Our business depends on the availability, integrity and confidentiality of our IT and OT systems and related data, including systems supporting accounting, financial reporting, operations, leasing, communications, and building operations. Our OT environment includes building management and automation systems, access control, HVAC, energy management and other systems that support the operation of our properties and, in some cases, are critical to the operations of certain of our tenants.
We are vulnerable to security breaches and disruptions caused by, among other things, cyberattacks or cyber intrusions over the internet, malware (including ransomware and data-extortion schemes), computer viruses, software defects, IT bugs or malfunctions, inadvertent or intentional acts by employees or other insiders, and persons with authorized access to our or our service providers' systems. The risk of a security breach or disruption has increased as the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased, including due to the use of advanced tools and techniques and artificial intelligence that can improve social engineering, accelerate attack timelines, evade detection and, in certain cases, reduce available forensic evidence.
We also rely on numerous third-party service providers and cloud-based platforms for accounting, financial, operational, management, and other operational and data-related. Many of these third-party systems and services are essential to our operations, but we do not control them, and certain third parties have access to systems that we use. As a result, we are exposed to risks arising from third-party failures, security breaches and disruptions, including supply-chain vulnerabilities (such as compromises of software, cloud platforms, managed services or other vendors), as well as misconfigurations, outages or other events that may occur in environments outside of our control.
The liabilities and costs associated with security breaches are significant and, depending on the incident, may include litigation and governmental investigations, as well as damages, fines, penalties or injunctive relief that requires us to make changes to our business practices. In addition, cybersecurity incidents may trigger disclosure obligations, breach notification requirements or other regulatory reporting, and compliance with numerous and evolving laws, regulations and industry standards relating to data privacy, cybersecurity and the protection of information is challenging and expensive. Failure to comply with these requirements could subject us to regulatory scrutiny and additional liability and could increase our operating costs.
There can be no assurance that our controls and procedures, or those of our service providers, will be effective at preventing, identifying, detecting, investigating, containing or remediating future cyber incidents. For example, we cannot guarantee that our or third-party systems do not contain exploitable vulnerabilities, defects or misconfigurations that could result in a breach of, or disruption to, our systems. Like other businesses, we and our third-party service providers have been and expect to continue to be subject to cybersecurity incidents and other events of varying degrees.
To date, such events have not materially impacted our operations or business and were not individually or in the aggregate material. However, we cannot guarantee that material incidents will not occur in the future. A successful attack or other disruption involving our or third-party IT or OT systems could, among other things:
- result in unauthorized access to, destruction, loss, theft, misappropriation or release of proprietary, confidential, sensitive or otherwise valuable information;- compromise the integrity, accuracy or availability of data, including data used in our financial accounting and reporting systems;- disrupt or degrade business operations, including our ability to operate, monitor or maintain building systems relied on by our tenants;- result in business email compromise, fraudulent payment instructions or other financial fraud;- require significant management attention and resources to investigate and remediate;- subject us to regulatory actions, penalties or private litigation;- increase our costs of operations; and/or - harm our reputation among tenants, investors, employees and other stakeholders.
Any of these events could have a material adverse impact on our business