In the ordinary course of our business, we and the third parties with whom we work collect, process, receive, store, use, generate, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, process) proprietary, confidential and sensitive information, including personal data (including health information), intellectual property, trade secrets, information we collect about patients in connection with clinical trials, and proprietary business information owned or controlled by ourselves or other parties (collectively, sensitive information).
Cyberattacks, malicious internet-based activity, online and offline fraud and other similar activities threaten the confidentiality, integrity, and availability of our sensitive information and information technology systems, and those of the third parties with whom we work. Such threats are prevalent and are increasing in their frequency, sophistication and intensity, and have become increasingly difficult to detect. These threats come from a variety of sources, including traditional computer "hackers," "hacktivists," organized criminal threat actors, threat actors, personnel (such as through theft or misuse), sophisticated nation-states, and nation-state-supported actors. Some actors now engage and are expected to continue to engage in cyber-attacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we, and the third parties with whom we work, may be vulnerable to a heightened risk of these attacks, including retaliatory cyber-attacks, that could materially disrupt our systems and operations, supply chain, and ability to produce and distribute our product candidates. We and the third parties with whom we work are subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service credential stuffing attacks, credential harvesting, adware, ransomware, supply chain attacks, personnel misconduct or error, attacks enhanced or facilitated by AI, and other similar threats. Our information technology systems and data, and those of the third parties with whom we work, may also be subject to failure or disruption from software bugs, server malfunction, software or hardware failures, loss of data or other information technology assets, telecommunications failures, natural disasters such as earthquakes, fires, and floods, and other similar issues.
In particular, severe ransomware attacks are becoming increasingly prevalent and severe and can lead to significant interruptions, delays, or outages in our operations, disruptions to our clinical trials, loss of data (including data related to clinical trials), significant expense to restore data or systems, reputational loss and the diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. In addition, our reliance on third parties could introduce new cybersecurity risks and vulnerabilities, including supply-chain attacks, and other threats to our business operations. Such supply chain attacks have increased in frequency and severity, and we cannot guarantee that third parties' infrastructure in our supply chain have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach to our information technology systems or those of the third parties with whom we work. Additionally, future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities' systems and technologies. Furthermore, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program.
We work with certain third parties, such as CROs and CDMOs, to operate critical business systems and process our proprietary, confidential and sensitive information. We also share or receive sensitive information with our CROs, CDMOs, or other third parties. Our ability to monitor these third parties' information security practices is limited, and these third parties may not have adequate information security measures in place. If the third parties with whom we work experience a security incident or are perceived to have experienced a security incident, we could experience adverse consequences. While we may be entitled to damages if the third parties with whom we work fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award.
Although we have implemented security measures designed to protect against, mitigate, and remediate security incidents, there can be no assurance that these measures will be effective.
We take steps designed to detect, mitigate, and remediate vulnerabilities in our information systems (such as our hardware and/or software, including that of third parties with whom we work). We have not and may not in the future, however, detect and remediate all such vulnerabilities in our information technology systems, including on a timely basis, because such threats and techniques change frequently, are often sophisticated in nature, and may not be detected until after a security incident has occurred. Unremediated high risk or critical vulnerabilities pose material risks to our business that may be exploited and could result in a security incident. Further, we have experienced and may in the future experience delays in developing and deploying remedial measures designed to address any such identified vulnerabilities. We also face heightened physical and information technology risks due to our sharing office space with other tenants at certain of our sites. Any failure to prevent or mitigate security incidents or improper access to, use of, or disclosure of our clinical data or patients' personal data could result in significant liability under state, federal, and international law and may cause a material adverse impact to our reputation, affect our ability to conduct our clinical trials and potentially disrupt our business. In addition, as many of our employees work from home at least part of the time and utilize network connections outside our premises, including while at home, or in transit, this poses increased risks to our information technology systems and data.
Certain of the previously identified or similar threats have in the past, and any of the identified or similar threats may in the future, cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our sensitive information. For example, we have been the target of unsuccessful phishing attempts in the past, and expect such attempts will continue in the future. In addition, from time to time, our vendors inform us of security incidents. For example, in November 2024, one of our vendors notified us that they had detected suspicious activity on their network that compromised several email accounts the vendor used to communicate with us. We took appropriate remedial measures, and based on our investigation, we concluded that the incident did not compromise our systems. To date, we have not determined that such incidents as reported to us were material. However, we may not have all information related to such incidents and future incidents could have an adverse impact on our business. A security incident or other interruption could disrupt our ability (and that of third parties with whom we work) to manufacture or deliver our product candidates.
We may expend significant resources (including financial), or modify our business activities and operations, including our clinical trial activities, in an effort to protect against security incidents or to detect, investigate, mitigate, contain and remediate a security incident. Certain data privacy and security obligations may require us to implement and maintain specific security measures or use industry-standard or reasonable security measures to protect our information technology systems and sensitive information.
Applicable data protection laws, privacy policies, data protection obligations and public company disclosure obligations may require us, or we may voluntarily choose, to notify relevant stakeholders, including affected individuals, regulators and investors, of certain security incidents, or to implement other requirements, such as providing credit monitoring. Such disclosures and compliance with such requirements are costly, and the disclosures or the failure to comply with such applicable requirements could lead to adverse consequences. A security incident, whether perceived or actual, experienced by us or a third party with whom we work, may cause us to experience adverse consequences. These consequences may include: government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive information (including personal data); litigation (including class claims) and mass arbitration; indemnification obligations; negative publicity; reputational harm; monetary fund diversions; interruptions in our operations (including availability of data); financial loss; and other similar harms. Whether a cybersecurity incident is reportable to our investors may not be straightforward, may take considerable time to determine, and may be subject to change as the investigation of the incident progresses, including changes that may significantly alter any initial disclosure that we provide. Moreover, experiencing a material cybersecurity incident and any mandatory disclosures could lead to negative publicity, loss of investor or partner confidence in the effectiveness of our cybersecurity measures, diversion of management's attention, governmental investigations, lawsuits, and the expenditure of significant capital and other resources.
Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that the limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our data privacy and security obligations.
We cannot be sure that our insurance coverage will be adequate or sufficient to protect us from or adequately mitigate liabilities arising out of our privacy and security practices, or that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims.
In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position. Additionally, sensitive information could be leaked, disclosed, or revealed as a result of or in connection with the use of generative artificial intelligence technologies by our employees, personnel, or vendors.