We face risks associated with security breaches, incidents, and compromises, whether through cyber attacks or cyber intrusions over the internet, malware, computer viruses, attachments to e-mails, persons inside our organization or persons with access to systems inside our organization, social engineering tactics, and other significant disruptions of our IT networks and related systems. The risk of a security breach, incident, compromise, or disruption, particularly through cyber attack or cyber intrusion, including by computer hackers, foreign governments and cyber terrorists, has generally increased as the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased. Our IT networks and related systems are essential to the operation of our business and our ability to perform day-to-day operations (including managing our building systems and accounting for our business operations) and, in some cases, may be critical to the operations of certain of our clients.
Although we make efforts to maintain the security and integrity of our IT networks and related systems, and we have implemented various measures designed to manage the risk of a security breach, incident, compromise or disruption, there can be no assurance that our security efforts and measures will be effective or that attempted security breaches, incident, compromise or disruptions would not be successful or damaging. Even the most well-protected information, networks, systems and facilities remain potentially vulnerable because the techniques used in such attempted security breaches evolve and generally are not recognized until launched against a target, and in some cases, are designed not be detected and, in fact, may not be detected. Accordingly, we may be unable to anticipate these techniques or to implement adequate security barriers or other preventative measures, and thus it is impossible for us to entirely mitigate this risk.
Like other businesses, we have been, and expect to continue to be, subject to attempts at unauthorized access of our network, mishandling or misuse, computer viruses or malware, cyber attacks and intrusions and other events of varying degrees. To date, these events have not, individually or in the aggregate, materially affected our operations or business. However, a security breach, incident, compromise or other significant disruption involving our IT networks and related systems could:
- disrupt the proper functioning of our networks and systems and therefore our operations and/or those of certain of our clients;- result in misstated financial reports, violations of loan covenants, missed reporting deadlines and/or missed permitting deadlines;- result in our inability to properly monitor our compliance with the rules and regulations regarding BXP's qualification as a REIT;- result in the unauthorized access to, and destruction, loss, theft, misappropriation or release of, proprietary, confidential, sensitive or otherwise valuable information of ours or others, which others could use to compete against us or which could expose us to damage and claims or threats by third-parties for disruptive, destructive or otherwise harmful purposes and outcomes;- result in our inability to maintain the building systems relied upon by our clients for the efficient use of their leased space;- require significant management attention and resources to remedy any damages that result;- subject us to claims for breach of contract, damages, credits, penalties or termination of leases or other agreements or subject us to litigation and regulatory investigations and related fines and penalties;- be uninsured or exceed policy limits, increase operating costs, including insurance expenses, or make future cyber risk coverage unavailable on commercially reasonable terms; and - damage our reputation among our clients and investors generally.
Any one or more of the foregoing could have a material adverse effect on our results of operations, financial condition and cash flows. Refer to Part I, Item 1C. Cybersecurity in this Form 10-K for more information.