1 unchanged sentence
In addition to the risk factors identified in our 2020 Annual Report, please consider the following revised risk factor.
−Removed: Cyberattacks, cyber fraud, and unauthorized information disclosure could harm our reputation, result in liability and service outages, any of which could adversely affect our business and results of operations
+Added: Cyberattacks, cyber fraud, and unauthorized information disclosure could harm our reputation, and result in liability and service outages, any of which could adversely affect our business and results of operations
Our business involves the use, storage, and transmission of information about our clients, their customers, and our employees.
We also monitor and support information systems for certain clients through cloud-based and on-client-premises managed services model.
−Removed: While we take reasonable measures to protect the security of and unauthorized access to our systems and to our clients’ systems;
−Removed: and the privacy of personal and proprietary information that we access and store, our security controls over our systems may not be adequate to prevent the improper access to these systems or disclosure of information stored on these systems.
+Added: While we believe that we take reasonable measures to protect the security of and unauthorized access to our systems and to our clients’ systems, and the privacy of personal and proprietary information that we access and store, our security controls over our systems have not prevented and in the future may not prevent improper access to these systems or disclosure of information stored on these systems.
Such unauthorized access or disclosure could subject TTEC to significant liability under relevant law or our contracts and could harm our reputation, resulting in impacts on our results of operations, loss of future revenue and business opportunities.
1 unchanged sentence
In recent years, there have been an increasing number of high-profile security breaches at companies and government agencies, and security experts have warned about the growing risks of hackers, cybercriminals and state actors launching a broad range of ransomware, data exfiltration, and other cyberattacks targeting information technology systems.
−Removed: Information security breaches, computer viruses, service interruption, loss of business data, DDoS (distributed denial of service) attacks, ransomware and other cyberattacks on any of our systems or on our clients’ systems that we manage could disrupt our normal operations of customer experience centers, our remote customer experience service delivery, our cloud platform digital offerings, our clients’ on-premise managed service offerings, and our enterprise services, impeding our ability to provide critical services to our clients.
−Removed: On July 2, 2021, our subsidiary Avtex Solutions, LLC (“Avtex”) and some of its clients experienced a ransomware attack as part of a global supply chain compromise that impacted thousands of companies worldwide and is believed to have been orchestrated by a Russian-based REvil cybercriminal group.
+Added: Information security breaches, computer viruses, service interruption, loss of business data, DDoS (distributed denial of service) attacks, ransomware and other cyberattacks on any of our systems or on our clients’ systems that we manage have or in the future could disrupt the normal operations of our customer experience centers, our remote customer experience service delivery, our cloud platform digital offerings, our clients’ on-premise managed service offerings, and our enterprise services, impeding our ability to provide critical services to our clients.
+Added: Techniques used by cyber criminals to obtain unauthorized access, disable or degrade services, or sabotage systems evolve frequently and may not immediately be detected, and we may be unable to implement adequate preventative measures
+Added: For example, on September 12, 2021, TTEC experienced a cybersecurity incident that involved our information systems.
+Added: Certain TTEC systems and data became encrypted;
+Added: and certain TTEC data was exfiltrated or destroyed The incident resulted in a temporary disruption to the Engage business segment’s client support environment (see Part I, Item 2.
+Added: Management's Discussion and Analysis of Financial Condition and Results of Operations for additional information regarding the security incident).
+Added: TTEC restored and continues to rebuild many of the systems and data impacted in the incident.
+Added: TTEC recovered exfiltrated data from the unauthorized parties, and while we currently have no reasons to believe that such data was publicly released, no assurance can be made that it was not released or that it may not be released in the future.
+Added: In addition, as a result of the incident, some clients opted to suspend our access to their networks as a security precaution until they were satisfied that the incident was contained.
+Added: As of the date of this disclosure, we have returned to services with all our clients.
+Added: As another example, on July 2, 2021, our subsidiary Avtex Solutions, LLC (“Avtex”) and some of its clients experienced a ransomware attack as part of a global supply chain compromise that impacted thousands of companies worldwide and is believed to have been orchestrated by a Russian-based REvil cybercriminal group.
The attack exploited a vulnerability in a Kaseya VSA remote monitoring software that Avtex utilized in its managed services solution (“Kaseya REvil attack”).
2 unchanged sentences
Over the course of the following weeks, the Company assisted Avtex’s affected clients in restoring their systems to full operations.
−Removed: While we believe that we have remediated the immediate consequences of the incident, cybersecurity events may have cascading effects that unfold over time and result in additional costs, including costs associated with investigations, contractual claims, performance penalties, litigation, future business cancelations and other losses.
+Added: While we believe that we have remediated the immediate consequences of these cybersecurity incidents, cybersecurity events may have cascading effects that unfold over time and result in additional costs, including costs associated with investigations, government enforcement actions, regulatory investigations, fines and penalties, contractual claims, performance penalties, litigation, financial judgement or settlements in excess of insurance, disputes with insurance carriers concerning coverage, loss of clients’ trust, future business cancelations and other losses.
Any perception by existing and prospective clients that our systems or the information system environments that we support for our clients are not secure could result in a material loss of business and revenue and damage our reputation and competitiveness.
−Removed: As others in many industries, we are experiencing an increase in frequency of cyber-fraud attempts, such as so-called “social engineering” attacks and phishing scams, which typically seek unauthorized money transfers or information disclosure.
+Added: As others in many industries, we are experiencing an increase in frequency of cybersecurity and cyber fraud attempts, including phishing attempts, and so-called “social engineering” attacks, which typically seek unauthorized access into the environment, money transfers or unauthorized information disclosure.
We actively train our employees to recognize these attacks and have implemented proactive risk mitigation measures to curb them.
−Removed: There are no assurances, however, that these attacks, which are growing in sophistication, may not deceive our employees, resulting in a material loss.
−Removed: While we have taken reasonable measures to protect our systems and processes from unauthorized intrusions and cyber-fraud, we cannot be certain that advances in cyber-criminal capabilities, discovery of new system vulnerabilities, and attempts to exploit such vulnerabilities will not compromise or breach the technology protecting our systems and the information that we manage and control, which could result in damage to our systems, our reputation, and our profitability.
+Added: There are no assurances, however, that these attacks, which are growing in sophistication and frequency, may not deceive our employees, resulting in a material loss and impacts to our operations and back-office environments.
+Added: While believe we have taken reasonable measures to protect our systems and processes from unauthorized intrusions and cyber-fraud, we cannot be certain that advances in cyber-criminal capabilities, discovery of new system vulnerabilities, and attempts to exploit such vulnerabilities will not compromise or breach the technology protecting our systems and the information that we manage and control, which could result in damage to our systems, our reputation, and our profitability.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.