We collect, store, receive, transmit, generate, use, transfer, disclose, make accessible, protect, secure, dispose, share and otherwise process (collectively, process) proprietary, confidential and otherwise sensitive information, including personal information (such as health-related data of clinical trial participants and employee information), in the course of our business. Our technology systems and the information and data processed and stored by us or by third parties with whom we work (e.g., research collaborators, partners, CROs, CDMOs, contractors, consultants and other third parties), are vulnerable to a variety of evolving online and offline threats that could result in security incidents, including unauthorized, unlawful, or accidental loss, damage, corruption, access, use, encryption, acquisition, disclosure, misappropriation, or other compromise of such systems or data. A security incident or other interruption could disrupt our ability (and that of third parties with whom we work) to operate our business (including to conduct our clinical trials) and may have other adverse effects.
We and third parties with whom we work face threats that are constantly evolving and growing in frequency, sophistication, and intensity. These threats include (without limitation) malware (including as a result of advanced persistent threat intrusions), viruses, worms, software vulnerabilities and bugs, software or hardware failures, hacking, denial of service attacks, social engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing), credential harvesting, ransomware, personnel misconduct or errors, credential stuffing, telecommunications failures, loss or theft of devices, data or other information technology assets, attacks enhanced or facilitated by AI, earthquakes, fires, floods and other similar threats. Threats such as ransomware attacks, for example, are becoming increasingly prevalent and severe, and attackers are increasingly leveraging multiple attack methods to extort payment from victims, such as data theft and disabling systems. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. If a security incident were to materially impact us, our CROs, our CDMOs, our service providers, our current or potential future parties or other third parties with whom we work, there could be material disruptions to our business operations or other significant harm to our business.
Security incidents may result from the actions of a wide variety of actors with a wide range of motives and expertise, including traditional hackers, hacktivists, our personnel, or the personnel of the third parties we work with, sophisticated nation-states, nation-state-supported actors, and organized criminal threat actors. During times of war and other major conflicts, we, the third parties with whom we work, and our customers may be vulnerable to a heightened risk of these attacks, including retaliatory cyber-attacks, that could materially disrupt our systems and operations, supply chain, and ability to produce, sell and distribute our goods and services.
Certain functional areas of our workforce work remotely on a full- or part-time basis outside of our corporate network security protection boundaries or otherwise utilize network connections, computers and devices outside of our premises or network, which imposes additional risks to our business, including increased risk of industrial espionage, phishing, and other cybersecurity attacks, and unauthorized dissemination of proprietary or confidential information, including personal information, any of which could have a material adverse effect on our business. Additionally, future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities' systems and technologies. Furthermore, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program.
In addition, we rely on third parties to operate critical business systems and process sensitive data in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, personnel email, and other functions. We also rely on third parties, including CROs, clinical trial sites and clinical trial vendors, to process sensitive data as part of our research activities. Our ability to monitor these third parties is limited, and these third parties may not have adequate information security measures in place and may expose us to cyberattacks and other security incidents. Supply-chain attacks have also increased in frequency and severity, and we cannot guarantee that third parties' infrastructure in our supply chain or the supply chains of the third parties with whom we work have not been compromised. If the third parties with whom we work experience a security incident or other interruption, we could experience materially adverse consequences. While we may be entitled to damages if the third parties with whom we work fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award.
We may be required to, or we may choose to, expend significant resources (including financial) or modify our business activities (including our clinical trial activities) in an effort to protect our information systems and data (including against security incidents) or to detect, investigate, mitigate, contain and remediate a security incident, particularly where required by applicable data privacy and security laws or regulations or industry standards. While we have implemented security measures and processes designed to protect against, mitigate and remediate security incidents, we cannot assure you that these security measures that we or our service providers implement will be effective in preventing security incidents, disruptions, cyberattacks, or other similar events. For example, we have been the target of unsuccessful phishing attempts in the past and expect such attempts will continue in the future. We take steps designed to detect, mitigate, and remediate vulnerabilities in our information systems (such as our hardware and/or software, including that of third parties with whom we work). We may not, however, detect and remediate, all such vulnerabilities including on a timely and effective basis. Further, we may experience delays in developing and deploying remedial measures and patches designed to address identified vulnerabilities. Vulnerabilities could be exploited and result in a security incident.
Any of the previously identified or similar threats could cause a security incident. A security incident could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to data. If our information systems or data, or that of the third parties with whom we work, are compromised or were perceived to be compromised, it could interrupt our operations, disrupt our development programs and have a material adverse effect on our business, financial condition and results of operations. For example, the loss or corruption of clinical trial data from completed or future clinical trials could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. Likewise, we rely on third parties for the manufacture of pacibekitug, to analyze clinical trial samples and to conduct clinical trials, and security incidents experienced by these third parties could have a material adverse effect on our business. Actual or perceived security incidents affecting us or the third parties with whom we work or partner with could result in substantial remediation costs and expose us to litigation (including class claims), regulatory enforcement action (for example, investigations, fines, penalties, audits and inspections), additional reporting requirements and/or oversight, fines, penalties, indemnification obligations, negative publicity, reputational harm, monetary fund diversions, diversion of management attention, interruptions in our operations (including availability of data or processing of sensitive information), financial loss and other liabilities, and harms. Additionally, such incidents may trigger data privacy and security obligations requiring us to notify relevant stakeholders, such as individuals, regulators, and others, or take other required remedial or corrective actions and may subject us to liability. Such disclosures and remediation efforts may be costly, and related requirements or the failure to comply with them could lead to adverse consequences.
Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from claims related to our data privacy and security obligations. Additionally, we cannot be certain that our insurance coverage will be adequate for data security liabilities actually incurred, will continue to be available to us on economically and commercially reasonable terms, or at all, or that any insurer will not deny coverage as to any future claim. The successful assertion of one or more large claims against us that exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could adversely affect our reputation, business, financial condition and results of operations.
In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position. Additionally, sensitive information of the Company could be leaked, disclosed, or revealed as a result of or in connection with our personnel's, or vendors' use of generative AI technologies.