Capital One 2013 Annual Report Download - page 48

breach, depending on the nature of the disruption or breach, it could lead to unauthorized transactions on Capital
One accounts or unauthorized access to personal or confidential information maintained by those entities. A
disruption or breach such as these could result in significant legal and financial exposure, regulatory intervention,
remediation costs, card reissuance, supervisory liability, damage to our reputation or loss of confidence in the
security of our systems, products and services that could adversely affect our business.
Information security risks for large financial institutions like us have generally increased in recent years in part
because of the proliferation of new technologies, the use of the Internet and telecommunications technologies to
conduct financial transactions and the increased sophistication and activities of organized crime, perpetrators of
fraud, hackers, terrorists, activists, formal and informal instrumentalities of foreign governments and other
external parties. As noted above, our operations rely on the secure processing, transmission and storage of
confidential information in our computer systems and networks. Our businesses rely on our digital technologies,
computer and email systems, software and networks to conduct their operations. In addition, to access our
products and services, our customers may use computers, smartphones, tablet PCs and other mobile devices that
are beyond our security control systems. Although we believe we have a robust suite of authentication and
layered information security controls, our technologies, systems, networks and our customers’ devices may
become the target of cyber-attacks or other attacks that could result in the unauthorized release, gathering,
monitoring, misuse, loss or destruction of our or our customers’ confidential, proprietary or other information,
including access to accounts with online functionality, which could result in disruptions and damage to the
business operations or finances of Capital One, our customers or other third parties. For example, we and other
U.S. financial services providers were targeted recently on several occasions with distributed denial-of-service
(“DDOS”) attacks from sophisticated third parties. DDOS attacks are designed to saturate the targeted online
network with excessive amounts of network traffic, resulting in slow response times or even causing the site to
be temporarily unavailable. On at least one occasion, a DDOS attack successfully disrupted our consumer online
banking services for a period of time, which had a non-material impact on our business. Although we have not
experienced any material losses relating to cyber incidents, there can be no assurance that we will not suffer such
losses in the future. If future attacks like these are successful or if customers are unable to access their accounts
online for other reasons, it could adversely impact our ability to service customer accounts or loans, complete
financial transactions for our customers or otherwise operate any of our businesses or services. In addition, a
breach or attack affecting one of our third-party service providers or partners could harm our business even if we
do not control the service that is attacked.
Because the methods and techniques employed by perpetrators of fraud and others to attack, disable, degrade or
sabotage platforms, systems and applications change frequently, are increasingly sophisticated and often are not
fully recognized or understood until after they have been launched, we and our third-party service providers and
partners may be unable to anticipate certain attack methods in order to implement effective preventative
measures. In addition, the increasing prevalence of cyber-attacks and other efforts to breach or disrupt our
systems or those of our partners, retailers or other market participants has led, and will likely continue to lead, to
increased costs to us with respect to preventing, mitigating and remediating these risks, as well as any related
attempted fraud. Further, successful cyber-attacks at other large financial institutions or other market
participants, whether or not we are impacted, could lead to a general loss of customer confidence in financial
institutions that could negatively affect us, including harming the market perception of the effectiveness of our
security measures or the financial system in general which could result in reduced use of our financial products.
Though we have insurance against some cyber-risks and attacks, it may not be sufficient to offset the impact of a
material loss event.
The Growth Of Our Direct Banking Business Presents Certain Risks.
We operate the largest online direct banking institution in the U.S., with approximately $104 billion in deposits
as of December 31, 2013. While direct banking represents a significant opportunity to attract new customers that
value greater and more flexible access to banking services at reduced costs, it also presents significant risks. In
addition to the software, infrastructure and cyber-attack risks discussed above, we face risks related to direct
28