The impact of any of the foregoing, individually or collectively, could adversely affect our business, financial condition, and results of operations. Moreover, to the extent the COVID-19 pandemic adversely affects our business, financial condition, and results of operations, it may also have the effect of heightening many of the other risks described in this “Risk Factors” section.
If our security measures, or those maintained on our behalf, are compromised now, or in the future, or the security, confidentiality, integrity or availability of our information technology, software, services, networks, communications or data is compromised, limited or fails, this could have a material adverse effect on our business, financial condition and results of operations.
In the ordinary course of our business, we may collect, use, store, safeguard, disclose, share, transfer, secure and otherwise process (collectively, “Process” or “Processing”) proprietary, confidential and sensitive data, including personal data (such as key-coded data, health information and other special categories of personal data), intellectual property, trade secrets and proprietary business information owned or controlled by ourselves, our customers and other parties (collectively “Sensitive Information”).
We may use third-party service providers and subprocessors to help us operate our business and engage in Processing on our behalf. We may also share Sensitive Information with our partners or other third parties in conjunction with our business. We manage and maintain our data utilizing a combination of on-site systems and cloud-based data centers. We utilize external security and infrastructure vendors to manage parts of our data centers. This data encompasses a wide variety of Sensitive Information, including research and development information, commercial information and business and financial information.
Cybersecurity incidents compromising the confidentiality, integrity, and availability of Sensitive Information or our systems could result from cyber-attacks, computer malware, viruses, social engineering (including phishing), ransomware, supply chain attacks, credential stuffing, efforts by individuals or groups of hackers and sophisticated organizations, including state-sponsored organizations, errors or malfeasance of our personnel, and security vulnerabilities in the software or systems on which we rely. Such incidents are prevalent and continue to increase. Due to the COVID-19 pandemic, a significant portion of our workforce works remotely and this has increased the risk to our information technology assets and data. If we, our service providers, partners or other relevant third parties have experienced, or in the future experience, any security incident(s) that result in any data loss, deletion or destruction; unauthorized access, acquisition, disclosure or exposure of Sensitive Information; or compromise related to the security, confidentiality, integrity or availability of our (or their) information technology, software, services, communications or data (any, a “Security Breach”), it may result in a material adverse effect on our business, financial condition and results of operations, including the diversion of funds to address the breach, and interruptions, delays, or outages in our operations.
We may be required to expend significant resources, fundamentally change our business activities and practices, or modify our operations or information technology in an effort to protect against Security Breaches and to mitigate, detect, and remediate actual and potential vulnerabilities. Various data privacy and security laws, regulations and standards, as well as policies, contracts and other obligations, that apply to the Processing of personal data both by us and on our behalf (collectively, “Data Protection Requirements”) may require us to implement specific security measures or use industry-standard or reasonable measures to protect against Security Breaches. Even if we were to take and have taken security measures designed to protect against Security Breaches, there can be no assurance that such security measures or those of our service providers, partners and other third parties will be effective in protecting against all Security Breaches and material adverse effects that may arise from such Security Breaches.
Applicable Data Protection Requirements may require us to notify relevant stakeholders of Security Breaches, including affected individuals, partners, collaborators, customers, regulators, law enforcement agencies, credit reporting agencies and others. Such disclosures are costly, and the disclosures or the failure to comply with such requirements could lead to material adverse effects on our business, financial condition and
34