Our internal information technology networks and related systems are vulnerable to damage from any number of sources, including computer viruses, unauthorized access, energy blackouts, natural disasters, terrorism, war and telecommunication failures. Any system failure or accident that causes interruptions in our operations could result in a material disruption to our business. We may also incur additional costs to remedy damages caused by these disruptions.
As reliance on technology has increased, so have the risks posed to those systems. We must continuously monitor and develop networks and information technology to prevent, detect, address and mitigate the risk of unauthorized access, misuse, computer viruses, and social engineering, such as phishing. We are continuously working including with the aid of third party service providers, to install new, and to upgrade existing, network and information technology systems, to create processes for risk assessment, testing, prioritization, remediation, risk acceptance, and reporting, and to provide awareness training around phishing, malware and other cyber risks to ensure they provide us with services essential to our operations are protected against cyber risks and security breaches and that we are also therefore so protected. However, these upgrades, processes, new technology and training may not be sufficient to protect us from all risks. Even the most well protected information, networks, systems and facilities remain potentially vulnerable because the techniques and technologies used in attempted attacks and intrusions evolve and generally are not recognized until launched against a target. In some cases, attempted attacks and intrusions are designed not to be detected and, in fact, may not be detected.
The remediation costs and lost revenues experienced by a subject of an intentional cyberattack or other event which results in unauthorized third party access to systems to disrupt operations, corrupt data or steal confidential information may be significant and significant resources may be required to repair system damage, protect against the threat of future security breaches or to alleviate problems, including reputational harm, loss of revenues and litigation, caused by any breaches. Additionally, any failure to adequately protect against unauthorized or unlawful processing of personal data, or to take appropriate action in cases of infringement may result in significant penalties under privacy law.
Furthermore, a security breach or other significant disruption involving our information technology networks and related systems could:
- result in misstated financial reports, violations of loan covenants, missed reporting or permitting deadlines;- affect our ability to properly monitor our compliance with the rules and regulations regarding our qualification as a REIT;- result in the unauthorized access to, and destruction, loss, theft, misappropriation or release of, proprietary, confidential, sensitive or otherwise valuable information (including information about tenants), which others could use to compete against us or for disruptive, destructive or otherwise harmful purposes and outcomes;- result in our inability to maintain the building systems relied upon by our tenants for the efficient use of their leased space;- require significant management attention and resources to remedy any damages that result;- subject us to claims for breach of contract, damages, credits, penalties or termination of leases or other agreements; or - adversely impact our reputation among our tenants and investors generally.
There can be no assurance that the measures we have adopted will be sufficient. Further, while we carry cyber liability insurance, such insurance may not be adequate to cover all losses related to such events.