In the ordinary course of our business, we may process proprietary, confidential and sensitive information, personal data (including health information), intellectual property, trade secrets, and other sensitive business information owned or controlled by ourselves or other parties (collectively, sensitive information).
Despite the implementation of security measures, we and the third parties upon whom we rely (including the Internet and related systems) face a variety of evolving threats related to sensitive information, including without limitation ransomware attacks, which could cause security incidents. Cyberattacks, malicious internet-based activity, online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of our sensitive information technology systems, and those of the third parties upon which we rely. Such threats are prevalent and continue to rise, are increasingly difficult to detect, and come from a variety of sources, including traditional computer "hackers," threat actors, "hacktivists," organized criminal threat actors, personnel misconduct or error, employee theft or misuse, sophisticated nation-state and nation-state supported actors. Some actors now engage and are expected to continue to engage in cyberattacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we and the third parties upon which we rely may be vulnerable to a heightened risk of these attacks, including cyberattacks, that could materially disrupt our systems and operations, supply chain, and ability to produce, sell and distribute our products.
We and the third parties upon whom we rely are subject to a variety of evolving threats, including but not limited to social engineering attacks (including through phishing attacks), software bugs, malicious code (such as viruses and worms), denial-of-service attacks (such as credential stuffing), ransomware attacks, supply chain attacks, malware installation (including as a result of advanced persistent threat intrusions), server malfunction, software or hardware failures, loss of data or other computer assets, adware, physical break-ins, fires, telecommunications or network failures, malicious human acts, natural disasters, or other similar issues. Ransomware attacks, including those from organized criminal threat actors, nation-states, and nation-state supported actors, are becoming increasingly prevalent and severe and can lead to significant interruptions, delays, or outages in our operations, disruption of clinical trials, loss of sensitive information (including data related to clinical trials), loss of income, significant extra expenses to restore data or systems, reputational loss and the diversion of funds. To alleviate the financial, operational and reputational impact of a ransomware attack, it may be preferable to make extortion payments, but we may be unwilling or unable to do so (including, for example, if applicable laws or regulations prohibit such payments).
In addition, we rely upon third-party service providers and technologies to operate critical business systems to process sensitive information in a variety of contexts, including without limitation, assay processing, sample tracking, quality control, customer service and support, billing and reimbursement, research and development activities and our general and administrative activities. Our ability to monitor these third parties' information security practices is limited, and these third parties may not have adequate information security measures in place. We may share or receive sensitive information with or from third parties. If our third-party service providers experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if our third-party service providers fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. Similarly, supply chain attacks have increased in frequency and severity, and we cannot guarantee that third parties and infrastructure in our supply chain have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach of or disruption to our platform, systems and networks or the systems and networks of third parties that support us and our services. Despite the security controls we have in place, such attacks are very difficult to avoid.
Any of the aforementioned threats and other similar attacks, disruptions or accidents could cause a security incident, which, in turn, could result in unauthorized access to, damage to, disablement or encryption of, use or misuse of, disclosure of, modification of, destruction of, or loss of our sensitive information, or disrupt our ability to provide our platform or our service providers' ability to support our services or develop or deliver our products. We may expend significant resources, fundamentally change our business activities and practices, or modify our operations in an effort to protect against security incidents and to mitigate, detect and address actual and potential vulnerabilities. Certain data privacy and security obligations may require us to implement and maintain specific, industry-standard or reasonable security measures to protect our information technology systems and sensitive information. Despite the precautionary measures we have taken to try to prevent a security incident, there can be no assurance that these measures will be effective. We may be unable in the future to detect vulnerabilities in our information technology systems because such threats and techniques change frequently, are often sophisticated in nature, and may not be detected until after a security incident has occurred. Despite our efforts to identify and address vulnerabilities, if any, in our information technology systems, our efforts may not be successful. These vulnerabilities pose risk to our business. Further, we may experience delays in developing and deploying remedial measures designed to address any such identified vulnerabilities.
Applicable data privacy and security obligations may require us to notify relevant stakeholders of security incidents. Such disclosures are costly, and the disclosure of any security incident or the failure to comply with such requirements could lead to adverse consequences. Any disruption or loss of information technology or telecommunications systems on which critical aspects of our operations depend could have an adverse effect on our business, such as preventing us from processing assays; providing assay results to medical oncologists, neuro-oncologists, surgical oncologists, urologists, pulmonologists, pathologists, and other physicians; billing payors; processing reimbursement appeals; handling patient or physician inquiries; conducting research and development activities and managing the administrative aspects of our business.
Furthermore, if we or any third party upon whom we rely experience a security incident, or are perceived to have experienced a security incident, it could result in: government enforcement actions that could include investigations, fines, penalties, audits and inspections; additional reporting requirements and/or oversight; restrictions on processing personal data or sensitive information (which could impact our ability to conduct tests or develop our products); litigation (including class claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; interruptions in our operations (including availability of data); financial loss; and other similar harms. Security incidents and attendant consequences may cause customers to stop using our services, deter new customers from using our services, and negatively impact our ability to grow and operate our business.
Furthermore, there can be no assurance that our contracts contain limitations of liability, and even where they do, such limitations may not be enforceable, adequate or otherwise protect us from liabilities or damages if we fail to comply with obligations related to security incidents. We cannot be sure that our insurance coverage will be adequate or sufficient to protect us from or mitigate liabilities arising out of our privacy and security practices, that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims.
In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position.