In the ordinary course of our business, we may collect, receive, store, process, use, generate, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share, or collectively, Process, proprietary, confidential and sensitive information, including personal data (including, key-coded data, health information and other special categories of personal data), intellectual property, trade secrets, and proprietary business information owned or controlled by ourselves or other parties, or collectively, Sensitive Information.
We may use third-party service providers and subprocessors to help us operate critical business systems to Process Sensitive Information on our behalf in a variety of contexts, including without limitation, encryption and authentication technology, employee email, and other functions. Our ability to monitor these third parties' information security practices is limited, and these third parties may not have adequate information security measures in place. We may share or receive Sensitive Information with or from third parties.
If we, our service providers, partners or other relevant third parties have experienced, or in the future experience, any security incident(s) that result in, any data loss; deletion or destruction; unauthorized access to; loss, unauthorized acquisition, disclosure, or exposure of, Sensitive Information, or compromise related to the security, confidentiality, integrity or availability of our (or their) information technology, software, services, communications or data, or collectively, a Security Incident, it may materially adversely affect our business, financial condition, operating results and prospects, including the diversion of funds to address the breach, and interruptions, delays, or outages in our operations and development programs. In the first quarter of 2020, our email server was compromised in a cyber-attack. We quickly isolated the incident and have, since, implemented additional risk prevention measures.
Cyberattacks, malicious internet-based activity and online and offline fraud are prevalent and continue to increase. These threats are becoming increasingly difficult to detect especially as more advanced artificial intelligence and machine learning become available and increasingly used. These threats come from a variety of sources, including traditional computer "hackers", threat actors, employee error, theft or misuse, sophisticated nation-states, and nation-state supported actors. We and the third parties upon which we rely may be subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through phishing attacks); software bugs; malicious code (such as viruses and worms); denial-of-service attacks (such as credential stuffing); malware (including as a result of advanced persistent threat intrusions); supply-chain attacks, server malfunctions, software and hardware failures; loss of data or other information technology assets; adware; natural disasters; terrorism; war; telecommunication and electrical failures; ransomware attacks; and other similar threats.
Ransomware attacks, including those from organized criminal threat actors, nation-states and nation-state supported actors, are becoming increasingly prevalent and severe and can lead to significant interruptions, delays, or outages in our operations, loss of data, loss of income, significant extra expenses to restore data or systems, reputational loss and the diversion of funds. To alleviate the financial, operational and reputational impact of a ransomware attack, it may be preferable to make extortion payments, but we may be unwilling or unable to do so (including, for example, if applicable laws or regulations prohibit such payments).
Similarly, supply chain attacks have increased in frequency and severity, and we cannot guarantee that third parties and infrastructure in our supply chain have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach of or disruption to our systems and networks or the systems and networks of third parties that support us and our services. We may also be the subject of server malfunction, software or hardware failures, loss of data or other computer assets, and other similar issues. A significant portion of our workforce and third-party partners work remotely from time to time, and reliance on remote working technologies and the prevalent use of mobile devices that access confidential and personal data information increase the risk of Security Incidents, which could lead to the loss confidential information, personal data, trade secrets or other intellectual property.
We may be required to expend additional, significant resources, fundamentally change our business activities and practices, or modify our operations, including our clinical trial activities, or information technology in an effort to protect against Security Incidents and to mitigate, detect, and remediate actual and potential vulnerabilities. Certain data privacy and security obligations may require us to implement specific security measures or use industry-standard or reasonable measures to protect our information technology systems and Sensitive Information. Even if we were to take and have taken security measures designed to protect against Security Incidents, there can be no assurance that such security measures or those of our service providers, partners and other third parties will be effective in protecting against all Security Incidents and material adverse impacts that may arise from such Security Incidents. We may be unable in the future to detect vulnerabilities in our information technology systems because such threats and techniques change frequently, are often sophisticated in nature, and may not be detected until after a Security Incident has occurred. Despite our efforts to identify and remediate vulnerabilities, if any, in our information technology systems, our efforts may not be successful. Further, we may experience delays in developing and deploying remedial measures designed to address any such identified vulnerabilities.
If we (or a third-party upon whom we rely) experience a Security Incident or are perceived to have experienced a Security Incident, we may experience adverse consequences. These consequences may include: government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive information (including personal data); litigation (including class claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; interruptions in our operations (including availability of data); financial loss; and other similar harms. In addition, our actual or prospective customers, collaborators, partners and/or clinical trial participants may stop using our product candidates or working with us. This discontinuance, or failure to meet the expectations of such third parties, could result in material harm to our operations, financial performance or reputation and affect our ability to grow and operate our business.
Failures or significant downtime of our information technology or telecommunication systems or those used by our third-party service providers could cause significant interruptions in our operations and adversely impact the confidentiality, integrity and availability of Sensitive Information, including preventing us from conducting clinical trials, tests or research and development activities and prevent us from managing the administrative aspects of our business.
Applicable Data Protection Requirements (as defined below) may require us to notify relevant stakeholders of Security Incidents, including affected individuals, partners, collaborators, customers, regulators, law enforcement agencies, credit reporting agencies and others. Such disclosures are costly, and the disclosures or the failure to comply with such requirements could materially adversely affect our business, financial condition, operating results and prospects.
Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that any limitations or exclusions of liability in our contracts would be enforceable or adequate or would otherwise protect us from liabilities or damages if we fail to comply with Data Protection Requirements related to information security or Security Incidents.
We cannot be sure that our insurance coverage will be adequate or otherwise protect us from or adequately mitigate liabilities or damages with respect to claims, costs, expenses, litigation, fines, penalties, business loss, data loss, regulatory actions or material adverse impacts arising out of our Processing operations, privacy and security practices, or Security Incidents we may experience. The successful assertion of one or more large claims against us that exceeds our available insurance coverage, or results in changes to our insurance policies (including premium increases or the imposition of large excess or deductible or co-insurance requirements), could materially adversely affect our business, financial condition, operating results and prospects.