Significant disruptions of our or our vendors’ information technology systems or cybersecurity incidents could result in significant financial, legal, regulatory, business, and reputational harm to us.
We are increasingly dependent on information technology systems and infrastructure, including mobile technologies, to operate our business. In the ordinary course of our business, we collect, store, process, and transmit large amounts of confidential information, including intellectual property, proprietary business information, personal information (including health information), and other confidential information. It is critical that we do so in a secure manner to maintain the confidentiality, integrity, and restricted availability of such information. We have also outsourced elements of our operations, including elements of our information technology infrastructure and data processing, to third parties and, as a result, we manage a number of third-party vendors who have access to our computer networks or our information. In addition, many of those third parties in turn subcontract or outsource some of their responsibilities to other third parties. While all information technology operations are inherently vulnerable to inadvertent or intentional security breaches, incidents, attacks, and exposures, the accessibility and distributed nature of our information technology systems, and the information stored on those systems, make such systems (and the information stored therein) vulnerable to risks that threaten the confidentiality, integrity and availability of these systems and information, including unintentional or malicious, internal, and external attacks on our technology environment. Vulnerabilities can be exploited by diverse threat actors and attack vectors, including through inadvertent or intentional actions of our employees, third-party vendors, business partners, or by malicious third parties. Cybersecurity incidents are increasing in their frequency, levels of persistence, sophistication, and intensity, and are being conducted by sophisticated and organized groups and individuals with a wide range of motives (including industrial espionage) and expertise, including organized criminal groups, “hacktivists,” nation states, and others, and utilizing increasingly sophisticated techniques and tools – including AI – that circumvent security controls, evade detection and remove or obfuscate forensic evidence. In addition to access to, loss of or the extraction of information, such attacks could involve the deployment of harmful malware, ransomware, denial-of-service attacks, social engineering/phishing, malicious code embedded in software, and other means to affect service reliability and threaten the confidentiality, integrity, and availability of information technology systems or information. In addition, the prevalent use of mobile devices increases the risk of cybersecurity incidents.
Significant disruptions of our or our third-party vendors’ or business partners’ information technology systems or other similar cybersecurity incidents could adversely affect our business operations and result in the loss, misappropriation, and unauthorized access, use or disclosure of, or the prevention of access to, information, which could result in financial, legal, regulatory, business, and reputational harm to us. In addition, any impact to the confidentiality, integrity or availability of information technology systems and the information stored therein, whether from attacks on our or third-party technology environment or from computer viruses, natural disasters, terrorism, war, telecommunication and electrical failures, or other threats, could result in a material disruption of our development programs and our business operations. For example, the loss of clinical trial data from ongoing, completed or future clinical trials could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. We cannot ensure that our cybersecurity and data protection efforts and our investment in information technology, or the efforts or investments of CROs, consultants or other third parties with which we work, will prevent breakdowns or breaches in our or their systems or other cybersecurity incidents, including those that cause loss, destruction, unavailability, alteration, dissemination of, or damage, or unauthorized access to, or processing of, our data, including personal information, assets, and other data processed or maintained on our behalf, that could have a material adverse effect upon our reputation, business, financial condition, results of operations and growth prospects.