Our business operations rely upon information technology systems for data processing, storage, and reporting. Our information technology systems, along with those of the third parties whom we rely on, are potentially vulnerable to a variety of evolving cybersecurity threats that may expose our data to unauthorized persons or otherwise compromise its integrity. These threats may include, but are not limited to, social-engineering attacks (including phishing attacks), business email compromise, online and offline fraud, malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), employee misconduct, denial-of-service attacks, access attacks (such as credential stuffing), ransomware attacks, supply-chain attacks, and software bugs as well as cybersecurity failures resulting from human error, catastrophic events (such as fires, floods, hurricanes and tornadoes), loss of data or other information technology assets, and technological errors. We expend resources trying to protect against cybersecurity threats to our information technology systems. Additionally, certain data privacy and security laws, as well as industry best practice standards, may require us to implement and maintain additional cybersecurity measures.
Cybersecurity threat actors and their techniques change frequently, are often sophisticated in nature, and may not be detected until after a cybersecurity incident has occurred. While we have implemented cybersecurity measures designed to protect our information technology systems as well as the confidential and sensitive data in our possession, there can be no assurance that these measures will be adequate to detect, prevent, or adequately address any cybersecurity incident or data breach that we may face. Additionally, the third-parties with whom we do business may be sources or targets of cybersecurity attacks or other technological risks. While we engage in actions to reduce our exposure to third-party risks, we cannot control the cybersecurity plans and systems put in place by these third parties and ongoing threats may result in unauthorized access, loss, exposure or destruction or misuse of data, or other cybersecurity incidents, with increased costs and other consequences, including those described above.
If we, or a third party upon whom we rely, experience a cybersecurity incident or are perceived to have experienced a cybersecurity incident, we may experience adverse consequences. These consequences may affect our business strategy, results of operations, or financial condition and can include: government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive data (including personal data); litigation (including class claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; interruptions in our operations (including availability of data); financial loss; and other similar harms. To the extent that any disruption or cybersecurity incident were to result in a loss of, or damage to, a counterparties' data or applications, or inappropriate disclosure or misuse of confidential or proprietary information, our partners' operations may be harmed, and the development and commercialization of their products, development-stage product candidates, and technologies could be delayed. Further, our insurance coverage may not be adequate or sufficient in type or amount to protect us from or to mitigate liabilities arising out of our privacy and security practices.