We, our collaborators, third-party providers, distributors, customers and other contractors utilize information technology systems and networks to transmit, store and otherwise process electronic data in connection with our business activities, including our supply chain processes, operations and communications including, in some cases, our clinical data and business proprietary information, and electronic data interchange, on purchase orders, invoices, chargebacks, among other things. We, and our collaborators, third-party providers, distributors and other contractors, also collect, transmit, store and otherwise process certain data relating to individuals, including about our personnel, business partners, and others, which may be subject to applicable data protection, security and privacy laws and regulations that require adoption of minimum information security standards. The cost of compliance with applicable data protection, security and privacy laws and regulations have increased and may increase in the future.
Despite our implementation of security measures to protect the confidentiality, integrity, and availability of the systems, networks and data within our control from various threats (e.g., cyber-attacks, system breaches, malware, viruses, hacking, fraudulent use, social engineering attacks, phishing attacks, ransomware attacks, credential-stuffing attacks, denial-of-service attacks, unauthorized access, insider threats, accidental disclosures, intellectual property theft and economic espionage, exploitable vulnerabilities, defects or bugs in our or our third-party providers' systems, natural disasters, war, terrorism, telecommunications and electrical outages, breakdowns, damage, interruptions), we have experienced and may continue to experience cyber-attacks of varying degrees from time to time. For example, in the first quarter of 2022, our Chinese subsidiary, ANP, was subject to a security incident that resulted in a temporary disruption to some of their internal computer systems. We worked with ANP to improve and implement additional security measures to their systems and networks. We incurred minimal costs to respond to the ANP incident. In addition, in the second quarter of 2020, we were subject to a security incident that resulted in a temporary disruption to some of our internal computer systems. In response to this incident, we engaged a third-party forensic expert to investigate, and determined that cyber criminals illegally obtained certain personal information of certain current and former employees. We notified affected individuals and regulators, as we deemed was required or appropriate. We incurred minimal cost to respond to this incident, and we expect to continue to incur cost to support our efforts to enhance our security measures. Our systems and networks and the systems and networks of third parties that support us and our services may be breached or disrupted due to these threats. The size and complexity of our systems may make them potentially vulnerable to breakdown or interruption, whether due to computer viruses or other causes, which may result in loss of data or the impairment of production and other supply chain processes, adversely affecting our business.
Techniques used to sabotage or obtain unauthorized access to systems and networks are constantly evolving and, in some instances, are not identified until or after they are launched against a target. We and our third-party providers may be unable to anticipate these techniques, discover threats and react in a timely manner, or implement adequate preventative or mitigating measures. Further, system breaches, malware, ransomware, computer hacking, and insider threats have become more prevalent. For example, companies have experienced an increase in phishing and social engineering attacks from third parties in connection with the increase in employees working remotely in recent years. We and our third-party providers who may be operating in remote work environments may have increased security risks, due to increased use of home Wi-Fi networks and virtual private networks, as well as increased disbursement of physical machines. Also, due to political uncertainty and military actions associated with Russia's invasion of Ukraine, we and our third-party providers are vulnerable to heightened risks of cyber threats and cyber-attacks from or affiliated with nation-state actors, including attacks that could materially disrupt our systems and operations, supply chain, and ability to produce, sell and distribute our products and services. While we implement security measures designed to reduce these risks, there is no guarantee that these measures will be adequate to safeguard all systems and networks. Any failure to maintain performance, reliability, security and availability of our systems and networks may result in accidental or unlawful destruction, damage, loss, unavailability, alteration, impairment, misuse, unauthorized disclosure of, or unauthorized access to our data, including personal information.
In addition, potential legal, regulatory, contractual, financial, operational, and reputational harm may arise from the accidental or unlawful destruction, damage, loss, unavailability, alteration, impairment, misuse, unauthorized disclosure of, or unauthorized access to our systems, networks, or data, including data which is transmitted, stored or otherwise processed by us or by collaborators, third-party providers, distributors and other contractors on our behalf. For example:
- The accidental or unlawful loss, unavailability or alteration of clinical trial data from completed or ongoing clinical trials for any of our product candidates could affect our ability to operate, result in delays in our development and regulatory approval efforts, and significantly increase our costs to recover or reproduce the data.
- Any security incident may require costly response and remediation efforts, trigger notification obligations under breach notification laws or contractual notification requirements, result in litigation or adverse regulatory action arising from or related to such an incident or event, damage our reputation, and result in significant additional expense to implement further data protection measures. Integrating the systems and data of any acquired entity may increase these risks due to unforeseen threats and vulnerabilities.
- Similarly, any security incident experienced by our collaborators, third-party providers, distributors and other contractors may hinder our product development, supply chain, other business operations, or our regulatory and contractual obligations to others and could also give rise to litigation or adverse regulatory action.
In an effort to ensure appropriate oversight of cyber security issues and risks, management now updates the Board of Directors on cyber security matters on a quarterly basis, and the Board of Directors has assigned oversight of cyber security to the Audit Committee. Additionally, the Company has a security training and compliance program, which employees with access to information technology, must complete annually or more often, if deemed necessary or appropriate.
There can be no assurance that we will be successful in preventing security incidents nor that we will be successful in mitigating their effects, despite the implementation of security measures for systems, networks and data within our control. Similarly, there can be no assurance that our collaborators, third-party providers, distributors and other contractors will be successful in protecting our data on their systems or in protecting other systems upon which we may rely. Furthermore, breach notification laws are not consistent among jurisdictions, and compliance and other measures in the event of a security incident could result in a substantial cost and diversion of resources and distract management and technical personnel in efforts to investigate or correct the security incident, address and eliminate vulnerabilities and prevent future security incidents, and remediate the security incident, which repairing systems and responding to claims of damages for actual or asserted contract breaches. Any such security incident could have a material adverse effect on our business and prospects.
Although we maintain cyber insurance coverage that may cover certain of our losses in connection with a security incident, we cannot be certain our insurance coverage will be adequate for losses actually incurred, that insurance will continue to be available to us on commercially reasonable terms (if at all) or that any insurer will not deny coverage as to any future claim. The successful assertion of one or more large claims against us that exceed available insurance coverage, the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, or denials of coverage, could have a material adverse effect on our business, including our financial condition, results of operations and reputation.