Spirit Airlines 2012 Annual Report Download - page 22

In addition, our automated systems cannot be completely protected against events that are beyond our control, including natural disasters, computer viruses or
telecommunications failures. Substantial or sustained system failures could cause service delays or failures and result in our customers purchasing tickets from other airlines.
We have implemented security measures and change control procedures and have disaster recovery plans; however, we cannot assure you that these measures are adequate
to prevent disruptions. Disruption in, changes to or a breach of, these systems could result in a disruption to our business and the loss of important data. Any of the foregoing
could result in a material adverse effect on our business, results of operations and financial condition.
We are subject to cyber security risks and may incur increasing costs in an effort to minimize those risks.
Our business employs systems and websites that allow for the secure storage and transmission of proprietary or confidential information regarding our customers,
employees, suppliers and others, including personal identification information, credit card data, and other confidential information. Security breaches could expose us to a
risk of loss or misuse of this information, litigation, and potential liability. Although we take steps to secure our management information systems, and although multiple
auditors review and approve the security configurations and management processes of these systems, including our computer systems, intranet and internet sites, email and
other telecommunications and data networks, the security measures we have implemented may not be effective, and our systems may be vulnerable to theft, loss, damage
and interruption from a number of potential sources and events, including unauthorized access or security breaches, natural or man-made disasters, cyber attacks, computer
viruses, power loss, or other disruptive events. We may not have the resources or technical sophistication to anticipate or prevent rapidly evolving types of cyber attacks.
Attacks may be targeted at us, our customers and suppliers, or others who have entrusted us with information. In addition, attacks not targeted at us, but targeted solely at
suppliers, may cause disruption to our computer systems or a breach of the data that we maintain on customers, employees, suppliers, and others.
Actual or anticipated attacks may cause us to incur increasing costs, including costs to deploy additional personnel and protection technologies, train employees, and
engage third-party experts and consultants, or costs incurred in connection with the notifications to employees, suppliers, or the general public as part of our notification
obligations to the various governments that govern our business. Advances in computer capabilities, new technological discoveries, or other developments may result in the
breach or compromise of technology used by us to protect transaction or other data. In addition, data and security breaches can also occur as a result of non-technical issues,
including breaches by us or by persons with whom we have commercial relationships that result in the unauthorized release of personal or confidential information. Our
reputation, brand, and financial condition could be adversely affected if, as a result of a significant cyber event or other security issues: our operations are disrupted or shut
down; our confidential, proprietary information is stolen or disclosed; we incur costs or are required to pay fines in connection with stolen customer, employee or other
confidential information; we must dedicate significant resources to system repairs or increase cyber security protection; or we otherwise incur significant litigation or other
costs.
Our processing, storage, use and disclosure of personal data could give rise to liabilities as a result of governmental regulation.
In the processing of our customer transactions, we receive, process, transmit and store a large volume of identifiable personal data, including financial data such as
credit card information. This data is increasingly subject to legislation and regulation, typically intended to protect the privacy of personal data that is collected, processed
and transmitted. More generally, we rely on consumer confidence in the security of our system, including our website on which we sell the majority of our tickets. Our
business, results of operations and financial condition could be adversely affected if we are unable to comply with existing privacy obligations or legislation or regulations
are expanded to require changes in our business practices.
We may not be able to maintain or grow our non-ticket revenues.
Our business strategy includes expanding our portfolio of ancillary products and services. There can be no assurance that passengers will pay for additional ancillary
products and services or that passengers will continue to choose to pay for the ancillary products and services we currently offer. Further, regulatory initiatives could
adversely affect ancillary revenue opportunities. Failure to maintain our non-ticket revenues would have a material adverse effect on our results of operations and financial
condition. Furthermore, if we are unable to maintain and grow our non-
ticket revenues, we may not be able to execute our strategy to continue to lower base fares in order to
stimulate demand for air travel. Please see “—Restrictions on or increased taxes applicable to charges for ancillary products and services paid by airline passengers and
burdensome consumer protection regulations or laws could harm our business, results of operations and financial condition.”
21