2018 Annual Report for Norwegian Cruiseline Holdings - 25

Epidemics and viral outbreaks could have an adverse effect on our business, financial condition and results of operations.
Public perception about the safety of travel and adverse publicity related to passenger or crew illness, such as incidents of viral illnesses,
stomach flu or other contagious diseases, may impact demand for cruises and result in cruise cancellations and employee absenteeism. If any
wide-ranging health scare should occur, our business, financial condition and results of operations would likely be adversely affected.
Breaches in data security or other disturbances to our information technology and other networks could impair our operations and have
a material adverse impact on our business, financial condition and results of operations.
We have made significant investments in our information technology systems to optimize booking procedures, enhance the marketing power
of our websites and control costs. The integrity and reliability of these systems and networks are crucial to our business operations and
disruptions to these systems or networks could impair our operations and have an adverse impact on our financial results and negatively
affect our reputation and customer demand. In addition, certain networks are dependent on third-party technologies, systems and service
providers for which there is no certainty of uninterrupted availability. Among other things, actual or threatened natural disasters (e.g.,
hurricanes, earthquakes, tornadoes, fires, floods or similar events), information systems failures, computer viruses, denial of service attacks
and other cyber-attacks may cause disruptions to our information technology, telecommunications and other networks. While we have and
continue to invest in business continuity, disaster recovery, data restoration plans and data and information technology security, we cannot
completely insulate ourselves from disruptions that could result in adverse effects on our operations and financial results. We carry limited
business interruption insurance for certain shoreside operations, subject to limitations, exclusions and deductibles.
As part of our ordinary business operations, we and certain of our third-party service providers collect, process, transmit and store a large
volume of personally identifiable information, including email addresses, home addresses and financial data such as credit card information.
The security of the systems and networks where we and our service providers store this data is a critical element of our business. Despite our
implementation of security measures to protect against security breaches, unauthorized access to our data and other cyber-attacks or
incidents, our systems and networks are vulnerable to computer viruses, malware, worms, hackers and other security issues, including
physical and electronic break-ins, router disruption, sabotage or espionage, disruptions from unauthorized access and tampering (including
through social engineering such as phishing attacks), impersonation of authorized users and coordinated denial-of-service attacks. For
example, in October 2018, we discovered limited instances of unauthorized access to certain employee e-mail communications, some of
which contained proprietary business and personally identifiable information. We have implemented additional safeguards, and we do not
believe that we experienced any material losses related to this incident; however, there can be no assurance that this or any other breach or
incident will not have a material impact on our operations and financial results in the future. In addition, we may not be in a position to
promptly address security breaches, unauthorized access or other cyber-attacks or incidents or to implement adequate preventative measures
if we are unable to immediately detect such incidents. Our failure to successfully prevent, mitigate or timely respond to any breach, attack or
unauthorized use of our information systems to gain access to sensitive information, corrupt data or create general disturbances in our
operations systems could impair our ability to conduct business and damage our reputation.
We are also subject to laws relating to privacy of personal data, including European Union data privacy regulations. The compromise of our
information systems resulting in the loss, disclosure, misappropriation of or access to the personally identifiable information of our guests,
prospective guests or employees could result in governmental investigation, civil liability or regulatory penalties under laws protecting the
privacy of personal information, any or all of which could disrupt our operations and materially adversely affect our business. Additionally,
any material failure by us or our service providers to maintain compliance with the Payment Card Industry security requirements or to rectify
a data security issue may result in fines and restrictions on our ability to accept credit cards as a form of payment.
In the event of a data security breach of our systems and/or third-party systems or a cyber-attack or other cyber incident, we may incur costs
associated with the following: response, notification, forensics, regulatory investigations, public relations, consultants, credit identity
monitoring, credit freezes, fraud alert, credit identity restoration, credit card cancellation, credit card reissuance or replacement, data
restoration, regulatory fines and penalties, vendor fines and penalties, legal fees, damages and settlements. In addition, data security
breaches, a cyber-attack or other cyber incident may cause business interruption, information technology disruption, disruptions as a result of
regulatory investigation or litigation, digital asset loss related to corrupted or destroyed data, loss of company assets, damage to our
reputation, damages to intangible property and other intangible damages, such as loss of consumer confidence, all of which could impair our
operations and have an adverse impact on our financial results.

25
2018 Annual Report for Norwegian Cruiseline Holdings

Table of Contents for the Digital Edition of 2018 Annual Report for Norwegian Cruiseline Holdings
