We have experienced cyberattacks in the past that have not had a material effect on our business operations, and we face the risk of future cyberattacks that may or may not have a material effect. Despite the implementation of security measures, our internal computer systems and those of third parties with which we engage, such as research institution collaborators, clinical trial sites, and CROs and other vendors, contractors and consultants, may be vulnerable to damage, interruption, or other disruption from various causes, including computer viruses and other malicious code, and may be vulnerable to unauthorized access. Likewise, data privacy or security breaches or breaches by employees or others may pose a risk that sensitive data, including our intellectual property, trade secrets, or personal information of our employees, patients, customers, or other business partners, may be exposed to unauthorized persons or to the public or may otherwise be misused. As the cyber-threat landscape evolves, especially as certain of our employees have engaged in remote or hybrid work, these attacks are growing in frequency, sophistication, and intensity, and are becoming increasingly difficult to detect, mitigate, and defend against. Such threats are prevalent and continue to rise, are increasingly difficult to detect, and come from a variety of sources, including traditional computer "hackers," threat actors, "hacktivists," organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors. During times of war and other conflicts, we and our business counterparties, including third parties upon which we rely, may be vulnerable to a heightened risk of these attacks. Such attacks might involve the use of sophisticated malware, including ransomware or various types of service denial tactics. They can be initiated through harmful websites, or by leveraging phishing strategies, social engineering tactics, or credential stuffing. This might also include brute force attacks, along with other contemporary malicious methods which are always changing.
If a breakdown, cyberattack, or other information security breach or incident occurs, it could cause damage to or interruptions or other disruptions in our operations or those of third parties, with which we engage, and could result in damage to, the loss or unavailability of, or misappropriation or other unauthorized use or processing of, sensitive data, including personal information and confidential information, such as our intellectual property or financial information, and a material disruption of our research and development programs and our business operations. For example, the loss or unavailability of, or damage to, clinical trial data from completed, ongoing, or future clinical trials could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. Likewise, we rely on third-party research institution collaborators, clinical trial sites, and CROs and other vendors, consultants and contractors for research and development of our product candidates, and we rely on other third parties, such as CDMOs and CROs, to manufacture our product candidates and to conduct clinical trials, respectively. Supply-chain attacks against third-party actors like these have increased in frequency and severity, and we cannot guarantee that third-party infrastructure in our supply chain or our third-party partners' supply chains have not been compromised. Cyberattacks, security breaches and incidents, and disruptions, interruptions, and similar events relating to their computer systems and operations could also have a material adverse effect on our business.
We and our business counterparties, including third parties on which we rely, may be unable to anticipate or prevent outages or to anticipate or prevent techniques used to obtain unauthorized access to or to compromise our or our business counterparties' systems because such techniques change frequently and are generally not detected until after an incident has occurred. We may be unable to anticipate or prevent any breakdowns or other outages due to a failure of software, software updates or other events that may cause disruptions to our systems or data. There can be no assurance that we and our business counterparties will be successful in efforts to detect, prevent, or fully recover systems or data from all breakdowns, service interruptions or other disruptions, attacks, or compromises of, or security breaches or incidents impacting, systems that could adversely affect our business and operations and/or result in the loss or unavailability of, or damage to, critical or sensitive data.
Any disruption or security breach or incident resulting in loss or unavailability of, or damage to, our data or systems, or those of third parties on which we rely, or inappropriate use, disclosure, or modification of personal, sensitive, confidential or proprietary information, could result in our being subject to claims, demands, and litigation, investigations and other regulatory proceedings, and fines and other liabilities, as well as in delays to further development and commercialization of our product candidates. While we have invested, and continue to invest, in the protection of our data and information technology infrastructure, there can be no assurance that our efforts will prevent service disruptions, or prevent or identify vulnerabilities or security breaches or incidents, that could adversely affect our business and operations or result in the loss, unavailability, or corruption of, or inappropriate access to or use of, confidential, personal, or other sensitive information or company resources. Any such interruptions, breaches or incidents, or the perception that any have occurred, could result in financial, legal, business, or reputational harm to us. In addition, our liability insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyberattacks and other privacy and security breaches or incidents.
Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our data privacy and security obligations. We cannot be sure that our insurance coverage will be adequate or sufficient to protect us from or to mitigate liabilities arising out of our privacy and security practices, that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims.