OfficeMax 2014 Annual Report Download - page 16

Table of Contents
contract third parties with the specialized skills needed to support our multichannel platforms, or are unable to implement improvements to our customer-
facing technology in a timely manner, our ability to compete and our results of operations could be adversely affected. In addition, if our website and our
other customer-facing technology systems do not function as designed, the customer experience could be negatively affected, resulting in a loss of customer
confidence and satisfaction, and lost sales, which could adversely affect our reputation and results of operations.

We rely heavily on computer systems to process transactions, manage our inventory and supply-chain and to summarize and analyze our global business. If
our systems are damaged or fail to function properly, or, if we do not replace or upgrade certain systems, we may incur substantial costs to repair or replace
them and may experience an interruption of our normal business activities or loss of critical data. We are undertaking certain system enhancements and
conversions to increase productivity and efficiency, that, if not done properly, could divert the attention of our workforce and constrain for some time our
ability to provide the level of service our customers demand. Also, once implemented, the new systems and technology may not provide the intended
efficiencies or anticipated benefits, and could add costs and complications to our ongoing operations.


Through our sales, marketing activities, and use of third-party information, we collect and store certain personally identifiable information that our customers
provide to purchase products or services, enroll in promotional programs, register on our website, or otherwise communicate and interact with us. This may
include but is not limited to names, addresses, phone numbers, driver license numbers, e-mail addresses, contact preferences, personally identifiable
information stored on electronic devices, and payment account information, including credit and debit card information. We also gather and retain
information about our employees in the normal course of business. We may share information about such persons with vendors that assist with certain aspects
of our business. In addition, our online operations depend upon the secure transmission of confidential information over public networks, such as information
permitting cashless payments.
We have instituted safeguards for the protection of such information. These security measures may be compromised as a result of third-party security
breaches, burglaries, cyber-attack, errors by employees or employees of third-party vendors, faulty password management, misappropriation of data by
employees, vendors or unaffiliated third-parties, or other irregularity, and result in persons obtaining unauthorized access to our data or accounts. Despite
instituted safeguards for the protection of such information, we cannot be certain that all of our systems and those of our vendors and unaffiliated third-parties
are entirely free from vulnerability to attack or compromise given that the techniques used to obtain unauthorized access, disable or degrade service, or
sabotage systems change frequently. During the normal course of our business, we have experienced and we expect to continue to experience attempts to
breach our systems, and we may be unable to protect sensitive data and the integrity of our systems or to prevent fraudulent purchases. Moreover, an alleged
or actual security breach that affects our systems or results in the unauthorized release of personally identifiable information could:
• materially damage our reputation and brand, negatively affect customer satisfaction and loyalty, expose us to negative publicity, individual claims or
consumer class actions, administrative, civil or criminal investigations or actions, and infringe on proprietary information; and
• cause us to incur substantial costs, including but not limited to costs associated with remediation for stolen assets or information, payments of customer
incentives for the maintenance of business relationships after an attack, litigation costs, lost revenues resulting from unauthorized use of proprietary
information or the failure to retain or attract customers following an attack, and increased cyber security protection costs. While we maintain insurance
coverage that may, subject to policy terms and conditions, cover certain aspects of our cyber risks, such insurance coverage may be unavailable or
insufficient to cover our losses or all types of claims that may arise in the continually evolving area of cyber risk.
14