To achieve our business objectives, we rely on sophisticated information technology systems, including hardware, software, technology infrastructure, online sites and networks for both internal and external operations, mobile applications, cloud services and network-connected control systems, some of which are managed, hosted, provided or serviced by third parties. Internal or external events that compromise the confidentiality, integrity and availability of our systems and data may significantly interrupt the operation of our business, result in significant costs and/or adversely affect our reputation.
Our information technology systems are highly integrated into our business, including our R&D efforts, our clinical and commercial manufacturing processes and our product sales and distribution processes. Further, as the majority of our employees work remotely for some portion of their jobs in our hybrid work environment, our reliance on our and third-party information technology systems has increased substantially and is expected to continue to increase. Remote and hybrid working arrangements, including those of many third-party providers, can increase cybersecurity risks due to the challenges associated with managing remote computing assets and security vulnerabilities that are present in many non-corporate and home networks. The complexity and interconnected nature of software, hardware and our systems make them vulnerable to breakdown or other service interruptions, and to software errors or defects, misconfiguration and other security vulnerabilities. For example, in July 2024, businesses worldwide were affected by an information technology outage due to a faulty software update issued by a cybersecurity firm. Although our systems and operations were temporarily affected by the outage, the impact of this firm's faulty update on the Company was immaterial to our business operations. However, there can be no assurance that a future similar incident would not result in a material adverse effect on our business or results of operations. Upgrades or changes to our systems or the software that we use have resulted and we expect, in the future, will result in the introduction of new cybersecurity vulnerabilities and risks. In 2022, we identified a number of security vulnerabilities introduced into our information systems as a result of flaws that we subsequently identified in software that we had purchased and installed, and these flaws required that we apply emergency patches to certain of our systems. While we did not experience any significant adverse effects as a result of these vulnerabilities, there can be no assurance that we will timely identify and address future vulnerabilities. Our systems are also subject to frequent perimeter network reconnaissance and scanning, phishing and other cyberattacks. For example, as a result of our cybersecurity monitoring of the Horizon legacy information systems, we detected phishing activity in the accounts of two Horizon executives. These accounts were de-activated, the incidents were investigated and the determination was made separately by both our internal cybersecurity team and our external digital forensics and incident response supplier that no confidential information had been exfiltrated. As the cyber-threat landscape evolves, these attacks are growing in frequency, sophistication, and intensity, and are becoming increasingly difficult to detect and increasingly sophisticated in using techniques and tools-including artificial intelligence-that circumvent security controls, evade detection and remove forensic evidence. Such attacks could include the use of harmful and virulent malware, including ransomware or other denials of service, which can be deployed through various means, including the software supply chain, e-mail, malicious websites and/or the use of social engineering/phishing.
We have also experienced denial of service attacks against our network, and, although such attacks did not succeed, there can be no assurance that our efforts to guard against the wide and growing variety of potential attack techniques will be successful in the future. Attacks such as those experienced by government entities (including those that approve and/or regulate our products, such as the EMA) and other multi-national companies, including some of our peers, could leave us unable to utilize key business systems or access or protect important data, and could have a material adverse effect on our ability to operate our business, including developing, gaining regulatory approval for, manufacturing, selling and/or distributing our products. For example, in 2017, a pharmaceutical company experienced a cyberattack involving virulent malware that significantly disrupted its operations, including its research and sales operations and the production of some of its medicines and vaccines. As a result of the cyberattack, its orders and sales for certain products were negatively affected. In late 2020, SolarWinds Corporation, a leading provider of software for monitoring and managing information technology infrastructure, disclosed that it had suffered a cybersecurity incident whereby attackers had inserted malicious code into legitimate software updates for its products that were installed by myriad private and government customers, enabling the attackers to access a backdoor to such systems. In 2022, Okta, Inc., a provider of software that helps companies manage user authentication, disclosed that several hundred of its corporate customers were vulnerable to a security breach that allowed attackers to access Okta's internal network. Although this breach did not have a significant effect on our business, there can be no assurance that a similar future breach would not result in a material adverse effect on our business or results of operations.
Our systems also contain and use a high volume of sensitive data, including intellectual property, trade secrets and other proprietary business information, financial information, regulatory information, strategic plans, sales trends and forecasts, litigation materials and/or personal identifiable information belonging to us, our staff, our patients, customers and/or other parties. In some cases, we utilize third-party service providers to collect, process, store, manage or transmit such data, which have increased our risk. Intentional or inadvertent data privacy or security breaches (including cyberattacks) resulting from attacks or lapses by employees, service providers (including providers of information technology-specific services), business partners, nation states (including groups associated with or supported by foreign intelligence agencies), organized crime organizations, "hacktivists" or others, create risks that our sensitive data may be exposed to unauthorized persons, our competitors or the public. Malicious actors, including those working under state-sponsored campaigns, have sought employment, often in remote information technology roles, as a means to gain inside access at targeted companies. In the third quarter of 2024, an individual used fraudulent identification in connection with their hiring by the Company. While the individual was detected and terminated before any data was extracted or malware installed, there can be no assurance that future attempts by similar actors will be unsuccessful. System vulnerabilities and/or cybersecurity breaches experienced by our third-party service providers have constituted a substantial share of the information security risks that have affected us. For example, in the first half of 2021, a supplier experienced a data breach in which an unauthorized third party acquired access to certain information provided to the supplier in the course of its provision of services to us, including business documents and certain personally identifiable patient information (not including social security or other financial or health insurance information). As required, we promptly notified the applicable state attorneys general and the individuals whose personally identifiable information was affected of this data breach at the supplier. In the third quarter of 2022, another service provider experienced a similar cybersecurity breach in which an attacker exfiltrated certain data (including non-significant Amgen data) from the service provider's systems. Additionally, in April 2024, one of our former vendors notified us that its subsidiary that had provided us with certain patient support services until mid-2022, experienced a cybersecurity incident that it discovered in February 2024 and that data containing individually identifiable health information of over 1.7 million Amgen patients (that was retained as required by FDA regulations) was involved in the incident. Pursuant to the Health Breach Notification Rule requirements, we notified the FTC of this incident. Although these supplier data breaches have not resulted in material adverse effects on our business, there can be no assurance that a similar future cybersecurity incident would not result in a material adverse effect on our business or results of operations. Further, the timeliness of our awareness of a cybersecurity incident affects our ability to respond to and work to mitigate the severity of such events. For example, in 2020 and 2022, two of our vendors experienced cyberattacks and each initially reported to us that neither event involved our data. However, upon further investigation, they each subsequently informed us that the attackers had accessed limited, non-significant Amgen information. Although neither of these breaches had a significant adverse effect on our business, in the future we may again not receive timely reporting of cybersecurity events and such events could have a material adverse effect on our business.
Cyberattackers are also increasingly exploiting vulnerabilities in commercially available software from shared or open-source code. We rely on third party commercial software that have had and may have such vulnerabilities, but as use of open-source code is frequently not disclosed, our ability to fully assess this risk to our systems is limited. For example, in December 2021, a remote code execution vulnerability was discovered in a software library that is widely used in a variety of commercially available software and services. Although this vulnerability has not resulted in any significant adverse effects on us, there can be no assurances that a similar future vulnerability in the software and services that we use would not result in a material adverse effect on our business or results of operations.
Domestic and global government regulators, our business partners, suppliers with whom we do business, companies that provide us or our partners with business services and companies we have acquired or may acquire face similar risks. Security breaches of their systems or service outages have adversely affected systems and could, in the future, affect our systems and security, leave us without access to important systems, products, raw materials, components, services or information, or expose our confidential data or sensitive personal information. For example, in 2019, two vendors that perform testing and analytical services that we use in developing and manufacturing our products experienced cyberattacks, and in April and September of 2020, vendors that provide us with information technology services and clinical data services, respectively, each experienced ransomware attacks. Although there was no breach of our systems, each of these incidents required us to disconnect our systems from those vendors' systems. While we were able to reconnect our systems following restoration of these vendors' capabilities without significantly affecting product availability, a more extended service outage affecting these or other vendors, particularly where such vendor is the single source from which we obtain the services, could have a material adverse effect on our business or results of operations. In February 2024, Change Healthcare, a large U.S. insurance claim and co-pay card processing clearinghouse, experienced a ransomware attack that has caused significant disruptions to healthcare provider and pharmacy operations. While Change Healthcare does not directly provide us with services, disruptions to co-pay card support, insurance billing and Medicaid rebate processing led to lost sales and required us to take action to help patients access their medications and to provide extended payment terms to certain customers. Although services have been rerouted and restored, and the impact on our business has been immaterial, similar disruptions may occur in the future stemming from the interconnectedness of the U.S. healthcare ecosystem and industry reliance on centralized claims processing systems and networks, and such future disruptions may have a material adverse effect on our business or results of operations. In addition, we distribute our products in the United States primarily through three pharmaceutical wholesalers, and a security breach that impairs the distribution operations of our wholesalers could significantly impair our ability to deliver our products to healthcare providers and patients. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or effective in protecting our information technology systems and sensitive data.
Although we have experienced system breakdowns, attacks and information security breaches, we do not believe such breakdowns, attacks and breaches have had a material adverse effect on our business or results of operations. We will continue to experience varying degrees of cyberattacks and other incidents in the future. Even though we continue to invest in the monitoring, protection and resilience of our critical and/or sensitive data and systems, there can be no assurances that our efforts will detect, prevent or fully recover systems or data from all breakdowns, service interruptions, attacks and/or breaches of our systems that could adversely affect our business and operations and/or result in the loss or exposure of critical, proprietary, private, confidential or otherwise sensitive data, which could result in material financial, legal business or reputational harm to us or negatively affect our stock price. While we maintain cyber-liability insurance, our insurance is not sufficient to cover us against all losses that could potentially result from a service interruption, breach of our systems or loss of our critical or sensitive data.
We are also subject to various laws and regulations globally regarding cybersecurity, privacy and data protection, including laws and regulations relating to the collection, storage, handling, use, disclosure, transfer and security of personal data. The legislative and regulatory environment regarding privacy and data protection is continuously evolving and developing and the subject of significant attention globally. For example, we are subject to the EU's General Data Protection Regulation (GDPR), which became effective in May 2018, and the California Consumer Privacy Act (CCPA), which became effective in January 2020, both of which provide for substantial penalties for noncompliance. The CCPA was amended in late 2020, to create the California Privacy Rights Act to create opt in requirements for the use of sensitive personal data and the formation of a new dedicated agency for the enforcement of the law, the California Privacy Protection Agency. Similar consumer privacy laws went into effect in nine other states, have been enacted (but not yet in effect) in in 11 other states, and have been proposed in six additional states. Outside the United States, other jurisdictions where we operate have passed, or continue to propose, data privacy or cybersecurity legislation and/or regulations. For example, in China, the Personal Information Protection Law and the Data Security Law, which regulate data processing activities associated with personal and nonpersonal data, are in effect and build upon the existing Cybersecurity Law. Further, in March 2024, the European Parliament adopted the Artificial Intelligence Act that provides for EU-wide rules on data quality, transparency, human oversight and accountability with respect to the use of artificial intelligence. In April 2024, the EU also revised its Cybersecurity Directive NIS2 rules that create new cybersecurity risk management and reporting obligations. Failure to comply with these current and future laws could result in significant penalties and reputational harm and could have a material adverse effect on our business and results of operations.