Our information technology systems, or those used by our third-party CROs or other contractors or consultants, may fail or suffer security breaches and geopolitical tensions or conflicts, such as the ongoing war in Ukraine, may create a heightened risk of cyberattacks.
Despite the implementation of security measures, our internal computer, server, and other information technology systems as well as those of our third-party collaborators, consultants, contractors, suppliers, and service providers, may be vulnerable to damage from physical or electronic break-ins, computer viruses, “phishing” attacks, malware, ransomware, denial of service and other cyberattacks or disruptive incidents that could result in unauthorized access to, use or disclosure of, corruption of, or loss of sensitive, and/ or proprietary data, including health-related information or other personal information, and could subject us to significant liabilities and regulatory and enforcement actions, and reputational damage. In addition, geopolitical tensions or conflicts, such as the war between Russia and Ukraine or the war between Israel and Hamas, may create a heightened risk of cyberattacks. We have also outsourced elements of our information technology infrastructure, and as a result a number of third-party vendors may or could have access to our confidential information. If we or any of our third-party collaborators or service providers were to experience any material failure or security breach, it could result in a material disruption of our development programs, reputation, and business operations. For example, the loss of clinical study data from completed or ongoing clinical studies could result in delays in any regulatory approval or clearance efforts and significantly increase our costs to recover or reproduce the data, and subsequently commercialize the product.
We and certain of our service providers are from time to time subject to cyberattacks and security incidents. While we do not believe that we have experienced any significant system failure, accident or security breach to date, if we or our third-party collaborators, consultants, contractors, suppliers, or service providers were to suffer an attack or breach, for example, that resulted in the unauthorized access to or use or disclosure of personal information, including health-related information, we may have to notify individuals, collaborators, government authorities, and the media, and may be subject to investigations, civil penalties, administrative and enforcement actions, and litigation, any of which could harm our business and reputation. Likewise, we rely on our third-party CROs and other third parties to conduct clinical studies, and similar events relating to their computer systems could also have a material adverse effect on our business.
Attacks upon information technology systems are increasing in their frequency, levels of persistence, sophistication and intensity, and are being conducted by sophisticated and organized groups and individuals with a wide range of motives and expertise. Further, the continued hybrid working environment has generally increased the attack surface available to criminals, as more companies and individuals work online and work remotely, and as such, the risk of a cybersecurity incident potentially occurring, and our investment in risk mitigations against such an incident, is increasing. Because the techniques used to obtain unauthorized access to, or to sabotage, systems change frequently and often are not recognized until launched against a target, we may be unable to anticipate these techniques or implement adequate preventative measures. We may also experience security breaches that may remain undetected for an extended period. Even if identified, we may be unable to adequately investigate or remediate incidents or breaches due to attackers increasingly using tools and techniques that are designed to circumvent controls, to avoid detection, and to remove or obfuscate forensic evidence.
To the extent that any disruption or security breach were to result in a loss of, or damage to, our data or systems, or inappropriate or unauthorized access to or disclosure or use of confidential, proprietary, or other sensitive, personal information, including health-related information, we could incur liability and suffer reputational harm, and the development and commercialization of our products could be delayed. Federal, state and international laws and regulations can expose us to enforcement actions and investigations by regulatory authorities, and potentially result in regulatory penalties, fines and significant legal liability, if our information technology security efforts fail. We may also be exposed to a risk of loss or litigation and potential liability, which could materially and adversely affect our business, results of operations or financial condition. Our insurance policies may not be adequate to compensate us for the potential losses arising from such disruptions, failure, or security breach. In addition, such insurance may not be available to us in the future on economically reasonable terms, or at all. Further, our insurance may not cover all claims made