If our information technology systems or sensitive information, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including, but not limited to, regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm, loss of revenue or profits, and other adverse consequences.
In the ordinary course of our business, we may collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, processing) proprietary, confidential, and sensitive data, including personal data (such as health-related data), intellectual property, and trade secrets (collectively, sensitive information).We may share or receive sensitive information with or from third-party service providers and rely upon third-party service providers and technologies to operate critical business systems to process sensitive information in a variety of contexts, including, without limitation, third-party providers of cloud-based infrastructure, encryption and authentication technology, employee email, and other functions. Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place.
Despite the implementation of security measures, our internal computer systems, and those of third parties on which we rely, are vulnerable to cyberattacks, malicious internet-based activity and online and offline fraud. These threats are prevalent, continue to increase, and are becoming increasingly difficult to detect. These threats include, but are not limited to, malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks (such as credential stuffing), natural disasters, terrorism, war, telecommunication and electrical failures, social engineering attacks (including through phishing attacks), personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunction, software or hardware failures, loss of data or other information technology assets, adware, and other similar threats. Ransomware attacks, including by organized criminal threat actors, nation-states, and nation-state-supported actors, are becoming increasingly prevalent and severe and can lead to significant interruptions in our operations, loss of data and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Similarly, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties and infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach of or disruption to our information technology systems or the third-party information technology systems that support us. Additionally, the COVID-19 pandemic and our remote workforce poses increased risks to our information technology systems and data, as more of our employees work from home, utilizing network connections outside our premises. Future or past business transactions (such as acquisitions or integrations) could also expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies.
These threats come from a wide variety of sources, including threat actors, personnel (such as through theft or misuse), sophisticated nation-states, and nation-state-supported actors. These parties are expected to continue to engage in cyber-attacks, including, without limitation, nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we and the third parties upon which we rely may be vulnerable to a heightened risk of these attacks, including cyber-attacks that could materially disrupt our systems and operations, supply chain, and ability to produce, sell and distribute our products. For example, we may have operations and third parties upon which we rely to support our business located in unstable regions and regions experiencing (or expected to experience) geopolitical or other conflicts, including Ukraine, including through the use of cyber-attacks.
Any of the previously identified or similar threats could cause a security incident or other interruption. If such an event were to occur and cause interruptions in our operations, it could result in a material disruption of our product development programs. For example, the loss of clinical trial data from completed or ongoing or planned clinical trials could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data.
We may expend significant resources or modify our business activities (including our clinical trial activities) to try to protect against security incidents. We may be unable in the future to detect vulnerabilities in our information technology systems because such threats and techniques change frequently, are often sophisticated in nature, and may not be