Despite the implementation of security measures, our internal information technology systems and those of our collaborators, contractors and consultants are vulnerable to damage from internal or external events, such as computer viruses, unauthorized access, natural disasters, terrorism, war, and telecommunication and electrical failures, which compromise the confidentiality, integrity and availability of the systems. Although to our knowledge we have not experienced any material system failure or security breach to date, if such an event were to occur and cause interruptions in our operations, it could result in a material disruption of our development programs and our business operations. For example, the loss of clinical trial data from completed or future clinical trials could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. Likewise, we partially rely on our third-party research institution collaborators for research and development of our product candidates and other third parties for the manufacture of our product candidates and to conduct clinical trials, and similar events relating to their computer systems could also have a material adverse effect on our business.
In the ordinary course of our business, we collect and store sensitive data, including, among other things, personally identifiable information about our employees, intellectual property, and proprietary business information. Additionally, our CROs will collect and store sensitive data, such as legally protected patient health information, when conducting our clinical trials. We manage and maintain our applications and data utilizing on-site systems and outsourced vendors. These applications and data encompass a wide variety of business-critical information including research and development information, commercial information and business and financial information. Because information systems, networks and other technologies are critical to many of our operating activities, shutdowns or service disruptions at our Company or vendors that provide information systems, networks, or other services to us pose increasing risks. Such disruptions may be caused by events such as computer hacking, phishing attacks, ransomware, dissemination of computer viruses, worms and other destructive or disruptive software, denial of service attacks and other malicious activity, as well as power outages, natural disasters (including extreme weather), terrorist attacks or other similar events. Such events could cause loss of data, damage to system and data and leave us unable to utilize key business systems or access important data needed to operate our business, including conducting research and development, gaining regulatory approval for our product candidates or manufacturing and selling our products. Our collaborators, contractors or consultants may face similar risks, and service disruptions or security breaches of their systems could adversely affect our security, leave us without access to important systems, products, raw materials, components, services or information or expose our confidential data. In addition, system redundancy may be ineffective or inadequate, and our disaster recovery planning may not be sufficient to cover all eventualities. Significant events could result in a disruption of our operations, damage to our reputation or a loss of revenues. In addition, we may not have adequate insurance coverage to compensate for any losses associated with such events.
We could be subject to risks caused by misappropriation, misuse, leakage, falsification or intentional or accidental release or loss of information maintained in the information systems and networks of our Company and our vendors, including personal information of our employees and patients, and company and vendor confidential data. In addition, outside parties may attempt to penetrate our systems or those of our vendors or fraudulently induce our personnel or the personnel of our vendors to disclose sensitive information in order to gain access to our data and/or systems. Like other companies, we may experience, threats to our data and systems, including malicious codes and viruses, phishing, business email compromise attacks, or other cyber-attacks. The number and complexity of these threats may increase over time. If a material breach of our information technology systems or those of our vendors occurs, the market perception of the effectiveness of our security measures could be harmed and our reputation and credibility could be damaged. We could be required to expend significant amounts of money and other resources to respond to these threats or breaches and to repair or replace information systems or networks and could suffer financial loss or the loss of valuable confidential information. In addition, we could be subject to regulatory actions and/or claims made by individuals and groups in private litigation involving privacy issues related to data collection and use practices and other data privacy laws and regulations, including claims for misuse or inappropriate disclosure of data, as well as unfair or deceptive practices. We are taking measures and plan to continue to take measures to develop and maintain systems and controls designed to prevent, identify and mitigate these events from occurring. The development and maintenance of these systems, controls and processes is costly and requires ongoing monitoring and updating as technologies change and efforts to overcome security measures become increasingly sophisticated. Moreover, despite our efforts, the possibility of these events occurring cannot be eliminated entirely. As we outsource more of our information systems to vendors, engage in more electronic transactions with payors and patients, and rely more on cloud-based information systems, the related security risks will increase and we will need to expend additional resources to protect our technology and information systems. In addition, there can be no assurance that our internal information technology systems or those of our collaborators, contractors, or our consultants' efforts to implement adequate security and control measures, will be sufficient to protect us against breakdowns, service disruption, data deterioration or loss in the event of a system malfunction, or prevent data from being stolen or corrupted in the event of a cyberattack, security breach, industrial espionage attacks or insider threat attacks that could adversely affect our business and operations and/or result in the loss or exposure of critical, proprietary, private, confidential or otherwise sensitive data, which could result in financial, legal, business or reputational harm to us.