We host, collect, use and retain large amounts of sensitive and personal customer and workforce data, including credit card information, tax return information, bank account numbers, credit report information, login credentials and passwords, personal and business financial data, transaction records, social security numbers and payroll information, as well as our confidential, nonpublic business information. The significant resources we expend to implement security protections designed to shield this data against potential theft and security incidents cannot provide absolute security.
Our technologies, systems, and networks have been subject to, and are increasingly likely to continue to be the target of, cyberattacks, computer viruses, ransomware or other malware, worms, social engineering, malicious software programs, insider threats, denial-of-service attacks and other cybersecurity threats that have in the past, and could in the future, result in the unauthorized release, gathering, monitoring, use, loss or destruction of sensitive and personal data of our customers and our workforce, or Intuit's sensitive business data or cause temporary or sustained unavailability of our data, software, and systems. Cybersecurity incidents can be caused by malicious third parties, acting alone or in groups, or more sophisticated organizations, including nation-states or state-sponsored organizations, and the risks could be elevated in connection with significant armed conflicts, acts of war or terrorism. Customers who fail to update their systems, continue to run software that we no longer support, fail to install security patches on a timely basis or inadequately use security controls create vulnerabilities and make it more difficult for us to detect and prevent these kinds of attacks. Further, we are increasingly incorporating open source software into our products, and there may be vulnerabilities in open source software that make it susceptible to cyberattacks. In addition, techniques used to obtain unauthorized access to sensitive information change frequently and, as technologies like AI develop rapidly, malicious third parties are using these technologies to create new sophisticated attack methods that are increasingly automated, targeted and coordinated and more difficult to defend against. We have been and may in the future be a more frequent target of cyberattacks because cyber-criminals tend to focus their efforts on well-known offerings that are popular among customers and hold sensitive personal or financial information.
Further, the security measures that we implement may not be able to prevent unauthorized access to our products and our customers’ account data. Malicious third parties have in the past, and may in the future, be able to fraudulently induce members of our workforce, customers, vendors, partners, or users by social engineering means, such as email phishing, to disclose sensitive information in order to gain access to our systems. Unauthorized access to or disclosure of customer data may occur due to inadequate use of security controls by our customers or our workforce. Accounts created with weak or recycled passwords could allow cyber-attackers to gain access to customer data. Unauthorized persons could gain access to customer accounts if customers do not maintain effective access controls of their systems and software. Inadvertent exposure of data or access to our systems may also be caused by members of our workforce, including by their error or use of AI.
Criminals may also use stolen identity information obtained outside of our systems to gain unauthorized access to our customers’ data. We have experienced such instances in the past and as the broader accessibility of stolen identity information increases, we may experience further instances of unauthorized access to our systems through the use of stolen identity information of our customers or our workforce in the future. Further, our customers may choose to use the same login credentials across multiple products and services unrelated to our products. Such customers’ login credentials may be stolen from products offered by third-party service providers unrelated to us and the stolen identity information may be used by a malicious third party to access our products, which could result in disclosure of confidential information. In addition, our hybrid workplace model, where our workforce spends a portion of their time working away from our offices, increases the potential for attacks and adds operational complexity that exacerbates our security-related risks.
Further, because we have created an ecosystem where customers can have one identity across multiple Intuit products, a security incident may give access to increased amounts of customer data. From time to time, we detect, or receive notices from customers or public or private agencies that they have detected, actual or perceived vulnerabilities in our infrastructure, our software or third-party software components that are distributed with our products or fraudulent activity by unauthorized persons utilizing our products with stolen customer identity information. The existence of such vulnerabilities or fraudulent activity, even if they do not result in a security breach, may undermine customer confidence as well as the confidence of government agencies that regulate our offerings. Such perceived vulnerabilities could also seriously harm our business by tarnishing our reputation and brand and limiting the adoption of our products and services and could cause our stock price to decline. In some cases, such vulnerabilities may not be immediately detected, which could exacerbate the risk of a security incident and the related effects on our businesses.
While we maintain cybersecurity insurance, our insurance may not be sufficient to cover all liabilities described herein. The occurrence of any of the foregoing may result in disclosure of confidential information, loss of customer confidence in our products, possible litigation, material harm to our reputation and financial condition, disruption of our or our customers’ business operations, and a decline in our stock price.
Additionally, our use of Credit Karma member data is subject to an order issued in 2014 by the Federal Trade Commission (FTC) that, among other things, requires maintenance of a comprehensive security program relating to the development and management of new and existing products and services and biennial independent security assessments for 20 years from the date of the order. Our failure to fulfill the requirements of the FTC’s order could result in fines, penalties, enforcement inquiries, investigations and claims, and negatively impact our business and reputation.