Designer Brands (DBI) Risk Analysis

Given the nature of our business, we, together with third parties acting on our behalf, receive, collect, process, use, and retain sensitive and confidential customer and associate data and proprietary business information. Our business relies on IT networks and systems to market and sell our products, process financial and personal information, manage a variety of business processes, and comply with regulatory, legal, and tax requirements. We also depend on a variety of information systems to effectively process customer orders and other data, for digital marketing activities, and for electronic communications with our associates, customers, prospective customers, and vendors. Some of our third-party service providers, such as identity verification and payment processing providers, also regularly have access to customer data. Additionally, we maintain other confidential, proprietary, or otherwise sensitive information relating to our business and third parties. The IT networks and systems operated by us or our vendors may be susceptible to damage, disruptions, data breaches, failures during the process of upgrading or replacing software, databases, or components, power outages, natural disasters, hardware failures, user errors or malfeasance, unauthorized access or attacks, including actions of foreign actors and insider attacks, phishing or denial-of-service attacks, the introduction of computer viruses and/or malicious or destructive code, ransomware or other malware attacks, and other real or perceived cyberattacks or catastrophic events, any of which may not be prevented by our or our vendors' efforts to secure our or their computer systems. Any of these incidents could lead to interruptions or shutdowns of our platform, disruptions in our ability to process customer orders or to track, record, or analyze the sale of our products, loss or corruption of data, loss of funds, or unauthorized access to or acquisition of personal information or other sensitive information, such as our intellectual property. Such incidents could also lead to widespread technology outages, interruptions or other failures of operational, communication, or other systems globally and across companies and industries. We utilize security tools and controls, which include reasonable efforts to ensure that our third-party vendors maintain sufficient security measures, including encryption and authentication technology, in an effort to reduce our cyber risk and protect personal and other sensitive information. However, our ability to monitor our vendors' cybersecurity is limited, and we cannot ensure the cybersecurity measures they take will be sufficient to protect any information we share with them or prevent any disruption arising from a technology failure, cyberattack or other information or security breach. Furthermore, none of our or our vendors' security measures can provide absolute security. Advances in computer capabilities, continually evolving and increasingly sophisticated tools and methods used by hackers and cyber terrorists, new discoveries in the field of cryptography, the use of artificial intelligence by cyber-attackers to develop malicious code and launch sophisticated phishing or other social engineering attempts, or other developments may result in our or our vendors' failure or inability to adequately protect personal or other sensitive information. In addition, vulnerabilities may be introduced from the use of artificial intelligence by us and our vendors. Despite our or our vendors' security measures, we may be unable to anticipate cyberattacks or implement adequate preventative measures and could suffer the impacts of a cyberattack, unauthorized access to personal information or other sensitive data, and any such data compromise or unauthorized access may not be discovered in a timely fashion and could persist for an extended period of time. We rely on associates, contractors, and other third parties who may attempt to circumvent our security measures in order to obtain personal information or other sensitive data and may purposefully or inadvertently cause a breach involving such information. Actual or anticipated attacks may cause us to incur increased costs, including costs to deploy additional personnel and protection technologies, train associates, pay higher insurance premiums, and engage third-party specialists for additional services. An information security breach involving confidential and personal data could result in a loss of funds, damage our reputation, adversely affect our customers' willingness to purchase from us, and adversely affect our vendors' willingness to supply or provide services to us. In addition, we may incur material liabilities and remediation costs as a result of an information security breach, including potential liability for stolen customer or associate data, costs relating to repairing system damage, or costs of providing credit monitoring or other benefits to customers or associates affected by the breach. If we experience a material information security breach, our insurance may not be sufficient to cover the impact to our business. Although we have developed mitigating security controls to reduce our cyber risk and protect our data from loss or disclosure due to a security breach, including processes designed to reduce the impact of a security breach at a third-party vendor, such measures cannot provide absolute security. We, and our third-party vendors, regularly experience cyberattacks aimed at disrupting services. Our third-party vendors may be the victim of cyber-related attacks. If they fail to deter, detect, or report cyber incidents in a timely manner, we may suffer from financial and other harm, including to our information, operations, and reputation, and such incidents could lead to operational disruptions that could have an adverse effect on our ability to fulfill customer orders. Security incidents, such as ransomware attacks, are becoming increasingly prevalent and severe, as well as increasingly difficult to detect. We, and our third-party vendors, have been subject to cyber, phishing, and social engineering attacks and other security incidents in the past and may continue to be subject to such attacks in the future. Security breaches can also occur as a result of non-technical issues, including intentional or inadvertent actions by our associates, our third-party vendors, their personnel, or other parties. If we or our third-party service providers experience security breaches that result in a decline in marketplace performance, availability problems, or the loss of, corruption of, unauthorized access to, or disclosure of personal data or confidential information, customers may become unwilling to provide us with the information necessary for such customers to make purchases on our e-commerce websites, and our reputation and market position could be harmed. Existing customers may also decrease their purchases or close their accounts altogether. We could also face potential claims, investigations, regulatory proceedings, liability, and litigation, and could bear other substantial costs in connection with remediating and otherwise responding to any data security breach, all of which may not be adequately covered by insurance, and which may result in an increase in our costs for insurance or insurance not being available to us on economically feasible terms, or at all. Insurers may also deny us coverage as to any future claim. Further, cybersecurity and data protection laws and regulations continue to evolve, and are increasingly demanding, which adds compliance complexity and may increase our costs of compliance and expose us to litigation, monetary damages, regulatory enforcement actions or fines. Any of these results could harm our growth prospects, financial condition, business, and reputation. We, or third parties we rely on, may not be able to fully, continuously, and effectively implement security controls as intended. As described in Item 1C. Cybersecurity, we utilize a risk-based approach and exercise judgment to determine the security controls to implement, and it is possible that we may not implement appropriate controls if we do not recognize or if we underestimate a particular risk. In addition, security controls, no matter how well-designed or implemented, may only mitigate and not fully eliminate risks. Cybersecurity events, when detected by security tools or third parties, may not always be immediately understood or acted upon.