We cannot assure that our security measures, change control procedures or disaster recovery plans will be adequate to prevent disruptions or delays in connection with systems integration or replacement. Disruptions in or changes to these systems could result in a disruption to our business and the loss of important data. Any of the foregoing could result in a material adverse effect on our business, results of operations and financial condition. Evolving data security and privacy requirements could increase our costs, and any significant data security incident could disrupt our operations, harm our reputation, expose us to legal risks and otherwise materially adversely affect our business, results of operations and financial condition. Our business requires the secure processing and storage of sensitive information relating to our customers, employees, business partners and others. However, like any global enterprise operating in today’s digital business environment, we are subject to threats to the security of our networks and data, including threats potentially involving criminal hackers, hacktivists, state-sponsored actors, corporate espionage, employee malfeasance, and human or technological error. These threats continue to increase as the frequency, intensity and sophistication of attempted attacks and intrusions increase around the world. We have been the target of cybersecurity attacks in the past and expect that we will continue to be in the future. Furthermore, in response to these threats there has been heightened legislative and regulatory focus on data privacy and cybersecurity in the U.S., the EU and elsewhere, particularly with respect to critical infrastructure providers, including those in the transportation sector. As a result, we must comply with a proliferating and fast-evolving set of legal requirements in this area, including substantive cybersecurity standards as well as requirements for notifying regulators and affected individuals in the event of a data security incident. This regulatory environment is increasingly challenging and may present material obligations and risks to our business, including significantly expanded compliance burdens, costs and enforcement risks. For example, in May 2018, the EU’s new General Data Protection Regulation, commonly referred to as GDPR, came into effect, which imposes a host of new data privacy and security requirements, imposing significant costs on us and carrying substantial penalties for non-compliance. In addition, many of our commercial partners, including credit card companies, have imposed data security standards that we must meet. In particular, we are required by the Payment Card Industry Security Standards Council, founded by the credit card companies, to comply with their highest level of data security standards. While we continue our efforts to meet these standards, new and revised standards may be imposed that may be difficult for us to meet and could increase our costs. A significant cybersecurity incident could result in a range of potentially material negative consequences for us, including unauthorized access to, disclosure, modification, misuse, loss or destruction of company systems or data; theft of sensitive, regulated or confidential data, such as personal identifying information or our intellectual property; the loss of functionality of critical systems through ransomware, denial of service or other attacks; a deterioration in our relationships with business partners and other third parties; and business delays, service or system disruptions, damage to equipment and injury to persons or property. The methods used to obtain unauthorized access, disable or degrade service or sabotage systems are constantly evolving and may be difficult to anticipate or to detect for long periods of time. The constantly changing nature of the threats means that we may not be able to prevent all data security breaches or misuse of data. Similarly, we depend on the ability of our key commercial partners, including our regional carriers, distribution partners and technology vendors, to conduct their businesses in a manner that complies with applicable security standards and assures their ability to perform on a timely basis. A security failure, including a failure to meet relevant payment security standards, breach or other significant cybersecurity incident affecting one of our partners could result in potentially material negative consequences for us. In addition, the costs and operational consequences of defending against, preparing for, responding to and remediating an incident of cybersecurity breach may be substantial. As cybersecurity threats become more frequent, intense and sophisticated, costs of proactive defense measures are increasing. Further, we could be exposed to litigation, regulatory enforcement or other legal action as a result of an incident, carrying the potential for damages, fines, sanctions or other penalties, as well as injunctive relief and enforcement actions requiring costly compliance measures. A significant number of recent privacy and data security incidents, including those involving other large airlines, have resulted in very substantial adverse financial consequences to those companies. A cybersecurity incident could also impact our brand, harm our reputation and adversely impact our relationship with our customers, employees and stockholders. Accordingly, failure to appropriately address these issues could result in material financial and other liabilities and cause significant reputational harm to our company. 28