We are increasingly dependent on information technology systems and infrastructure, including mobile technologies, to operate our business. In the ordinary course of our business, we collect, store, process, and transmit large amounts of confidential information, including intellectual property, proprietary business information, personal information (including health information), and other confidential information. It is critical that we do so in a secure manner to maintain the confidentiality, integrity, and restricted availability of such information. We have also outsourced elements of our operations, including elements of our information technology infrastructure and data processing, to third parties and, as a result, we manage a number of third-party vendors who have access to our computer networks or our information. In addition, many of those third parties in turn subcontract or outsource some of their responsibilities to other third parties. While all information technology operations are inherently vulnerable to inadvertent or intentional security breaches, incidents, attacks, and exposures, the accessibility and distributed nature of our information technology systems, and the information stored on those systems, make such systems (and the information stored therein) vulnerable to risks that threaten the confidentiality, integrity and availability of these systems and information, including unintentional or malicious, internal, and external attacks on our technology environment. Vulnerabilities can be exploited by diverse threat actors and attack vectors, including through inadvertent or intentional actions of our employees, third-party vendors, business partners, or by malicious third parties. Cybersecurity incidents are increasing in their frequency, levels of persistence, sophistication, and intensity, and are being conducted by sophisticated and organized groups and individuals with a wide range of motives (including industrial espionage) and expertise, including organized criminal groups, "hacktivists," nation states, and others, and utilizing increasingly sophisticated techniques and tools – including AI – that circumvent security controls, evade detection and remove or obfuscate forensic evidence. In addition to access to, loss of or the extraction of information, such attacks could involve the deployment of harmful malware, ransomware, denial-of-service attacks, social engineering/phishing, malicious code embedded in software, and other means to affect service reliability and threaten the confidentiality, integrity, and availability of information technology systems or information. In addition, the prevalent use of mobile devices increases the risk of cybersecurity incidents.
Significant disruptions of our or our third-party vendors' or business partners' information technology systems or other similar cybersecurity incidents could adversely affect our business operations and result in the loss, misappropriation, and unauthorized access, use or disclosure of, or the prevention of access to, information, which could result in financial, legal, regulatory, business, and reputational harm to us. In addition, any impact to the confidentiality, integrity or availability of information technology systems and the information stored therein, whether from attacks on our or third-party technology environment or from computer viruses, natural disasters, terrorism, war, telecommunication and electrical failures, or other threats, could result in a material disruption of our development programs and our business operations. For example, the loss of clinical trial data from ongoing, completed or future clinical trials could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. We cannot ensure that our cybersecurity and data protection efforts and our investment in information technology, or the efforts or investments of CROs, consultants or other third parties with which we work, will prevent breakdowns or breaches in our or their systems or other cybersecurity incidents, including those that cause loss, destruction, unavailability, alteration, dissemination of, or damage, or unauthorized access to, or processing of, our data, including personal information, assets, and other data processed or maintained on our behalf, that could have a material adverse effect upon our reputation, business, financial condition, results of operations and growth prospects.
While we have implemented security measures intended to protect our information technology systems and infrastructure, there can be no assurance that such measures will successfully prevent service interruptions or cybersecurity incidents or that our security measures and processes will be fully implemented, complied with or effective. Nor can we be certain that our third-party vendors or business partners have sufficient measures or processes in place to protect their information technology systems and infrastructure. We, our third-party vendors and business partners are, from time to time, subject to attacks and cybersecurity incidents. While we have not to our knowledge experienced an incident that has had a material impact on our operations or financial results, there is no way of knowing with certainty whether we have experienced any material cybersecurity incidents that have not been discovered. While we have no reason to believe this to be the case, attackers have become very sophisticated in the way they conceal access to systems, and many companies that have been attacked are not aware that their systems or information have been compromised. Any event that leads to unauthorized access, use, or disclosure of information, including personal information regarding our patients or employees, or other adverse impact to the availability, integrity or confidentiality of our information technology systems, infrastructure or information, could disrupt our business, harm our reputation, compel us to comply with applicable federal and state breach notification laws and foreign law and contractual equivalents, subject us to time-consuming, distracting, and expensive litigation (including class actions), regulatory investigation and oversight, mandatory corrective action, require us to verify the correctness of database contents, or otherwise subject us to liability under laws, regulations, and contractual obligations, including those that protect the privacy and security of personal information. It could also result in increased costs to us, including costs to investigate, mitigate and remediate vulnerabilities and incidents, and result in significant legal and financial exposure and reputational harm. In addition, any failure or perceived failure by us or our vendors or business partners to comply with our privacy, confidentiality, or data security-related legal or other obligations to third parties, or any further cybersecurity incidents, may result in governmental investigations, enforcement actions, regulatory fines, litigation, or public statements against us by advocacy groups or others, and could cause third parties, including clinical sites, regulators, or current and potential partners, to lose trust in us, or we could be subject to claims by third parties that we have breached our privacy- or confidentiality-related obligations. Moreover, cybersecurity incidents and other inappropriate access can be difficult to detect, and any delay in identifying them may lead to increased harm of the type described above. Finally, we cannot guarantee that any costs and liabilities incurred in relation to an incident will be covered by our existing insurance policies or that applicable insurance will be available to us in the future on economically reasonable terms or at all. Any of the foregoing could have a material adverse effect on our reputation, business, financial condition, results of operations and growth prospects.