Overstock.com 2012 Annual Report Download - page 22

Table of Contents
those of our users, or otherwise damage our reputation and business. Any compromise of our security could result in a violation of applicable privacy
and other laws, significant legal and financial exposure, damage to our reputation, and a loss of confidence in our security measures, which could harm
our business.
Most of our customers use credit cards to pay for their purchases. We rely on encryption and authentication technology licensed from third parties
to provide the security and authentication to effectively secure transmission of confidential information, including customer payment card numbers. We
cannot provide assurance that our technology can prevent breaches of the systems that we use to protect customer data. Data breaches can also occur as
a result of non-technical issues.
Under payment card rules and our contracts with our card processors, if there is a breach of payment card information that we store, we could be
liable to the payment card issuing banks for their cost of issuing new cards and related expenses. In addition, if we fail to follow payment card industry
security standards, even if there is no compromise of customer information, we could incur significant fines or lose our ability to give customers the
option of using payment cards to fund their payments or pay their fees. If we were unable to accept payment cards, our business would be seriously
damaged.
Our servers and the servers of our suppliers may also be vulnerable to computer viruses, physical or electronic break-ins, and similar disruptions,
including denial-of-service attacks. We may need to expend significant resources to protect against attacks or security breaches or to address problems
caused by attacks or breaches. Any attack or breach incident involving us or persons with whom we have commercial relationships, that results in the
unauthorized release of our users' personal information, could damage our reputation and expose us to a risk of loss or litigation and possible liability.
Third parties have demonstrated that they can breach the security of customer transaction data of large sophisticated Internet retailers, government
organizations and others. Any breach, whether it affects us directly or not, could cause our customers to lose confidence in the security of our site or the
use of the Internet and e-commerce in general. If third parties are able to penetrate our network security or otherwise misappropriate our customers'
personal information or credit card information, or if we give third parties improper access to our customers' personal information or credit card
information, we could be subject to liability. This liability could include claims for unauthorized purchases with credit card information, impersonation
or other similar fraud claims or damages for alleged violations of state or federal laws governing security protocols for the safekeeping of customers'
personal or credit card information. This liability could also include claims for other misuses of personal information, including unauthorized marketing
purposes. These claims could result in litigation. Liability for misappropriation of this information could adversely affect our business.
Credit card fraud and our response to it could adversely affect our business.
We routinely receive orders placed with fraudulent credit card data. We do not carry insurance against the risk of credit card fraud, so our failure to
adequately control fraudulent credit card transactions could reduce our net revenues and our gross profit. We have implemented technology to help us
detect and reject the fraudulent use of credit card information. However, we may in the future suffer losses as a result of orders placed with fraudulent
credit card data even if the associated financial institution approved payment of the orders. Under current credit card practices, we may be liable for
fraudulent credit card transactions because we do not obtain a cardholder's signature. If we are unable to detect or control credit card fraud, our liability
for these transactions could harm our business, prospects, financial condition and results of operation. Further, to the extent that our efforts to prevent
fraudulent orders result in our inadvertent refusal to fill legitimate orders, we would lose the benefit of legitimate potential sales and risk the alienation of
legitimate customers.
13