The risk of a cybersecurity incident or disruption, particularly through cyber-attack or cyber intrusion, including by computer hackers, foreign governments and cyber terrorists, has generally increased as the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased. Our website, www.modiv.com, IT networks and related systems, including third party providers of software-as-a-service ("SaaS") platforms, are essential to the operation of our business and our ability to perform day-to-day operations. Although we make efforts to maintain the security and integrity of our IT networks and related systems, and we have implemented various measures to manage our risk of a cyber-attack or disruption, there can be no assurance that our security efforts and measures will be effective or that attempted cyber-attacks or disruptions would not be successful or damaging. Even the most well protected information, networks, systems and facilities remain potentially vulnerable because the techniques used in such attempted cyber-attacks evolve and may be designed to be undetectable. Accordingly, we may be unable to anticipate these techniques or to implement adequate security barriers or other preventative measures, and thus it is impossible for us to entirely mitigate this risk. Additionally, data protection laws and regulations often require "reasonable," "appropriate" or "adequate" technical and organizational security measures, and the interpretation and application of those laws and regulations are often uncertain and evolving; there can be no assurance that our security measures will be deemed adequate, appropriate or reasonable by a regulator or court. Moreover, even security measures that are deemed appropriate, reasonable, and/or in accordance with applicable legal requirements may not be able to protect the information we maintain.
A cybersecurity incident or other significant disruption involving IT networks and related systems we use could:
- disrupt the proper functioning of our networks and systems and therefore our operations;- result in misstated financial reports, violations of loan covenants and/or missed reporting deadlines to the regulators;- result in our inability to properly monitor our compliance with the rules and regulations regarding our qualification as a REIT;- result in the unauthorized access to, or destruction, loss, theft, misappropriation or release of, proprietary, confidential, sensitive or otherwise valuable information of ours or others, which others could use to compete against us, or which could expose us to damage claims by third-parties for disruptive, destructive or otherwise harmful purposes and outcomes;- require significant management attention and resources to remedy any damages that result or improve our security;- subject us to claims for breach of contract, damages, credits, penalties or termination of leases or other agreements;- result in litigation or increased regulatory oversight, including governmental investigations, enforcement actions, regulatory fines, and/or criminal prosecution; and/or - damage our reputation among investors.
We rely heavily on SaaS solutions supplied by third party providers, including data centers and cloud storage services. If these third party providers cease to provide the facilities or services, experience operational interference or disruptions, breach their agreements with us, fail to perform their obligations and meet our expectations, or experience a cybersecurity incident, our operations could be disrupted or otherwise negatively affected, which could result in damage to our reputation among investors and brands, and materially and adversely affect our business. We may not carry business interruption insurance sufficient to compensate us for all losses that may result from interruptions in our service as a result of systems failures and similar events. And while we may be entitled to damages if our third-party providers fail to satisfy their security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award.
Any or all of the foregoing could have a material adverse effect on our results of operations, financial condition and cash flows.