Despite the implementation of security measures, our internal computer systems, and those of third parties on which we rely, we are vulnerable to damage from computer viruses, malware, natural disasters, terrorism, war, telecommunication and electrical failures, cyber-attacks or cyber-intrusions over the Internet, phishing attacks, persons inside our organization or persons with access to systems inside our organization. The risk of a security breach or disruption, particularly through cyber-attacks or cyber-intrusion, including by computer hackers, foreign governments and cyber terrorists, has generally increased as the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased and been targeted at pharmaceutical companies in particular. Also, increasing use of artificial intelligence may increase the risk of cyber attacks. If such an event were to occur and cause interruptions in our operations, it could result in a material disruption of our drug development programs. For example, the loss of clinical trial data from completed or ongoing or planned clinical trials could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data.
Also, our processing of sensitive information may subject us to data privacy and security obligations, and confidential patient and other personal or sensitive information may be compromised in a cyber-attack or cyber-intrusion. In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws and other similar laws (e.g., wiretapping laws). For example, the Health Insurance Portability and Accountability Act of 1996 imposes specific requirements relating to the privacy, security and transmission of individually identifiable health information. If we or the third parties on which we rely fail, or are perceived to have failed, to address or comply with data privacy and security obligations, we could face significant consequences. These consequences may include, but are not limited to, government enforcement actions, litigation, additional reporting requirements and/or oversight, bans on processing personal data, orders to destroy or not use personal data and imprisonment of Company officials.
To the extent that any disruption or security breach was to result in a loss of or damage to our data or applications, or inappropriate disclosure of confidential or proprietary information, we could incur material legal claims and liability, damage to our reputation, and the further development of our drug candidates could be delayed.