Any significant uninsured loss, prolonged or repeated disruption to operations or inability to operate, experienced by us or by our suppliers, could materially and adversely affect our business, financial condition and results of operations.
We are subject to information technology systems failures, security breaches, loss or leakage of data, technological malfunctions or other disruptions, which could result in, among other things, material disruption of our operations, financial losses, the inability to process transactions, the unauthorized release of confidential information and reputational risk, restrictions on accessing critical information and potential exposure to liability, all of which would negatively impact our business, financial condition or results of operations.
Our use of technology, infrastructure and data is critical to our continued operations. We are susceptible to operational, financial and information security risks resulting from security breaches, loss or leakage of data, technological malfunctions or other disruptions. Successful security breaches or technological malfunctions affecting us, our CROs, CMOs, suppliers or other third-party service providers can result in, among other things, material disruption of our operations, including our product development programs, financial losses, the inability to process transactions, the unauthorized release of confidential information, proprietary or other business information (including personal data), reputational risk, restrictions on accessing critical information and potential exposure to liability.
Cyber-attacks include, but are not limited to, deployment of harmful malware, ransomware, denial-of-service attacks, social engineering and other means to affect service reliability and threaten the confidentiality, integrity and availability of our and our service providers’ systems and the information on such systems. Cyber-attacks can also include phishing attempts or e-mail fraud to cause unauthorized payments or information to be transmitted to an unintended recipient, or to permit unauthorized access to systems. As cybersecurity threats continue to evolve, we may be required to use additional resources to continue to modify or enhance protective measures or to investigate security vulnerabilities, which could have a material adverse effect on our business, financial condition or results of operations.
Any security breach or other incident, whether actual or perceived, could impact our reputation and/or operations, cause us to incur significant costs, including legal expenses, harm customer confidence, hurt our expansion into new markets, cause us to incur remediation costs, or cause us to lose existing customers. For example, the loss of clinical trial data from clinical trials could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. To the extent that any disruption or security breach affects our systems (or those of our third-party service providers) or were to result in a loss of or accidental, unlawful or unauthorized access, use, release or other processing of personally identifiable information, confidential or proprietary information or damage to our data or applications, our product development programs could be materially disrupted and we could incur liability and become subject to significant fines, penalties or liabilities for any noncompliance to certain privacy and security laws.
We have also outsourced elements of our information technology infrastructure, and as a result, a number of third-party vendors have access to our confidential information. If the information technology systems of our third-party vendors become subject to disruptions or security breaches that compromise our confidential, proprietary or other business information (including personal data), we may incur liability and reputational damage but have insufficient recourse against such third parties. We will also have to expend significant resources to mitigate the impact of such an event and develop and implement protections to prevent future events of this nature from occurring.
Further, despite the implementation of security measures, our information technology systems and those of our third-party service providers are vulnerable to cybersecurity attacks, breakdowns or other damages or disruptions from service interruptions, system malfunction, unauthorized access or use, natural and man-made disasters, geopolitical conflicts and telecommunications, power outages or other infrastructure failures. Although we currently hold cybersecurity insurance, the costs related to significant security breaches or disruptions could be material and cause us to incur significant expenses.