Risks Related to Data Privacy, Information Technology, and Cybersecurity
If our information technology systems, or those used by our CROs, CMOs, clinical sites, or other contractors, consultants, or third parties with whom we work, or our data are or were compromised, including by system failures, security incidents, or loss or leakage of data, or otherwise disrupted, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or action, litigation, fines and penalties, disruptions of our business operations, reputational harm, and other adverse consequences.
We are increasingly dependent upon information technology systems, infrastructure, and data to operate our business. In the ordinary course of our business, we, and the third parties with whom we work, collect, receive, store, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, share, and otherwise process, which we collectively refer to as process, personal data and other sensitive information, including proprietary and confidential business data, trade secrets, intellectual property, data we collect about trial participants in connection with clinical trials, sensitive third-party data, business plans, transactions and financial information, and other proprietary information, which we collectively refer to as sensitive data. We also generate a substantial amount of sensitive data through our technology platform in the ordinary course of our business. As a result we, and the third parties with whom we work, face a variety of evolving threats which could cause security incidents or other disruptions. Cyberattacks, malicious internet-based activity, online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of our sensitive data and information technology systems, and those of the third parties with whom we work. Therefore, it is critical that we and third parties with whom we work process sensitive data in a secure manner to maintain the confidentiality and integrity of such sensitive data and otherwise safeguard our information technology systems.
Despite the implementation of security measures, given the size and complexity of our information technology systems and those of our CROs, CMOs, clinical sites, and other contractors, consultants, and third parties with whom we work, and the increasing amounts of sensitive data that they maintain, such information technology systems are potentially vulnerable to cyberattacks, computer viruses, bugs, worms or other malicious codes, malware (including as a result of advanced persistent threat intrusions) and other attacks by computer hackers, brute force attacks, application security attacks, social engineering (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), infiltration by unauthorized persons, fraud, supply chain attacks and vulnerabilities through our third-party service providers or otherwise, denial-of-service attacks, credential stuffing, credential harvesting, personnel misconduct or error, supply-chain attacks, software bugs, breakdown or other damage or interruption from service interruptions, system or server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, attacks facilitated or enhanced by AI, telecommunications and electrical failures, earthquakes, fires, floods, other natural disasters, terrorism, war, and other similar threats. Such information technology systems are additionally vulnerable to security incidents or other disruptions from inadvertent or intentional actions by our employees, third-party vendors, contractors, consultants, business partners, and other third parties. The increase in remote work has increased these risks to our information technology systems and sensitive data, as more of our employees utilize network connections, computers, and devices outside our premises or network, including working at home, while in transit, and in public locations. Any of the foregoing may compromise or disable our system infrastructure, or that of our third-party vendors and other contractors and consultants, or lead to data leakage.
Such threats are prevalent and continue to rise, are increasingly difficult to detect, and come from a variety of sources, including traditional computer “hackers,” threat actors, “hacktivists,” organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation-states, and nation-state-supported actors. Some actors now engage and are expected to continue to engage in cyberattacks, including without limitation nation-state actors, for geopolitical reasons and in conjunction with military conflicts and defense activities. In particular, ransomware attacks, including those from organized criminal threat actors, nation-states, and nation-state-supported actors, are becoming increasingly prevalent, sophisticated, and severe, and can lead to significant interruptions, delays, or outages in our operations, loss of sensitive data, loss of income, significant extra expenses to restore data or systems, reputational loss, and the diversion of funds.
78