We are increasingly dependent on information technology systems and infrastructure, including mobile technologies, to operate our business. In the ordinary course of our business, we and the third parties upon which we rely, collect, receive, store, process, generate, disclose, make accessible, protect, dispose of, transmit, use, safeguard, share and transfer, or collectively, process, confidential and sensitive electronic information on our networks and in our data centers. This information includes, among other things, de-identified or pseudonymous sensitive personal data (including health data), our intellectual property and proprietary information, the confidential information of our collaborators and licensees, and the personal data of our employees. It is important to our operations and business strategy that this electronic information remains secure and is perceived to be secure. The size and complexity of our information technology systems, and those of third-party vendors with whom we contract, and the volume of data we retain, make such systems potentially vulnerable to a variety of evolving threats, including but not limited to social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code, malware (such as malicious code, adware, and command and control (C2)), denial-of-service attacks, credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, attacks enhanced or facilitated by AI, telecommunications failures, and other similar threats. Cyber-attacks, malicious internet-based activity, online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of our sensitive information and information technology systems, and those of the third parties upon which we rely. Such threats continue to rise, are increasingly difficult to detect, and come from a variety of sources, including traditional computer "hackers," threat actors, "hacktivists," organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors (also referred to as APTs). Some actors now engage and are expected to continue to engage in cyber-attacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we and the third parties upon which we rely may be vulnerable to a heightened risk of these attacks, including retaliatory cyber-attacks, which could materially disrupt our systems and operations, as well as our ability to conduct clinical trials. Ransomware attacks are also becoming increasingly prevalent and severe, and can lead to significant interruptions in our operations (including our ability to conduct clinical trials), loss of sensitive data (including related to our clinical trials) and income, reputational harm, and diversion of funds. To alleviate the financial, operational and reputational impact of a ransomware attack, it may be preferable to make extortion payments, but we may be unwilling or unable to do so (including, for example, if applicable laws or regulations prohibit such payments). Similarly, supply chain attacks have increased in frequency and severity, and we cannot guarantee that third parties in our supply chain have not been compromised or that they do not contain exploitable defects, vulnerabilities, or bugs that could result in a breach of or disruption to our information technology systems and infrastructure or the information technology systems and infrastructure of third parties that support our operations.
Remote work has become more common and has increased risks to our information technology systems and data, as more of our employees work from home, utilizing network connections, computers and devices outside our premises, including at home, while in transit or in public locations.
Additionally, natural disasters, public health pandemics or epidemics, terrorism, war and geopolitical conflicts, and telecommunication and electrical failures may result in damage to or the interruption or impairment of key business processes, or the loss or corruption of confidential information, including intellectual property, proprietary business information and personal data.
Future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities' systems and technologies. Furthermore, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program.
As cyber threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities or modify our business activities (including our clinical trial activities) to try to protect against security incidents.
We take steps designed to detect, mitigate, and remediate vulnerabilities in our information security systems (such as our hardware and/or software, including that of third parties upon which we rely). We may not, however, detect and remediate all such vulnerabilities including on a timely basis. Further, we may experience delays in developing and deploying remedial measures and patches designed to address identified vulnerabilities. Vulnerabilities could be exploited and result in a security incident.
We rely on third-party service providers and technologies to operate critical business systems to process sensitive information in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, employee email and other functions. We also rely on third-party service providers to provide other products, services, parts, or otherwise to operate our business, including clinical trial sites and investigators, contractors, manufacturers, suppliers and consultants. Our ability to monitor these third parties' information security practices is limited, and these third parties may not have adequate information security measures in place. If our third-party service providers or CROs experience a security incident or other interruption, we could experience adverse consequences. In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties' infrastructure in our supply chain or our third-party partners' supply chains have not been compromised or otherwise subject to a security incident. While we may be entitled to damages if our third-party service providers fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award.
Although to our knowledge we, or the third parties upon who we rely, have not experienced a security incident or disruption to date that is material to us, we and our vendors have been, either directly or indirectly, the target of cybersecurity incidents and expect them to continue. While we have implemented security measures designed to protect our data security and information technology systems, such measures may not prevent such events. Furthermore, while we have implemented and are planning to implement redundancies designed to avoid interruptions to our operations, not all potential events can be anticipated and interruptions to our operations could lead to decreased productivity.
If we (or a third party upon whom we rely) experience a security incident, ransomware attack or are perceived to have experienced a security incident, we may experience adverse consequences. Such consequences may include: government enforcement actions (for example, investigations, fines, penalties, audits and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive information (including personal data); litigation (including class claims); indemnification obligations; negative publicity; reputational harm (including but not limited to damage to our patient, partner, or employee relationships); monetary fund diversions; diversion of management's attention; interruptions in our operations (including availability of data, loss of connectivity to our network or internet); financial loss (including decreased productivity resulting from interruptions in our operations); and other similar harms. Similarly, the loss of clinical trial data from completed or ongoing or planned clinical trials could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. In addition, theft of our intellectual property or proprietary business information could require substantial expenditures to remedy. Applicable data privacy and security obligations may also require us to notify relevant stakeholders, including affected individuals, customers, regulators, and investors, of security incidents. Such disclosures are costly, and the disclosure or the failure to comply with such requirements could lead to adverse consequences.
Our contracts, with for example third parties or CROs, may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our data privacy and security obligations. We also cannot be sure that our insurance coverage will be adequate or sufficient to protect us from or to mitigate liabilities arising out of our privacy and security practices, that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims.
In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position. Additionally, our sensitive information could be leaked, disclosed, or revealed as a result of or in connection with our employees', personnel's, or vendors' potential use of generative AI technologies.