our third-party collaborators, consultants, contractors, suppliers, or service providers were to suffer an attack or breach, for example, that resulted in the unauthorized access to or use or disclosure of personal information, including health-related information, we may have to notify individuals, collaborators, government authorities, and the media, and may be subject to investigations, civil penalties, administrative and enforcement actions, and litigation, any of which could harm our business and reputation. Likewise, we rely on our third-party CROs and other third parties to conduct clinical studies, and similar events relating to their computer systems could also have a material adverse effect on our business.
Attacks upon information technology systems are increasing in their frequency, levels of persistence, sophistication and intensity, and are being conducted by sophisticated and organized groups and individuals with a wide range of motives and expertise. Further, the COVID-19 pandemic is generally increasing the attack surface available to criminals, as more companies and individuals work online and work remotely, and as such, the risk of a cybersecurity incident potentially occurring, and our investment in risk mitigations against such an incident, is increasing. For example, there has been an increase in phishing and spam emails as well as social engineering attempts from “hackers” hoping to use the recent COVID-19 pandemic to their advantage. Because the techniques used to obtain unauthorized access to, or to sabotage, systems change frequently and often are not recognized until launched against a target, we may be unable to anticipate these techniques or implement adequate preventative measures. We may also experience security breaches that may remain undetected for an extended period. Even if identified, we may be unable to adequately investigate or remediate incidents or breaches due to attackers increasingly using tools and techniques that are designed to circumvent controls, to avoid detection, and to remove or obfuscate forensic evidence.
To the extent that any disruption or security breach were to result in a loss of, or damage to, our data or systems, or inappropriate or unauthorized access to or disclosure or use of confidential, proprietary, or other sensitive, personal information, including health-related information, we could incur liability and suffer reputational harm, and the development and commercialization of our products could be delayed. Our insurance policies may not be adequate to compensate us for the potential losses arising from such disruptions, failure, or security breach. In addition, such insurance may not be available to us in the future on economically reasonable terms, or at all. Further, our insurance may not cover all claims made against us and defending a suit, regardless of its merit, could be costly, divert management attention, and harm our reputation.
We face the significant risks associated with our company-wide implementation of an ERP system that may adversely affect our business and results of operations or the effectiveness of our internal controls over financial reporting.
We recently implemented a company-wide ERP system to upgrade certain existing business, operational, and financial processes. Our ERP implementation is a complex, expensive and time-consuming project and our ERP system initially went live in August 2022. Our results of operations could be adversely affected if we experience time delays or cost overruns during the ERP implementation process, or if the ERP system or associated process changes do not give rise to the benefits that we expect. This project has required and may continue to require investment of capital and human resources, the re-engineering of processes of our business, and the attention of many employees who would otherwise be focused on other aspects of our business. Any deficiencies in the design and implementation of the new ERP system could result in potentially higher costs than we had incurred previously and could adversely affect our ability to develop product candidates, launch products, file reports with the SEC in a timely manner, operate our business or otherwise affect our controls environment. Any of these consequences could have a material and adverse effect on our results of operations and financial condition.
We are subject to governmental regulation and other legal obligations related to privacy, data protection and information security. Compliance with these requirements could result in additional costs and liabilities to us or inhibit our ability to collect and process data, and the failure to comply with such requirements could have a material adverse effect on our business, financial condition or results of operations.
The global data protection landscape is rapidly evolving, and we are or may become subject to numerous state, federal and foreign laws, requirements and regulations governing the collection, use, disclosure, retention, and security