Dollar General 2015 Annual Report Download - page 89

10-K
share information with vendors that assist us in conducting our business (for example, third-party
vendors assist us in the transmittal of credit and debit card information in connection with sales), as
required by law, or with the permission of the individual. While we have implemented procedures and
technology intended to protect and safeguard our information and require appropriate controls of our
vendors, it is possible that computer hackers and others might compromise our security measures or
those of our technology and other vendors in the future and obtain the personal information of our
customers, employees and vendors that we hold or our business information, as cyberattacks are rapidly
evolving and becoming increasingly sophisticated. Moreover, employee error or malfeasance or other
irregularities may result in a defeat of our or our third-party vendors’ security measures and breach our
or our third-party vendors’ information systems.
Because we accept debit and credit cards for payment, we are subject to the Payment Card
Industry Data Security Standards (‘‘PCI DSS’’), issued by the Payment Card Industry Security
Standards Council. PCI DSS contains compliance guidelines and standards with regard to our security
surrounding the physical and electronic storage, processing, and transmission of cardholder data.
Additionally, we have implemented technology in all of our stores to allow for the acceptance of
Europay, Mastercard and Visa (EMV) credit transactions. Complying with PCI DSS standards and
implementing related procedures, technology and information security measures require significant
resources and ongoing attention. However, even as we comply with PCI DSS standards and offer
EMV technology in our stores, we may be vulnerable to, and unable to detect and appropriately
respond to, data security breaches and data loss, including cybersecurity attacks or other breach of
cardholder data.
A security breach of any kind (whether experienced by us or one of our vendors), which could be
undetected for a period of time, or any failure by us to comply with the applicable privacy and
information security laws, regulations and standards could expose us to risks of data loss, litigation,
government enforcement actions, fines or penalties, and costly response measures (including, for
example, providing notification to, and credit monitoring services for, affected customers, as well as
further upgrades to our security measures) which may not be covered by or may exceed the coverage
limits of our insurance policies, and could materially disrupt our operations. Any resulting negative
media attention and publicity could significantly harm our reputation which could cause us to lose
market share as a result of customers discontinuing the use of debit or credit cards in our stores or not
shopping in our stores altogether and could have a material adverse effect on our business and
financial performance.
Deterioration in market conditions or changes in our credit profile could adversely affect our business
operations and financial condition.
We rely on the positive cash flow we generate from our operating activities and our access to the
credit and capital markets to fund our operations, growth strategy, and return of cash to our
shareholders through share repurchases and dividends. Changes in the credit and capital markets,
including market disruptions, limited liquidity and interest rate fluctuations, may increase the cost of
financing or restrict our access to these potential sources of future liquidity. Our continued access to
these liquidity sources on favorable terms depends on multiple factors, including our operating
performance and our credit ratings. Our debt securities currently have an investment grade rating, and
a downgrade of this rating likely would negatively impact our access to the debt capital markets and
increase our cost of borrowing. As a result, any disruptions or turmoil in the debt markets or any
downgrade of our credit ratings could adversely affect our business operations and financial condition
and our ability to return cash to our shareholders. There can be no assurances that our ability to obtain
additional financing through the debt markets will not be adversely impacted by economic conditions or
that we will be able to maintain or improve our current credit ratings.
15