Item 1A. Risk Factors
ITEM 1A. RISK FACTORS
In addition to the other information set forth in this report, you should carefully consider the factors discussed in Item 1A, Risk factors, in our 2020 Annual Report on Form 10-K , which could materially affect our business, financial condition or future results. In addition to the risk factors identified in our 2020 Annual Report, please consider the following revised risk factor.
Cyberattacks, cyber fraud, and unauthorized information disclosure could harm our reputation, result in liability and service outages, any of which could adversely affect our business and results of operations
Our business involves the use, storage, and transmission of information about our clients, their customers, and our employees. We also monitor and support information systems for certain clients through cloud-based and on-client-premises managed services model. While we take reasonable measures to protect the security of and unauthorized access to our systems and to our clients’ systems; and the privacy of personal and proprietary information that we access and store, our security controls over our systems may not be adequate to prevent the improper access to these systems or disclosure of information stored on these systems. Such unauthorized access or disclosure could subject TTEC to significant liability under relevant law or our contracts and could harm our reputation, resulting in impacts on our results of operations, loss of future revenue and business opportunities. These risks may further increase as our business model now includes higher percentage of work from home delivery, in addition to our traditional delivery through customer experience centers.
In recent years, there have been an increasing number of high-profile security breaches at companies and government agencies, and security experts have warned about the growing risks of hackers, cybercriminals and state actors launching a broad range of ransomware, data exfiltration, and other cyberattacks targeting information technology systems. Information security breaches, computer viruses, service interruption, loss of business data, DDoS (distributed denial of service) attacks, ransomware and other cyberattacks on any of our systems or on our clients’ systems that we manage could disrupt our normal operations of customer experience centers, our remote customer experience service delivery, our cloud platform digital offerings, our clients’ on-premise managed service offerings, and our enterprise services, impeding our ability to provide critical services to our clients.
On July 2, 2021, our subsidiary Avtex Solutions, LLC (“Avtex”) and some of its clients experienced a ransomware attack as part of a global supply chain compromise that impacted thousands of companies worldwide and is believed to have been orchestrated by a Russian-based REvil cybercriminal group. The attack exploited a vulnerability in a Kaseya VSA remote monitoring software that Avtex utilized in its managed services solution (“Kaseya REvil attack”). TTEC systems and TTEC’s client support environments, outside of Avtex, were not impacted by the Kaseya REvil attack. Utilizing its standard cyber incident response protocols, TTEC recovered Avtex’s operating environment within hours of the attack and restored Avtex to full operating capacity by July 3, 2021. Over the course of the following weeks, the Company assisted Avtex’s affected clients in restoring their systems to full operations. While we believe that we have remediated the immediate consequences of the incident, cybersecurity events may have cascading effects that unfold over time and result in additional costs, including costs associated with investigations, contractual claims, performance penalties, litigation, future business cancelations and other losses. Any perception by existing and prospective clients that our systems or the information system environments that we support for our clients are not secure could result in a material loss of business and revenue and damage our reputation and competitiveness.
47
Table of Contents
As others in many industries, we are experiencing an increase in frequency of cyber-fraud attempts, such as so-called “social engineering” attacks and phishing scams, which typically seek unauthorized money transfers or information disclosure. We actively train our employees to recognize these attacks and have implemented proactive risk mitigation measures to curb them. There are no assurances, however, that these attacks, which are growing in sophistication, may not deceive our employees, resulting in a material loss.
While we have taken reasonable measures to protect our systems and processes from unauthorized intrusions and cyber-fraud, we cannot be certain that advances in cyber-criminal capabilities, discovery of new system vulnerabilities, and attempts to exploit such vulnerabilities will not compromise or breach the technology protecting our systems and the information that we manage and control, which could result in damage to our systems, our reputation, and our profitability.
Text extracted from the filing as submitted to EDGAR. Formatting, tables and exhibits are simplified for reading; the original document is authoritative for anything you rely on.