HR Block 2015 Annual Report Download - page 20

H&R Block, Inc. | 2015 Form 10-K 13
regulations continue to evolve, we may be required to expend significant additional resources to continue to modify
or enhance our protective measures or to investigate and remediate any information security vulnerabilities. Due to
the structure of our business model, we also rely on our franchisees and other private and governmental third parties
to maintain secure systems and respond to cybersecurity risks. Notwithstanding these efforts, there can be no
assurance that a security breach, intrusion, or loss or theft of personal client information will not occur.
A breach of our security measures or those of our franchisees or third parties on whom we rely, or other fraudulent
activity, could result in unauthorized access to personal client information. If such an event were to occur, it could
have serious short and long term negative consequences. Security breach remediation could require us to expend
significant resources to notify or assist impacted clients, repair damaged systems, implement improved information
security measures, and maintain client and business relationships. Other consequences could include reduced client
demand for our services and products, reduced growth and profitability and negative impacts to future financial
results, loss of our ability to deliver one or more services or products (e.g., inability to provide financial transaction
services or to accept and process client credit card orders or tax returns), litigation, harm to our reputation and brands,
fines, penalties, and other damages, and further regulation and oversight by U.S. federal, state, or foreign governmental
agencies.
A security breach or other unauthorized access to our systems could have a material adverse effect on our business
and our consolidated financial position, results of operations, and cash flows.
Stolen identity refund fraud could impede our clients' ability to timely and successfully file their tax returns and
receive their tax refunds, and could diminish consumers' perceptions of the security and reliability of our products
and services, resulting in negative publicity.
Companies offering DIY tax preparation services have seen a rise in instances of criminals utilizing stolen information
obtained through hacking, phishing, and other means of identity theft in order to electronically file fraudulent federal
and state tax returns. As a result, an increasing number of taxpayers must complete additional forms and go through
additional steps in order to report to appropriate authorities that their identities have been stolen and their tax returns
were filed fraudulently. While we offer assistance in the refund recovery process and have introduced Tax Identity
ShieldSM to help protect clients, stolen identity refund fraud could impede our clients' ability to timely and successfully
file their returns and receive their tax refunds, and could diminish consumers' perceptions of the security and reliability
of our products and services, resulting in negative publicity, despite there having been no breach in the security of
our systems. In addition, if stolen identity refund fraud is perpetrated through our products or services, state or federal
tax authorities may refuse to allow us to continue to process our clients' tax returns electronically. As a result, stolen
identity refund fraud could harm our revenue, results of operations and reputation.
In addition, our clients may access our services and products from personal or public computers and mobile devices
and may install and use our H&R Block DIY desktop tax preparation software on their computers. As a result, a person
with malicious intent could obtain user account and password information through hacking, phishing, or other means
of cyber attack, in order to perpetrate stolen identity refund fraud and otherwise cause losses for our clients. It has
been reported that a number of companies, including some in the tax return preparation industry, have recently
experienced instances where criminals gained unauthorized and illegal access to their systems by using stolen identity
information obtained from sources other than those companies. The unauthorized and illegal access to those systems
was used by criminals to perpetrate a variety of crimes, including stolen identity refund fraud. We could experience
this form of unauthorized and illegal access to our systems, despite there having been no breach in the security of
our systems, which could negatively impact our clients and harm our revenue, results of operations and reputation.
Additionally, if such unauthorized or illegal access occurs, we may be subject to claims and litigation by clients, non-
clients, or governmental agencies.
An interruption in our information systems, or those of our franchisees or a third party on which we rely, or an
interruption in the internet, could have a material adverse effect on our business and our consolidated financial
position, results of operations, and cash flows.
We and our franchisees rely heavily upon communications and information systems and the internet to conduct our
business. Our, and our franchisees', systems and operations are potentially vulnerable to damage or interruption from
upgrades and maintenance, network failure, hardware failure, software failure, power or telecommunications failures,
cyber attacks involving the penetration of our network by hackers or other unauthorized users through computer