AmazonScience/document-haystack

1unable to successfully manage our expenses, our financial results will be negatively affected. Changes to our business, 2including those resulting from our strategic imperatives, also require robust governance to ensure that our objectives are 3executed as intended without adversely impacting our customers, associates, operations or financial performance. Ineffective 4change management oversight and governance over the execution of our key projects and initiatives could expose us to 5operational, strategic and reputational risk and could negatively impact customers or our financial performance.6A cyber-attack or other security incident on us or third parties (including their supply chains) with which we conduct 7business, including an incident that results in the theft, loss, manipulation or misuse of information (including personal 8information), or the disabling of systems and access to information critical to business operations, may result in increased 9costs, reductions in revenue, reputational damage, legal exposure and business disruptions.10Our ability to provide our products and services and communicate with our customers, depends upon the management and 11safeguarding of information systems and infrastructure, networks, software, data, technology, methodologies and business 12secrets, including those of our service providers. Our products and services involve the collection, authentication, management, 13usage, storage, transmission and destruction of sensitive and confidential information, including personal information, 14regarding our customers and their accounts, our employees, our partners and other third parties with which we do business. We 15also have arrangements in place with third-party business partners through which we share and receive information about their 16customers who are or may become our customers. The financial services industry, including Capital One, is particularly at risk 17because of the increased use of and reliance on digital banking products and other digital services, including mobile banking 18products, such as mobile payments, and other internet- and cloud-based products and applications, and the development of 19additional remote connectivity solutions, which increase cybersecurity risks and exposure. In addition, global events and 20geopolitical instability (including, without limitation, the war between Israel and Hamas, the war between Ukraine and Russia 21and the related sanctions imposed by the U.S. and other countries, and increased geopolitical tensions between the U.S. and 22China) may lead to increased nation state targeting of financial institutions in the U.S. and abroad.   23Technologies, systems, networks and other devices of Capital One, as well as those of our employees, service providers, 24partners and other third parties with whom we interact, have been and may continue to be the subject of cyber-attacks and other 25security incidents, including computer viruses, hacking, malware, ransomware, supply chain attacks, vulnerabilities, credential 26stuffing, account takeovers, insider threats, business email compromise scams or phishing or other forms of social engineering. 27Such cyber-attacks and other security incidents are designed to lead to various harmful outcomes, such as unauthorized 28transactions in Capital One accounts, unauthorized or unintended access to or release, gathering, monitoring, disclosure, loss, 29destruction, corruption, disablement, encryption, misuse, modification or other processing of confidential or sensitive 30information (including personal information), intellectual property, software, methodologies or business secrets, disruption, 31sabotage or degradation of service, systems or networks, an attempt to extort Capital One, its third-party service providers or its 32business partners or other damage. Cyber-attacks and other security incidents that occur in the supply chain of third parties with 33which we interact could also negatively impact Capital One.34These threats may derive from, among other things, error, fraud or malice on the part of our employees, insiders, or third parties 35or may result from accidental technological failure or design flaws. Any of these parties may also attempt to fraudulently induce 36employees, service providers, customers, partners or other third-party users of our systems or networks to disclose confidential 37or sensitive information (including personal information) in order to gain access to our systems, networks or data or that of our 38customers, partners, or third parties with whom we interact, or to unlawfully obtain monetary benefit through misdirected or 39otherwise improper payment. For instance, any party that obtains our confidential or sensitive information (including personal 40information) through a cyber-attack or other security incident may use this information for ransom, to be paid by us or a third 41party, as part of a fraudulent activity that is part of a broader criminal activity, or for other illicit purposes. Additionally, the 42failure of our employees, third-party service providers or business partners, or their respective supply chains, to exercise sound 43judgment and vigilance when targeted with social engineering or other cyber-attacks may increase our vulnerability.44For example, on July 29, 2019, we announced that on March 22 and 23, 2019 an outside individual gained unauthorized access 45to our systems (the “2019 Cybersecurity Incident”). This individual obtained certain types of personal information relating to 46people who had applied for our credit card products and to our credit card customers. While the 2019 Cybersecurity Incident 47has been remediated, it resulted in fines, litigation, consent orders, settlements, government investigations and other regulatory 48enforcement inquiries. Cyber and information security risks for large financial institutions like us continue to increase due to the 49proliferation of new technologies, the industry-wide shift to reliance upon the internet to conduct financial transactions, the 50increased sophistication and activities of malicious actors, organized crime, perpetrators of fraud, hackers, terrorists, activists, 51extremist parties, formal and informal instrumentalities of foreign governments, state-sponsored or nation-state actors and other 52external parties and the growing use of AI by threat actors. In addition, our customers access our products and services using 53personal devices that are necessarily external to our security control systems. There has also been a significant proliferation of 5431 Capital One Financial Corporation (COF)