target of attempted cyber and other security threats by outside third parties, including technically sophisticated and well-resourced bad actors attempting to access or steal the data we store. Insider or employee cyber and security threats are also a significant concern for all companies, including ours. Despite our substantial investment in physical and technological security measures, employee training and contractual precautions, our information technology networks and infrastructure (or those of our third-party vendors and other service providers) are potentially vulnerable to unauthorized access to data or breaches of confidential information due to criminal conduct, attacks by hackers, employee or insider malfeasance and/or human error. The techniques used to obtain unauthorized access, disable or degrade service or sabotage systems are constantly evolving and often are not recognized until launched against a target, or even some time after. We may be unable to anticipate these techniques, implement adequate preventative measures or remediate any intrusion on a timely or effective basis even if our security measures are appropriate, reasonable, and/or comply with applicable legal requirements. Certain efforts may be state-sponsored and supported by significant financial and technological resources, making them even more sophisticated and difficult to detect. Further, we are in the process of transforming our applications and infrastructure technologies, and this transition to cloud-based technologies may expose us to additional cyber threats as we migrate our data from our legacy systems to cloud-based solutions hosted by third parties. Although we have developed systems and processes that are designed to protect our data and customer data and to prevent data loss and other security breaches, and expect to continue to expend significant additional resources to bolster these protections, these security measures cannot provide absolute security. In 2017, we experienced a cybersecurity incident following a criminal attack on our systems that involved the theft of personally identifiable information of U.S., Canadian and U.K. consumers. If we experience additional breaches of our security measures, including from incidents that we fail to detect for a period of time, sensitive data may be accessed, stolen, disclosed or lost. Any such access, disclosure or other loss of information could subject us to significant litigation, regulatory fines or penalties, any of which could have a material adverse effect on our cash flows, competitive position, financial condition or results of operations. We cannot ensure that our insurance policies in the future will be adequate to cover losses from any future security breaches. For example, our $125.0 million cybersecurity insurance policy was not adequate to cover the losses we have incurred to date from the 2017 cybersecurity incident. Security breaches and the adverse publicity that may follow could also have a negative impact on our reputation and our relationship with our customers. For example, our reputation with consumers and other stakeholders and our customer relationships were damaged following the 2017 cybersecurity incident, resulting in a negative impact on our revenue. If we experience another material cybersecurity incident or are otherwise unable to demonstrate the security of our systems and the data we maintain and retain the trust of our customers, consumers and data suppliers, we could experience a substantial negative impact on our business. We are required by customers and business partners to obtain various industry or technical certifications. Such certifications are critical to our business because certain of our current and potential customers and the contracts governing certain customer relationships, as well as certain of our data suppliers, require us to maintain them as a requirement of doing business. For example, as a result of the 2017 cybersecurity incident, we lost certain key certifications which caused certain customers and business partners to stop or pause doing business with us and temporarily limited our ability to win new business. We had to spend significant resources on remediation activities in order to obtain these key re-certifications. If we fail to achieve or maintain key industry or technical certifications as a result of another cybersecurity incident or for other reasons, customers and business partners may stop doing business with us and we may not be able to win new business, which would negatively affect our revenue. We face various risks related to health epidemics, pandemics and similar outbreaks, including the global outbreak of COVID-19 in 2020. The COVID-19 pandemic and the mitigation efforts by governments to attempt to control its spread have adversely impacted the global economy, leading to reduced consumer spending and lending activities and disruptions and volatility in the global capital markets. Our customers, and therefore our business and revenues, are sensitive to negative changes in general economic conditions. We experienced significant revenue declines in several of our markets as a result of COVID-19. We expect that the negative impacts of the COVID-19 pandemic on our operating revenue will continue until health and economic conditions improve. Our business has been and will continue to be negatively impacted by the recent COVID-19 outbreak. Strategy and Market Demand Risks If we fail to achieve and maintain key industry or technical certifications, our customers and business partners may stop doing business with us and we may not be able to win new business, which would negatively affect our revenue. 16