Sears 2015 Annual Report Download - page 10

We rely extensively on computer systems to implement our integrated retail strategy, process transactions,
summarize results and otherwise manage our business. Disruptions in these systems could harm our ability to
run our business.
Given the significance of our online and mobile capabilities, our collection and use of data to create
personalized experiences, and the number of individual transactions we have each year, including in our stores, it is
critical that we maintain uninterrupted operation of our computer and communications hardware and software
systems, some of which are based on end-of-life or legacy technology, operate with minimal or no vendor support
and are otherwise difficult to maintain. Our systems are subject to damage or interruption from power outages,
computer and telecommunications failures, computer viruses, security breaches, catastrophic events such as fires,
tornadoes and hurricanes, and usage errors by our employees. Operating legacy systems subjects us to inherent costs
and risks associated with maintaining, upgrading and replacing these systems and retaining sufficiently skilled
personnel to maintain and operate the systems, demands on management time, and other risks and costs. Any
material interruption in our computer operations may have a material adverse effect on our business or results of
operations, including on our Shop Your Way® program and participation in or engagement with that program. We are
pursuing initiatives to transform our information technology processes and systems. These initiatives are highly
complex and include replacing legacy systems, upgrading existing systems, and acquiring new systems and
hardware with updated functionality. The risk of disruption is increased in periods when such complex and
significant systems changes are undertaken.
If we do not maintain the security of our member and customer, associate or company information, we could
damage our reputation, incur substantial additional costs and become subject to litigation.
Cyber-security risks such as malicious software and attempts to gain unauthorized access to data are rapidly
evolving. Techniques or software used to gain unauthorized access, and/or disable, degrade or harm our systems
may be difficult to detect or scope for prolonged periods of time, and we may be unable to anticipate these
techniques or put in place protective or preventive measures. These attempts to gain unauthorized access could lead
to disruptions in our systems, unauthorized release of confidential or otherwise protected information or corruption
of data. If individuals are successful in infiltrating, breaking into, disrupting, damaging or otherwise stealing from
the computer systems of the Company or its third-party providers we may have to make a significant investment to
fix or replace them, we may suffer interruptions in our operations in the interim, we may face costly litigation,
government investigations, government enforcement actions, fines and/or lawsuits, the ability for our members to
earn or redeem points in our Shop Your Way® program may be impacted or halted, and our reputation with our
members and customers may be significantly harmed. There is no guarantee that the procedures that we have
implemented to protect against unauthorized access to secured data are adequate to safeguard against all data
security breaches. A data security breach or any failure by us to comply with applicable privacy and information
security laws and regulations could result in a loss of customer or member confidence and negatively impact our
business, including our Shop Your Way® program, and our results of operations. As publicly announced on October
10, 2014, Kmart’s information technology team detected on October 9, 2014 that the Kmart store payment data
system had been criminally breached beginning in early September 2014, that the payment data systems at Kmart
stores were purposely infected with a new form of malware, and that debit and credit card numbers were potentially
compromised. The Company is defending a class-action lawsuit in the Northern District of Illinois alleging
violations relating to, and harm resulting from this incident.
We are subject to payment-related risks that could increase our operating costs, expose us to fraud or theft,
subject us to potential liability and potentially disrupt our business operations.
As a retailer who accepts payments using a variety of methods, including credit and debit cards, PayPal, and
gift cards, the Company is subject to rules, regulations, contractual obligations and compliance requirements,
including payment network rules and operating guidelines, data security standards and certification requirements,
and rules governing electronic funds transfers. The regulatory environment related to information security and
privacy is increasingly rigorous, with new and constantly changing requirements applicable to our business, and
compliance with those requirements could result in additional costs or accelerate these costs. For certain payment
methods, including credit and debit cards, we pay interchange and other fees, which could increase over time and
raise our operating costs. We rely on third parties to provide payment processing services, including the processing
10