Our operations are highly dependent on our information systems and technology, which are provided and maintained by an outsourced technology vendor, and we rely heavily on our financial, accounting, treasury, communications and other data processing systems. Such systems may fail to operate properly or become disabled as a result of tampering or a breach of the network security systems or otherwise. In addition, such systems are subject to cyberattacks, including ransomware attacks and social engineering, such as phishing, smishing and vishing, which are continually evolving and will likely continue to increase in sophistication and frequency in the future. Moreover, remote working, including pursuant to our hybrid work model, may be less secure and more susceptible to cyberattacks. Attacks on us and our service providers' systems could involve, and in some instances have in the past involved, attempts that are intended to obtain unauthorized access to our proprietary information or personal identifying information of our stockholders, destroy data, disable, degrade or sabotage our systems, including through the introduction of computer viruses and other malicious code, or divert or steal funds, including by wire fraud and other nefarious means.
Cybersecurity incidents and cyberattacks, denial of service attacks, ransomware attacks, and social engineering attempts (including business email compromise attacks) have been occurring globally at a more frequent and severe level and will likely continue to increase in frequency in the future. There have been a number of recent highly publicized cases involving the dissemination, theft and destruction of corporate information or other assets, as a result of a failure to follow procedures by employees or contractors or as a result of actions by a variety of third parties, including nation state actors and terrorist or criminal organizations. We and our service providers and other market participants increasingly depend on complex information technology and communications systems to conduct business functions, and their operations rely on the secure access to, and processing, storage and transmission of confidential and other information in their systems and those of their respective third-party service providers. These information, technology and communications systems are subject to a number of different threats or risks that could adversely affect us. For example, our information and technology systems, as well as those of other related parties, such as service providers, may be vulnerable to damage or interruption from cybersecurity breaches, computer viruses or other malicious code, network failures, computer and telecommunication failures, infiltration by unauthorized persons and other security breaches, usage errors by their respective professionals or service providers, power, communications or other service outages and catastrophic events such as fires, tornadoes, floods, hurricanes and earthquakes. Cyberattacks and other security threats could originate from a wide variety of external sources, including cybercriminals, nation state hackers, hacktivists and other outside parties. Cyberattacks and other security threats could also originate from the malicious or accidental acts of insiders.
There has been an increase in the frequency and sophistication of the cyber and security threats we face, with attacks ranging from those common to businesses generally to those that are more advanced and persistent, which may target us because we hold a significant amount of confidential and sensitive information. As a result, we may face a heightened risk of a security breach or disruption with respect to this information. If successful, these types of attacks on our network or other systems could have a material adverse effect on our business and results of operations, due to, among other things, the loss of investor or proprietary data, interruptions or delays in the operation of our business and damage to our reputation. There can be no assurance that measures we take to ensure the integrity of our systems will provide protection, especially because cyberattack techniques used change frequently, may persist undetected over extended periods of time and may not be mitigated in a timely manner to prevent or minimize the impact of an attack.
If unauthorized parties gain access to such information and technology systems, they may be able to steal, publish, delete or modify private and sensitive information, including nonpublic personal information related to stockholders (and their beneficial owners) and material nonpublic information. Although we have implemented, and our service providers may implement, various measures to manage risks relating to these types of events, such systems could prove to be inadequate and, if compromised, could become inoperable for extended periods of time, cease to function properly or fail to adequately secure private information. There also have been several publicized cases of ransomware where hackers have requested ransom payments in exchange for not disclosing client or customer information or restoring access to information technology or communications systems. We do not control the cybersecurity plans and systems put in place by third-party service providers, and such third-party service providers may have limited indemnification obligations to us. Breaches such as those involving covertly introduced malware, impersonation of authorized users and industrial or other espionage may not be identified even with sophisticated prevention and detection systems, potentially resulting in further harm and preventing them from being addressed appropriately. The failure of these systems or of disaster recovery plans for any reason could cause significant interruptions in our operations and result in a failure to maintain the security, confidentiality or privacy of sensitive data, including personal information relating to stockholders, material nonpublic information and the intellectual property and trade secrets and other sensitive information in our possession. We could be required to make a significant investment to remedy the effects of any such failures, harm to our reputation, legal claims that we may be subjected to, regulatory action or enforcement arising out of applicable privacy and other laws, adverse publicity and other events that may affect our business and financial performance.
Even if we are not targeted directly, cyberattacks on governments, financial markets, financial institutions, or other businesses, including borrowers, vendors, software creators, cybersecurity service providers and other third-parties with whom we do business, may occur, and such events could disrupt our normal business operations and networks in the future.
In addition, our business is highly dependent on information systems and technology. The costs related to cyber or other security threats or disruptions may not be fully insured or indemnified by other means. In addition, we could also suffer losses in connection with updates to, or the failure to timely update, our information systems and technology. In addition, we are reliant on third-party service providers for certain aspects of our business, including for administrative services, as well as for certain information systems and technology, including cloud-based services. These third-party service providers could also face ongoing cybersecurity threats and compromises of their systems and as a result, unauthorized individuals could gain access to certain confidential data.
Many jurisdictions in which we operate have, or are considering adopting, laws and regulations relating to data privacy, cybersecurity and protection of personal information. Some jurisdictions have also enacted laws requiring companies to notify individuals and government agencies of data security breaches involving certain types of personal data. Breaches in security, whether malicious in nature or through inadvertent transmittal or other loss of data, could potentially jeopardize our employees', investors' or counterparties' confidential, proprietary and other information processed and stored in, and transmitted through, our computer systems and networks, or otherwise cause interruptions or malfunctions in our employees', investors', counterparties' or third-parties' operations, which could result in significant losses, increased costs, disruption of our business, liability to our investors and other counterparties, regulatory intervention or reputational damage. Furthermore, if we fail to comply with the relevant laws and regulations or fail to provide the appropriate regulatory or other notifications of a breach in a timely manner, it could result in regulatory investigations and penalties, which could lead to negative publicity and may cause our investors to lose confidence in the effectiveness of our security measures.
A disaster or a disruption in the infrastructure that supports our business, including a disruption involving electronic communications or other services used by us or third-parties with whom we conduct business, could have a material adverse impact on our ability to continue to operate our business without interruption. Our disaster recovery programs may not be sufficient to mitigate the harm that may result from such a disaster or disruption. In addition, insurance and other safeguards might only partially reimburse us for our losses, if at all.