from other countries and bulk purchasing. Due to the volatility in the current economic and market dynamics, we are unable to predict the impact of any unforeseen or unknown legislative, regulatory, payor or policy actions, which may include cost containment and healthcare reform measures. Such policy actions could have a material adverse impact on future worldwide sales of imetelstat, if approved.
RISKS RELATED TO INFORMATION TECHNOLOGY SYSTEMS,
DATA SECURITY AND DATA PRIVACY
If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including, but not limited to, regulatory investigations or actions; litigation; fines and penalties; a disruption of our business operations, including our clinical trials; reputational harm; loss of revenue and profits; and other adverse consequences.
In the ordinary course of our business, we (and third parties upon which we rely) collect, receive, store, use, transfer, make accessible, protect, secure, dispose of, transmit, disclose, or otherwise process (commonly known as processing) proprietary, confidential, and sensitive data, including personal data (such as health-related data and participant study related data), intellectual property, and trade secrets (collectively, sensitive information). In addition, we rely on third-party service providers to establish and maintain appropriate information technology and data security protections over the information technology systems they provide us to operate our critical business systems, including cloud-based infrastructure and systems, employee email, and data storage and management systems. However, except for contractual duties and obligations, we have limited ability to control or monitor third parties’ safeguards and actions related to such matters, and these third parties may not have adequate information security measures in place. Furthermore, while we may be entitled to damages if our third-party service providers fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. Most of our employees work remotely, resulting in increased risks to our information technology systems and data, as employees utilize network connections, computers, and devices outside our premises and networks, including working at home and while in transit and in public locations. Additionally, the prevalent use of mobile devices that access our sensitive information increases the risk of security incidents.
Future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies. Furthermore, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program.
Our information technology systems, including in our remote work environment, and those of the third parties upon which we rely, may be vulnerable to evolving threats. These threats are prevalent, continue to increase, and come from a variety of sources such as traditional “hackers,” threat actors, ““hacktivist,” organized criminal threats actors, or internal bad actors, personnel (such as through theft, error or misuse), sophisticated nation states and nation-state-supported actors. These threats include, but are not limited to, social-engineering attacks, malicious code or malware, unauthorized intrusions, denial-of-service attacks, personnel misconduct or errors, ransomware attacks, supply-chain attacks, software bugs, computer viruses, server malfunctions, software, hardware or data center failures, loss of data or other information technology assets, natural disasters, terrorism, war, telecommunication and electrical failures and attacks enhanced or facilitated by artificial intelligence, or AI, and other similar threats. In particular, ransomware attacks are becoming increasingly prevalent and severe and can lead to significant interruptions in operations, loss of data and income, reputational harm, and diversion of funds. If we were to experience such an attack, extortion payments might alleviate the negative impact of a ransomware attack, but we might be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Similarly, supply-chain attacks and attacks on clinical trial sites
S-45