A cybersecurity incident is an unauthorized occurrence, or a series of related unauthorized occurrences, on or conducted through the Company's information systems that jeopardizes the confidentiality, integrity, or availability of our information systems or any information residing therein. These events can include gaining unauthorized access to systems to disrupt operations, corrupt data or steal confidential information, including information regarding our residents, prospective residents, employees and employees' dependents.
Despite system redundancy, the implementation of security measures, required employee awareness training and the existence of a disaster recovery plan for our internal information technology systems, our systems and systems maintained by third-party vendors with which we do business are vulnerable to damage from any number of sources. We face risks associated with security breaches, whether through cyber attacks or cyber intrusions over the Internet, malware, computer viruses, attachments to emails, phishing attempts, social engineering, ransomware or other scams, persons inside our organization or persons/vendors with access to our systems and other significant disruptions of our information technology networks and related systems, including property infrastructure. These risks have increased due to increased reliance on remote working and other electronic interactions with our current and prospective residents. Our information technology networks and related systems are essential to the operation of our business and our ability to perform day-to-day operations. We use these systems to manage our resident and vendor relationships, internal communications, accounting and record-keeping systems and many other key aspects of our business. Our operations rely on the secure processing, storage and transmission of confidential and other information in our computer systems and networks, which also depend on the strength of our procedures and the effectiveness of our internal controls as well as those of vendors with whom we do business. Even the most well-protected information, networks, systems and facilities remain potentially vulnerable because the techniques used in such attempted security breaches evolve and generally are not recognized until launched against a target, and in some cases are designed not to be detected and, in fact, may not be detected. Accordingly, we may be unable to anticipate these techniques or to implement adequate security barriers or other preventative measures, and thus it is impossible for us to entirely mitigate this risk.
We may periodically collect and store personally identifiable information of our residents and prospective residents in connection with our leasing activities, and we may collect and store personally identifiable information of our employees and their dependents. In addition, we often engage third-party service providers that may have access to such personally identifiable information in connection with providing necessary information technology, security and other business services to us. Despite the fact that we monitor and perform a comprehensive review of businesses that we contract with that represent a cybersecurity risk to the organization, the systems of these third-party service providers may contain defects in design or other problems that could unexpectedly compromise personally identifiable information. Although we make efforts to maintain the security and integrity of our information technology networks and those of our third-party providers and we have implemented various measures to manage the risk of a security breach or disruption, there can be no assurance that our security efforts and measures will be effective or that attempted security breaches or disruptions would not be successful or damaging.
A breach or significant and extended disruption in the function of our systems, including our primary website, could damage our reputation and cause us to lose residents and revenues, result in a violation of applicable privacy and other laws, generate third-party claims, result in the unintended and/or unauthorized public disclosure or the misappropriation of proprietary, personally identifiable and confidential information and require us to incur significant expenses to address and remediate or otherwise resolve these kinds of issues. We may not be able to recover these expenses in whole or in any part from our service providers, our insurers or any other responsible parties. As a result, there can be no assurance that our financial results would not be negatively impacted.
We are also subject to laws, rules, and regulations in the United States, such as the California Privacy Rights Act ("CPRA"), relating to the collection, use, and security of resident, customer, employee and other data. Evolving compliance and operational requirements under the CPRA and the privacy laws of other jurisdictions in which we operate may impose significant costs that are likely to increase over time. Our failure to comply with laws, rules and regulations related to privacy and data protection could harm our business or reputation or subject us to fines and penalties.