The United States federal and various state and foreign governments have adopted or proposed laws, regulations and requirements regarding the collection, distribution, use, security, and storage of personally identifiable information and other data relating to individuals, and federal and state consumer protection laws are being applied to enforce regulations related to the collection, use, and dissemination of such data. In the ordinary course of business, we collect, store, transmit and otherwise process confidential information, including, without limitation, proprietary business information, preclinical and clinical trial data and personal information, or collectively, Confidential Information. It is critical that we do so in a secure manner to maintain the confidentiality and integrity of such Confidential Information. Despite the implementation of security measures, our information technology systems (including infrastructure) and those of our current and any future CROs and other contractors, consultants and collaborators are vulnerable to attack, damage and interruption from computer viruses and malware (e.g. ransomware), misconfigurations, "bugs" or other vulnerabilities, malicious code, cybersecurity threats (such as denial or degredation-of-service attacks, cyber-attacks or cyber-intrusions over the Internet, hacking, phishing and other social engineering attacks), unauthorized access or use, natural disasters, terrorism, war and telecommunication and electrical failures, employee theft or misuse, human error, fraud, and sophisticated nation-state and nation-state-supported actors. Attacks upon information technology systems are increasing in their frequency, levels of persistence, sophistication and intensity, and are being conducted by sophisticated and organized groups and individuals with a wide range of motives and expertise. As a result of the post-pandemic continued hybrid working environment, we may also face increased cybersecurity risks due to our reliance on internet technology and the number of our employees who continue to work remotely, which may create additional opportunities for cybercriminals to exploit vulnerabilities. Furthermore, because the techniques used to obtain unauthorized access to, or to sabotage, systems change frequently and often are not recognized until launched against a target, we may be unable to anticipate these techniques or implement adequate preventative measures. We may also experience security breaches that may remain undetected for an extended period. Even if identified, we may be unable to adequately investigate or remediate incidents or breaches due to attackers increasingly using tools and techniques - including artificial intelligence - that are designed to circumvent controls, to avoid detection, and to remove or obfuscate forensic evidence. There can also be no assurance that our and our third-party service providers', strategic partners', contractors', consultants', CROs' and collaborators' cybersecurity risk management program and processes, including policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems, networks and confidential information.
We and certain of our service providers are from time to time subject to cyberattacks and security incidents. While we do not believe that we have experienced any significant system failure, accident or security breach to date, if such an event were to occur and cause interruptions in our operations or result in the unauthorized disclosure of or access to proprietary or sensitive personally identifiable information, it could result in a material disruption of our development programs and our business operations, whether due to a loss, corruption or unauthorized disclosure of our trade secrets or other similar disruptions. Some of the federal, state and foreign laws, regulations and requirements include obligations of companies to notify individuals of security breaches involving particular personally identifiable information, which could result from breaches experienced by us or by our vendors, contractors, or organizations with which we have formed strategic relationships.
Any security breach or other incident, whether real or perceived, could impact our reputation, cause us to incur significant costs, including legal expenses, harm customer confidence, hurt our expansion into new markets, cause us to incur remediation costs, or cause us to lose existing customers. For example, the loss of clinical trial data from clinical trials could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. We also rely on third parties to manufacture our product candidates, and similar events relating to their computer systems could also have a material adverse effect on our business. To the extent that any real or perceived disruption or security breach affects our systems (or those of our third-party collaborators, service providers, contractors or consultants) or were to result in a loss of or accidental, unlawful or unauthorized access to, use of, release of, or other processing of personally identifiable information, or damage to, our data or applications, or inappropriate disclosure of confidential or proprietary information, we could incur liability, the further development and commercialization of our product candidates could be delayed, and we could be subject to significant fines, penalties or liabilities for any noncompliance to certain privacy and security laws. Any adverse impact to the availability, integrity or confidentiality of our or third-party systems or confidential information can result in legal claims or proceedings (such as class actions), regulatory investigations and enforcement actions, fines and penalties, negative reputational impacts that cause us to lose existing or future customers, and/or significant incident response, system restoration or remediation and future compliance costs. Further, our insurance coverage may not be sufficient to cover the financial, legal, business or reputational losses that may result from an interruption or breach of our systems. For further discussion on the potential liability related to the violation of these laws, see "Risk Factors-We, our collaborators and our service providers may be subject to a variety of data privacy and security laws and contractual obligations, which could increase compliance costs and our actual or alleged failure to comply with them could subject us to potentially significant fines or penalties, regulatory investigation, negative publicity, liability or and otherwise harm our business, results of operations and financial condition."