Capital One 2014 Annual Report Download - page 48

card reissuance, supervisory liability, damage to our reputation or loss of confidence in the security of our systems,
products and services that could adversely affect our business.
Information security risks for large financial institutions like us have generally increased in recent years in part
because of the proliferation of new technologies, the use of the internet and telecommunications technologies to
conduct financial transactions and the increased sophistication and activities of organized crime, perpetrators of
fraud, hackers, terrorists, activists, formal and informal instrumentalities of foreign governments and other external
parties. As noted above, our operations rely on the secure processing, transmission and storage of confidential
information in our computer systems and networks. Our businesses rely on our digital technologies, computer and
email systems, software and networks to conduct their operations. In addition, to access our products and services,
our customers may use computers, smartphones, tablet PCs and other mobile devices that are beyond our security
control systems. Although we believe we have a robust suite of authentication and layered information security
controls, our technologies, systems, networks and our customers’ devices may become the target of cyber-attacks
or other attacks that could result in the unauthorized release, gathering, monitoring, misuse, loss or destruction
of our or our customers’ confidential, proprietary or other information, including access to accounts with online
functionality, which could result in disruptions and damage to the business operations or finances of Capital One,
our customers or other third parties. For example, we and other U.S. financial services providers continue to be
targeted with evolving and adaptive distributed DDOS attacks from sophisticated third parties. DDOS attacks are
designed to saturate the targeted online network with excessive amounts of network traffic, resulting in slow response
times or even causing the site to be temporarily unavailable. On at least one occasion, a DDOS attack successfully
disrupted our consumer online banking services for a period of time, which had a non-material impact on our business.
Although we have not experienced any material losses relating to cyber incidents, there can be no assurance that we
will not suffer such losses in the future. If future attacks like these are successful or if customers are unable to access
their accounts online for other reasons, it could adversely impact our ability to service customer accounts or loans,
complete financial transactions for our customers or otherwise operate any of our businesses or services. In addition,
a breach or attack affecting one of our third-party service providers or partners could harm our business even if we do
not control the service that is attacked.
Because the methods and techniques employed by perpetrators of fraud and others to attack, disable, degrade or sabotage
platforms, systems and applications change frequently, are increasingly sophisticated and often are not fully recognized
or understood until after they have been launched, we and our third-party service providers and partners may be unable
to anticipate certain attack methods in order to implement effective preventative measures. In addition, the increasing
prevalence of cyber-attacks and other efforts to breach or disrupt our systems or those of our partners, retailers or other
market participants has led, and will likely continue to lead, to increased costs to us with respect to preventing, mitigating
and remediating these risks, as well as any related attempted fraud. For example, various retailers have recently been
victims of cyber-attacks in which customer data, including debit and credit card information, was obtained. In these
situations, we incur a variety of costs, including those associated with replacing the compromised cards and remediating
fraudulent transaction activity. Further, successful cyber-attacks at other large financial institutions or other market
participants, whether or not we are impacted, could lead to a general loss of customer confidence in financial institutions
that could negatively affect us, including harming the market perception of the effectiveness of our security measures
or the financial system in general which could result in reduced use of our financial products. Though we have insurance
against some cyber-risks and attacks, it may not be sufficient to offset the impact of a material loss event.
We May Fail To Realize All Of The Anticipated Benefits Of Our Mergers, Acquisitions And Strategic Partnerships.
We have engaged in merger and acquisition activity and entered into strategic partnerships over the past several
years and may continue to engage in such activity in the future. We continue to evaluate and anticipate engaging in,
among other merger and acquisition activity, additional strategic partnerships and selected acquisitions of financial
institutions and other financial assets, including credit card and other loan portfolios.
Any merger, acquisition or strategic partnership we undertake will entail certain risks, which may materially and adversely
affect our results of operations. If we experience greater than anticipated costs to integrate acquired businesses into our
26 Capital One Financial Corporation (COF)