Our contract manufacturers would also be subject to the same risks we face in developing our own manufacturing capabilities, as described above. Each of these risks could delay our clinical trials, the approval, if any, of our product candidates by the FDA or the commercialization of our product candidates or result in higher costs or deprive us of potential product revenue. In addition, we will rely on third parties to perform release tests on our product candidates prior to delivery to patients. If these tests are not appropriately done and test data are not reliable, patients could be put at risk of serious harm.
Cell-based therapies rely on the availability of specialty raw materials, which may not be available to us on acceptable terms or at all.
Our product candidates require many specialty raw materials, including viral vectors that deliver the targeting moiety and other genes to the product candidate. We currently manufacture through contract manufacturers, some of which have limited resources and experience supporting a commercial product, and such suppliers may not be able to deliver raw materials to our specifications. Those suppliers normally support blood-based hospital businesses and generally do not have the capacity to support commercial products manufactured under cGMP by biopharmaceutical firms. The suppliers may be ill-equipped to support our needs, especially in non-routine circumstances like an FDA inspection or medical crisis, such as widespread contamination. We also do not have contracts with many of these suppliers, and we may not be able to contract with them on acceptable terms or at all. Accordingly, we may experience delays in receiving key raw materials to support clinical or commercial manufacturing.
In addition, some raw materials utilized in the manufacture of our candidates are currently available from a single supplier, or a small number of suppliers. We cannot be sure that these suppliers will remain in business or that they will not be purchased by one of our competitors or another company that is not interested in continuing to produce these materials for our intended purpose. Further, the lead time needed to establish a relationship with a new supplier can be lengthy, and we may experience delays in meeting demand in the event we must switch to a new supplier. The time and effort to qualify a new supplier could result in additional costs, diversion of resources or reduced manufacturing yields, any of which would negatively impact our operating results. We may be unable to enter into agreements with a new supplier on commercially reasonable terms, which could have a material adverse impact on our business.
If we or our third-party suppliers use hazardous, non-hazardous, biological or other materials in a manner that causes injury or violates applicable law, we may be liable for damages.
Our research and development activities involve the controlled use of potentially hazardous substances, including chemical and biological materials. We and our suppliers are subject to federal, state and local laws and regulations in the United States governing the use, manufacture, storage, handling and disposal of medical and hazardous materials. Although we believe that our and our suppliers’ procedures for using, handling, storing and disposing of these materials comply with legally prescribed standards, we and our suppliers cannot completely eliminate the risk of contamination or injury resulting from medical or hazardous materials. As a result of any such contamination or injury, we may incur liability or local, city, state or federal authorities may curtail the use of these materials and interrupt our business operations. In the event of an accident, we could be held liable for damages or penalized with fines, and the liability could exceed our resources. Compliance with applicable environmental laws and regulations is expensive, and current or future environmental regulations may impair our research, development and production efforts, which could harm our business, prospects, financial condition or results of operations.
Our internal computer systems, or those used by our CROs or other contractors or consultants, may fail or suffer security breaches, incidents, or compromises.
Our internal computer systems and the systems of our CROs, contractors and consultants are vulnerable to cybersecurity threats. Additionally, we operate in a hybrid work environment. As our employees and our business partners’ employees work from home and access our systems remotely, we may be subject to heightened security and privacy risks, including the risks of cyber attacks and privacy incidents. Cybersecurity threats include, but are not limited to, social-engineering attacks (including through phishing attacks), business email compromise, online and offline fraud, malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks, access attacks (such as credential stuffing), personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, and telecommunications failures among other cybersecurity risks. Threat actors and their techniques change frequently, are often sophisticated in nature, and may not be detected until after a security incident has occurred. We may expend significant resources to try to protect against these threats to our systems. Certain data privacy and security laws, as well as industry best practice standards, may require us to implement and maintain security measures. While we have implemented security measures designed to protect our systems and confidential and sensitive data, there can be no assurance that these measures will be effective.
We and certain of our service providers have in the past and may in the future experience cybersecurity incidents, including incidents related to social engineering, business email compromise, and wire fraud. For example, in September and October 2024, certain employee business email accounts were compromised by an unauthorized third party, and as a result, payments intended for certain vendors were fraudulently re-directed into bank accounts presumably controlled by the unauthorized third