completed, ongoing or future clinical trials could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. Likewise, we rely on third parties for research and development, the manufacture and supply of drug product and drug substance and to conduct clinical trials. We depend on these third parties to implement adequate controls and safeguards to protect against and report cybersecurity incidents. If they fail to do so, we may suffer financial and other harm, including to our information, operations, performance, and reputation. To the extent that any cybersecurity incident or data breach were to result in a loss of, or damage to, our data or systems, or inappropriate disclosure of confidential or proprietary information, we may have an obligation to provide legal notifications and disclosures, and we could incur liability and the further development and commercialization of our product candidates could be delayed.
We are increasingly dependent on information technology systems and infrastructure, including mobile technologies, to operate our business. Cybersecurity threats, both on premises and in the cloud, are evolving and could occur and result in information theft, data corruption, operational disruption, damage to our reputation, or financial loss. Such threats include, but are not limited to: malicious software, destructive malware, ransomware attacks, denial-of-service attacks, business email compromises, viruses, wrongful intrusions, social engineering (including phishing attacks), attempts to gain unauthorized access to systems or data, data breaches, the unauthorized release of confidential, personal or otherwise protected information, data corruption, the breakdown or damage or interruption of networks or systems from, among other things, natural disasters, terrorism, war, telecommunication and electrical failures, and harm to individuals. In addition, we could be impacted by cybersecurity threats or other disruptions or vulnerabilities found in products or services we use that are provided to us by third-parties. The risk of a security breach or disruption, particularly through cyberattacks or cyber intrusion, including by computer hackers, cyber criminals, hacktivists, foreign governments, and cyber terrorists, has generally increased as the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased. The techniques used by criminal elements to attack computer systems are sophisticated, change frequently and may originate from less regulated and remote areas of the world. As a result, we may not be able to address these techniques proactively or implement adequate preventative measures. These events, if not prevented or effectively mitigated, could damage our reputation, require remedial actions and lead to loss of business, regulatory actions, potential liability and other financial losses.
Certain data breaches must also be reported to affected individuals and various government and/or regulatory agencies, and in some cases to the media, under provisions of HIPAA, as amended by HITECH, other U.S. federal and state law, and requirements of non-U.S. jurisdictions, including the European Union Data Protection Directive, and financial penalties may also apply.
Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our privacy and data security obligations. Further, although we maintain cyber liability insurance, this insurance may not provide adequate coverage against potential liabilities related to any experienced cybersecurity incident or data breach. In addition, such insurance may not be available to us in the future on economically reasonable terms, or at all. Further, our insurance may not cover all claims made against us and defending a suit, regardless of its merit, could be costly and divert management’s attention.
Inadequate funding for the FDA, the Securities Exchange Commission (SEC), the National Institutes of Health (NIH) and other government agencies, including from government shut downs, or other disruptions to these agencies’ staffing and operations, could hinder their ability to hire, retain or deploy personnel, and substantial leadership, personnel, and policy changes or otherwise could prevent new products from being developed or commercialized in a timely manner or otherwise prevent those agencies from performing normal business functions on which the operation of our business may rely, which could negatively impact our business.
The ability of the FDA to review and approve new products can be affected by a variety of factors, including government budget and funding levels, ability to hire and retain key personnel and accept the payment of user fees, and statutory, regulatory and policy changes. Average review times at the agency have fluctuated in recent years as a result of these factors. Disruptions at the FDA and other agencies, including substantial leadership departures, personnel cuts and policy changes, may also slow the time necessary for new product candidates to be reviewed and/or approved by necessary government agencies, which would adversely affect our business. Changes and cuts in FDA staffing have been reported by some in the pharmaceutical industry as creating instances of delays in the FDA’s responsiveness or in its ability to review IND submissions or applications, issue regulations or guidance, or implement or enforce regulatory requirements in a timely fashion or at all. In addition, government funding of the SEC and other government agencies on which our operations may rely, including those that fund research and development activities, is subject to the political process, which is inherently fluid and unpredictable.
For example, over the last several years the U.S. government has shut down several times and certain regulatory agencies, such as the FDA and the SEC, have had to furlough critical FDA, SEC and other government employees and stop critical activities. Currently, federal agencies in the U.S. are operating under a federal government shutdown due to expiration of the continuing resolution on September 30, 2025. The duration of the current government shutdown is unknown. If a prolonged government