facilities, cloud-based services and hardware, social media sites and mobile technology, in connection with the conduct of our business.
We must constantly update our information technology systems and infrastructure and undertake investments in new information technology systems and infrastructure. However, we cannot provide assurance that the information technology systems and infrastructure on which we depend, including those of third parties, will continue to meet our current and future business needs or adequately safeguard our operations. Furthermore, modification, upgrade or replacement of such systems and infrastructure may be costly or out of our control.
Any failure to so modify, upgrade or replace such systems and infrastructure, any disruptions that occur during the process of such modification, upgrade or replacement and/or any breakdown, interruption or corruption of our information technology systems and infrastructure could create system disruptions, shutdowns, delays in generating or the corruption or loss of data and information or other disruptions that could result in negative financial, operational, business or reputational consequences for us.
The size and complexity of the information technology systems and infrastructure on which we rely makes such systems and infrastructure potentially vulnerable to internal or external inadvertent or intentional security breaches, including as a result of private or state-sponsored cybercrimes, terrorism, war, malware, ransomware, human error, system malfunction, telecommunication and electrical failures, natural disaster, misplaced or lost data, socially engineered breaches or other similar events.
In addition, during the normal course of our business operations, including through the use of information technology systems and infrastructure, we are involved in the collection, processing, transmission, use and retention of sensitive, confidential, non-public or personal data including personal health data and information in Canada, the United States and abroad.
Cyber-attacks are increasing in frequency, sophistication and intensity and are made by groups and individuals with a wide range of motives and expertise. Cyber-attacks could include the deployment of harmful malware, ransomware, denial-of-service attacks, worms, social engineering, improper modification of information, fraudulent “phishing” e-mails and other means to affect service reliability or threaten data confidentiality, integrity or availability. Techniques used in these attacks are often highly sophisticated, change frequently and may be difficult to detect for periods of time.
We have established: (i) physical, electronic and organizational measures to safeguard and secure our systems to prevent a compromise and (ii) policies and procedures designed to provide for the timely investigation of cybersecurity incidents and the timely disclosure of cybersecurity incidents consistent with our legal and contractual obligations. We also rely on commercially available systems, software, tools and monitoring to provide security for the processing, transmission and storage of digital information.
While we attempt to take appropriate security and cybersecurity measures to protect our information technology systems and infrastructure (including any trade secrets, confidential or other sensitive information) and to prevent and detect breakdowns, unauthorized breaches and cyber-attacks, we cannot guarantee that these measures will be successful and that breakdowns and breaches of, or attacks on, our systems and data, or those of third parties upon which we rely, will be prevented. Such breakdowns and breaches of, or attacks on, our systems and infrastructure, or the public perception that we or any third party upon which we rely have suffered a cybersecurity incident or breakdown, may cause business interruption and could have a material adverse effect on our business, financial condition, cash flows and results of operations, damage our reputation with customers, employees and third parties with whom we do business and cause the market value of our common shares to decline, and we may suffer financial damage or other loss, including fines or criminal penalties or may be subject to litigation, including potentially class action law suits because of lost or misappropriated information.
While we maintain insurance against some of these risks, this insurance may not be sufficient to cover the financial, legal, business or reputational losses that may result from a breakdown, breach, cyber-attack or other
49