It is important that we do so in a secure manner to maintain the confidentiality, integrity and availability of such sensitive information. We have also outsourced elements of our operations (including elements of our information technology infrastructure) to third parties, and as a result, we manage a number of third-party vendors who may or could have access to our computer networks or our sensitive information. In addition, many of those third parties in turn subcontract or outsource some of their responsibilities to third parties. While all information technology operations are inherently vulnerable to inadvertent or intentional security breaches, incidents, attacks and exposures, the accessibility and distributed nature of our information technology systems, and the sensitive information stored on or transmitted between those systems, make such systems potentially vulnerable to unintentional or malicious, internal and external exploits of our technology environment. In addition, we may face increased risks of a security breach or disruption due to our reliance on internet technology and the number of our employees who are working remotely, which may create additional opportunities for cybercriminals to exploit vulnerabilities.
Cyber incidents are increasing in their frequency, levels of persistence, sophistication and intensity, and are being conducted by organized groups and individuals with a wide range of motives (including, but not limited to, industrial espionage) and expertise, including organized criminal groups, “hacktivists,” nation states and others. In addition to the extraction of sensitive information, such attacks could include the deployment of harmful malware, ransomware, supply chain attacks, denial-of-service attacks, social engineering and other means to affect service reliability and threaten the confidentiality, integrity and availability of information. Data security incidents and other inappropriate access can also be difficult to detect, and any delay in identifying them may lead to increased harm. In addition, the prevalent use of mobile devices increases the risk of data security incidents.
Significant disruptions of, or cyber incidents directed at, our or our third-party vendors’ and/or business partners’ information technology systems could adversely affect our business operations and/or result in the loss, misappropriation, and/or unauthorized access, use or disclosure of, or the prevention of access to, sensitive information, which could result in a variety of adverse effects, including financial, legal, regulatory, business and reputational harm to us. In addition, information technology system disruptions, whether from attacks on our technology environment or from computer viruses, natural disasters, terrorism, war and telecommunication and electrical failures, could result in a material disruption of our development programs and our business operations. For example, the loss of clinical trial data from completed or future clinical trials could result in delays in our marketing approval efforts and significantly increase our costs to recover or reproduce the data. Additionally, theft of our intellectual property or proprietary business information could require substantial expenditures to remedy. If we or our third-party collaborators, consultants, contractors, suppliers, vendors or service providers were to suffer an actual or likely attack or breach, for example, that involves the unauthorized access to or use or disclosure of personal or health information, we may have to notify consumers, partners, collaborators, government authorities, and the media, and may be subject to investigations, civil penalties, administrative and enforcement actions (including mandatory corrective action or requirements to verify the correctness of database contents), and consuming, distracting and expensive litigation, any of which could result in increased costs to us, and result in significant legal and financial exposure, or other harm to our business and reputation.
While we have no reason to believe that we have been subject to any material system failure, accident or security breach to date, we have experienced cybersecurity incidents in the past and expect that we will experience cybersecurity incidents in the future. In addition, attackers have become very sophisticated in the way they conceal access to systems, and many companies that have been attacked are not aware that they have been attacked. We may also experience security breaches that may remain undetected for an extended period. Even if identified, we may be unable to adequately investigate or remediate incidents or breaches due to attackers increasingly using tools and techniques that are designed to circumvent controls, to avoid detection, and to remove or obfuscate forensic evidence. While we have implemented security measures intended to protect our information technology systems and infrastructure, such measures may not successfully prevent service interruptions or security incidents.
Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our data privacy and security obligations. We cannot be sure that our insurance coverage will be adequate or sufficient to protect us from or to mitigate liabilities arising out of our privacy and security practices, that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims.
*Failure to comply with data privacy and security laws, regulations and other obligations could lead to government enforcement actions (which could include civil or criminal penalties), private litigation, negative publicity, and/or other adverse consequences that could negatively affect our operating results and business.
We and our partners and vendors may be subject to federal and state privacy and data protection laws and regulations as well as international laws that impose broad compliance obligations on the collection, possession, use, storage, access, disclosure, transfer, deletion and protection of personal data. In the United States, numerous federal and state laws and regulations, including state data breach notification laws, state health information privacy laws, and federal and state consumer protection laws and regulations that govern the collection, use, disclosure, and protection of health-related and other personal data, could apply to our operations or the