good online security practices (e.g., use the same password across different sites or do not use available multifactor authentication options), these passwords could be used to gain access to their information or accounts with us in certain situations.
Because we accept debit and credit cards for payment, we are subject to industry data protection standards and protocols, such as the Payment Card Industry Data Security Standards, issued by the Payment Card Industry Security Standards Council. Nonetheless, we or our applicable payment processing partner(s), may be vulnerable to, and unable to detect and appropriately respond to, cardholder data security breaches and data loss, including successful attacks on applications, systems, or networks.
A significant security breach of any kind experienced by us or one of our vendors, which could be undetected for a period of time, or a significant failure by us or one of our vendors to comply with applicable privacy and information security laws, regulations, standards, and related reporting requirements could expose us to risks of data loss, litigation, government enforcement actions, fines or penalties, credit card brand assessments, negative publicity and reputational harm, business disruption and costly response measures (e.g., providing