Item 1A. Risk Factors
ITEM 1A. RISK FACTORS
In addition to the other information set forth in this report, you should carefully consider the factors discussed in Item 1A, Risk factors, in our 2020 Annual Report on Form 10-K , which could materially affect our business, financial condition or future results. In addition to the risk factors identified in our 2020 Annual Report, please consider the following revised risk factor.
48
Table of Contents
Cyberattacks, cyber fraud, and unauthorized information disclosure could harm our reputation, and result in liability and service outages, any of which could adversely affect our business and results of operations
Our business involves the use, storage, and transmission of information about our clients, their customers, and our employees. We also monitor and support information systems for certain clients through cloud-based and on-client-premises managed services model. While we believe that we take reasonable measures to protect the security of and unauthorized access to our systems and to our clients’ systems, and the privacy of personal and proprietary information that we access and store, our security controls over our systems have not prevented and in the future may not prevent improper access to these systems or disclosure of information stored on these systems. Such unauthorized access or disclosure could subject TTEC to significant liability under relevant law or our contracts and could harm our reputation, resulting in impacts on our results of operations, loss of future revenue and business opportunities. These risks may further increase as our business model now includes higher percentage of work from home delivery, in addition to our traditional delivery through customer experience centers.
In recent years, there have been an increasing number of high-profile security breaches at companies and government agencies, and security experts have warned about the growing risks of hackers, cybercriminals and state actors launching a broad range of ransomware, data exfiltration, and other cyberattacks targeting information technology systems. Information security breaches, computer viruses, service interruption, loss of business data, DDoS (distributed denial of service) attacks, ransomware and other cyberattacks on any of our systems or on our clients’ systems that we manage have or in the future could disrupt the normal operations of our customer experience centers, our remote customer experience service delivery, our cloud platform digital offerings, our clients’ on-premise managed service offerings, and our enterprise services, impeding our ability to provide critical services to our clients. Techniques used by cyber criminals to obtain unauthorized access, disable or degrade services, or sabotage systems evolve frequently and may not immediately be detected, and we may be unable to implement adequate preventative measures
For example, on September 12, 2021, TTEC experienced a cybersecurity incident that involved our information systems. Certain TTEC systems and data became encrypted; and certain TTEC data was exfiltrated or destroyed The incident resulted in a temporary disruption to the Engage business segment’s client support environment (see Part I, Item 2. Management's Discussion and Analysis of Financial Condition and Results of Operations for additional information regarding the security incident). TTEC restored and continues to rebuild many of the systems and data impacted in the incident. TTEC recovered exfiltrated data from the unauthorized parties, and while we currently have no reasons to believe that such data was publicly released, no assurance can be made that it was not released or that it may not be released in the future. In addition, as a result of the incident, some clients opted to suspend our access to their networks as a security precaution until they were satisfied that the incident was contained. As of the date of this disclosure, we have returned to services with all our clients.
As another example, on July 2, 2021, our subsidiary Avtex Solutions, LLC (“Avtex”) and some of its clients experienced a ransomware attack as part of a global supply chain compromise that impacted thousands of companies worldwide and is believed to have been orchestrated by a Russian-based REvil cybercriminal group. The attack exploited a vulnerability in a Kaseya VSA remote monitoring software that Avtex utilized in its managed services solution (“Kaseya REvil attack”). TTEC systems and TTEC’s client support environments, outside of Avtex, were not impacted by the Kaseya REvil attack. Utilizing its standard cyber incident response protocols, TTEC recovered Avtex’s operating environment within hours of the attack and restored Avtex to full operating capacity by July 3, 2021. Over the course of the following weeks, the Company assisted Avtex’s affected clients in restoring their systems to full operations.
49
Table of Contents
While we believe that we have remediated the immediate consequences of these cybersecurity incidents, cybersecurity events may have cascading effects that unfold over time and result in additional costs, including costs associated with investigations, government enforcement actions, regulatory investigations, fines and penalties, contractual claims, performance penalties, litigation, financial judgement or settlements in excess of insurance, disputes with insurance carriers concerning coverage, loss of clients’ trust, future business cancelations and other losses. Any perception by existing and prospective clients that our systems or the information system environments that we support for our clients are not secure could result in a material loss of business and revenue and damage our reputation and competitiveness.
As others in many industries, we are experiencing an increase in frequency of cybersecurity and cyber fraud attempts, including phishing attempts, and so-called “social engineering” attacks, which typically seek unauthorized access into the environment, money transfers or unauthorized information disclosure. We actively train our employees to recognize these attacks and have implemented proactive risk mitigation measures to curb them. There are no assurances, however, that these attacks, which are growing in sophistication and frequency, may not deceive our employees, resulting in a material loss and impacts to our operations and back-office environments.
While believe we have taken reasonable measures to protect our systems and processes from unauthorized intrusions and cyber-fraud, we cannot be certain that advances in cyber-criminal capabilities, discovery of new system vulnerabilities, and attempts to exploit such vulnerabilities will not compromise or breach the technology protecting our systems and the information that we manage and control, which could result in damage to our systems, our reputation, and our profitability.
Text extracted from the filing as submitted to EDGAR. Formatting, tables and exhibits are simplified for reading; the original document is authoritative for anything you rely on.