parties (including supply chain cyber-attacks or the deployment of harmful malware, ransomware, denial-of-service attacks, social engineering and other means to affect service reliability and threaten the confidentiality, integrity and availability of information), which may compromise our system infrastructure or lead to the loss, destruction, alteration, prevention of access to, disclosure, or dissemination of, or damage or unauthorized access to, our data (including trade secrets or other confidential information, intellectual property, proprietary business information, and personal information) or data that is processed or maintained on our behalf, or other assets, which could result in financial, legal, business and reputational harm to us. For example, in 2019, one of our CROs experienced a cybersecurity breach which resulted in unauthorized access to certain of our preclinical data. Additionally, in 2023, one of our CROs experienced a cyber-attack for which an investigation found that no unauthorized access to Edgewise data occurred in connection with this event. We have received phishing attacks, and companies have, in general, experienced an increase in phishing and social engineering attacks from third parties in connection with remote working, which has increased these and other cybersecurity risks. Additionally, cybersecurity researchers have warned of heightened risks of cyberattacks in connection with Russia’s war with Ukraine, and war and instability in Israel and the surrounding region. Any disruption or security incident resulting in any loss, destruction, unavailability, alteration, disclosure, disruption or dissemination of, or damage or unauthorized access to, our applications, any other data processed or maintained on our behalf or other assets, or for it to be believed or reported that any of these occurred, could cause us to incur costs, liability, and other financial harm and reputational damage and could contribute to delays in the development and commercialization of our product candidates. We cannot assure you that our data protection efforts and our investment in information technology, or the efforts or investments of CROs, consultants or other third parties, will prevent significant breakdowns in systems or will prevent, or have prevented, other cyber incidents that could disrupt our programs and operations and the development of our product candidates or result in loss, destruction, unavailability, alteration or dissemination of, or damage or unauthorized access to, our data and other data processed or maintained on our behalf or other assets, any of which could have a material adverse effect upon our reputation, business, operations or financial condition. Any such event that leads to loss, damage, or unauthorized access to, or use, alteration, or disclosure, dissemination, or other processing of, personal information, including personal information regarding our clinical trial subjects or employees, or the perception that any such event has occurred, could harm our reputation directly, compel us to comply with federal and/or state breach notification laws and foreign law equivalents, subject us to mandatory corrective action, cause us to incur costs, and otherwise subject us to liability under laws and regulations that protect the privacy and security of personal information, which could result in significant legal and financial exposure and reputational damages that could potentially have an adverse effect on our business.
Notifications and follow-up actions related to a security breach or incident could impact our reputation and cause us to incur significant costs, including legal expenses and remediation costs. For example, the loss, corruption or unavailability of clinical trial data from completed or future clinical trials could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the impacted data. We expect to incur significant costs in an effort to detect and prevent security breaches and incidents, and we may face increased costs and requirements to expend substantial resources in the event of an actual or perceived security breach or incident. We also rely on third parties to manufacture our product candidates, and for other purposes, and similar events relating to their infrastructure and systems could also have a material adverse effect on our business.
Our insurance policies may not be adequate to compensate us for the potential losses arising from any such disruption in or, failure or security breach or incident of or impacting our systems or third-party systems where information important to our business operations or commercial development is stored. In addition, such insurance may not be available to us in the future on economically reasonable terms, or at all. Further, our insurance may not cover all claims made against us and could have high deductibles in any event, and defending a suit, regardless of its merit, could be costly and divert management attention.
Our operations are vulnerable to interruption by fire, earthquakes, power loss, telecommunications failure, terrorist activity, pandemics and other events beyond our control, which could harm our business.
Our facilities are located in Boulder, Colorado. We have not undertaken a systematic analysis of the potential consequences to our business and financial results from a major flood, blizzard, fire, earthquake, power loss,