disasters, power loss, war, telecommunications failures, viruses, denial or degradation of service attacks, ransomware, social engineering schemes, insider theft or misuse or other attempts to harm its systems. Arqit utilizes reputable third-party service providers or vendors for all of its IT and communications systems, and these providers could also be vulnerable to harms similar to those that could damage its systems, including sabotage and intentional acts of vandalism causing potential disruptions. Some of its systems will not be fully redundant, and its disaster recovery planning cannot account for all eventualities. Any problems with its third-party cloud hosting providers could result in lengthy interruptions in its business. In addition, Arqit’s services and functionality are highly technical and complex technology which may contain errors or vulnerabilities that could result in interruptions in its business or the failure of its systems.
If any of Arqit’s third parties’ systems, its customers’ cloud or on-premises environments, or its internal systems are breached or if unauthorized access to customer or third-party data is otherwise obtained, public perception of its business may be harmed, and Arqit may lose business and incur losses or liabilities.
Arqit’s success depends in part on its ability to provide effective data security protection in connection with its platforms and services, and Arqit relies on information technology networks and systems to securely store, transmit, index, and otherwise process electronic information. Because its platforms and services are used by its customers to encrypt large data sets that often contain proprietary, confidential, and/or sensitive information (including in some instances personal or identifying information and personal health information), its software is perceived as an attractive target for attacks by computer hackers or others seeking unauthorized access, and its software faces threats of unintended exposure, exfiltration, alteration, deletion, or loss of data. Additionally, because many of Arqit’s customers use its platforms to store, transmit, and otherwise process proprietary, confidential, or sensitive information, and complete mission critical tasks, they have a lower risk tolerance for security vulnerabilities in its platforms and services than for vulnerabilities in other, less critical, software products and services.
Arqit, and the third-party vendors upon which Arqit relies, have experienced, and may in the future experience, cybersecurity threats, including threats or attempts to disrupt its information technology infrastructure and unauthorized attempts to gain access to sensitive or confidential information. Its and its third-party vendors’ technology systems may be damaged or compromised by malicious events, such as cyberattacks (including computer viruses, malicious and destructive code, phishing attacks, and denial of service attacks), physical or electronic security breaches, natural disasters, fire, power loss, telecommunications failures, personnel misconduct, and human error. Such attacks or security breaches may be perpetrated by internal bad actors, such as employees or contractors, or by third parties (including traditional computer hackers, persons involved with organized crime, or foreign state or foreign state-supported actors).
Cybersecurity threats can employ a wide variety of methods and techniques, which may include the use of social engineering techniques, are constantly evolving, and have become increasingly complex and sophisticated; all of which increase the difficulty of detecting and successfully defending against them.
Furthermore, because the techniques used to obtain unauthorized access or sabotage systems change frequently and generally are not identified until after they are launched against a target, Arqit and its third-party vendors may be unable to anticipate these techniques or implement adequate preventative measures. Although prior cyberattacks directed at Arqit have not had a material impact on its financial results, and Arqit is continuing to bolster its threat detection and mitigation processes and procedures, Arqit cannot guarantee that future cyberattacks, if successful, will not have a material impact on its business or financial results. While Arqit has security measures in place to protect its information and its customers’ information and to prevent data loss and other security breaches, there can be no assurance that Arqit will be able to anticipate or prevent security breaches or unauthorized access of its information technology systems or the information technology systems of the third-party vendors upon which Arqit relies. Despite its implementation of network security measures and internal information security policies, data stored on personnel computer systems is also vulnerable to similar security breaches, unauthorized tampering or human error.
Many governments have enacted laws requiring companies to provide notice of data security incidents involving certain types of data, including personal data. In addition, most of Arqit’s customers contractually require Arqit to notify them of data security breaches. If an actual or perceived breach of security measures, unauthorized access to its system or the systems of the third-party vendors that Arqit rely upon, or any other cybersecurity threat occurs, Arqit may face direct or indirect liability, costs, or damages, contract termination, its reputation in the industry and with current and potential customers may be compromised, its ability to attract new customers could be negatively affected, and its business, financial condition, and results of operations could be materially and adversely affected.
Further, unauthorized access to Arqit’s or its third-party vendors’ information technology systems or data or other security breaches could result in the loss of information; significant remediation costs; litigation, disputes, regulatory action, or investigations that could result in damages, material fines, and penalties; indemnity obligations; interruptions in the operation of its business, including its ability to provide new product features, new platforms, or services to its customers; damage to its operation technology networks and information technology systems; and other liabilities. Moreover, its remediation efforts may not be successful. Any or all of these issues,