Global Business Travel Group, Inc.

Previous report

Interruptions in and unauthorized access to our information technology systems, security breaches or incidents impacting our systems or data that we or our service providers maintain or otherwise process, could adversely affect our business.

Previous report

Cyber-attacks are increasing in number and sophistication, are well-financed, in some cases supported by nation-state actors, and are designed to not only attack, but also to evade detection. Since the techniques used to obtain unauthorized access to systems, or to otherwise sabotage them, change frequently and are often not recognized until launched against a target, we may be unable to anticipate these techniques or to implement adequate detection or preventative measures. The emergence and maturation of artificial intelligence capabilities has led to new and/or more sophisticated methods of attack, including fraud that relies upon “deep fake” impersonation technology, of which we have been a target, or other forms of generative automation that have scaled up the effectiveness of cyber threat activity.

Previous report

We develop and maintain systems and processes aimed at detecting and preventing data breaches and fraudulent activity, which require significant investment, maintenance and ongoing monitoring and updating as technologies and regulatory requirements change and as efforts to overcome security measures become more sophisticated. Despite our efforts, the possibility of data breaches, malicious social engineering and fraudulent or other malicious activities, deep fake attacks and human error or malfeasance cannot be eliminated entirely, and risks associated with each of these remain, including the unauthorized disclosure, release, gathering, monitoring, misuse, loss or destruction of confidential, proprietary and other information (including account data information), online accounts and systems.

Previous report

If our information technology systems experience a significant disruption or breach or if actual or perceived fraud levels or other illegal activities were to arise due to a data breach at a business partner, merchant or other market participant, employee error, malfeasance or otherwise, it could lead to the loss of data or data integrity, regulatory investigations, increased litigation (including class action litigation), remediation and response costs, greater concerns of customers and/or business partners relating to the privacy and security of their data, and reputational and financial damage to our brand, which could have a material adverse impact on our business. If such disruptions or breaches are not detected immediately, their effect and resulting impact could be compounded. Data breaches and other actual or perceived failures to maintain confidentiality, integrity, privacy and/or data protection, including leaked business data, may also disrupt our operations, undermine our competitive advantage through the disclosure of sensitive Company information, divert management attention and resources and negatively impact the assessment of us and our subsidiaries by regulatory authorities and rating agencies.