We face risks associated with security breaches, whether through cyber attacks or cyber intrusions over the Internet, malware (including ransomware), computer viruses, social engineering and phishing e-mails, exploitation of vulnerabilities in software used in our business, malfeasance by insiders or persons with access to systems inside our organization, human or technological error, and other significant disruptions of our IT networks and related systems. The risk of a security breach or disruption, particularly through cyber attack or cyber intrusion, including by computer hackers, foreign governments and cyber terrorists, is expected to increase as the number, intensity and sophistication of attacks and intrusions from around the world is escalating. Our IT networks and related systems are essential to the operation of our business and our ability to perform day-to-day operations (including managing our building systems) and, in some cases, may be critical to the operations of certain of our tenants. We own and manage some of these systems but must rely on third parties for a range of systems, networks and other products and services, including but not limited to software and cloud computing services, that are critical to our business. In addition, we and others collect, maintain and process data about employees, business partners and others, including personally identifiable information, as well as proprietary data belonging to our business such as trade secrets.
There can be no assurance that our security measures, or those of third parties on whom we rely, will effectively protect the confidentiality, integrity and availability of our networks, systems and data from security breaches or disruptions. While to date we have experienced no cyberattacks or incidents that have had a material impact on our operations or financial results, we cannot guarantee that material incidents will not occur in the future.
Our information, networks, systems and facilities remain vulnerable because the techniques used by attackers are constantly evolving (including their use of tools like artificial intelligence) and generally are not recognized until launched against a target, and in some cases are designed not be detected and, in fact, may not be detected. Accordingly, we may be unable to anticipate these techniques or to implement adequate security barriers or other preventative measures, and thus it is impossible for us to entirely mitigate this risk. A security breach or other significant disruption involving our IT networks and related systems could have an adverse effect on our business, for example:
- Disruption to our networks and systems and thus our operations and/or those of our tenants or vendors;- Misstated financial reports, violations of loan covenants, missed reporting deadlines and missed permitting deadlines;- Inability to comply with laws and regulations;- Unauthorized access to, destruction, loss, theft, misappropriation or release of proprietary, confidential, sensitive or otherwise valuable information of ours or others, which others could be used to compete against us or for disruptive, destructive or otherwise harmful purposes;- Rendering us unable to maintain the building systems relied upon by our tenants;- The requirement of significant management attention and resources to restore our business and remedy any damages that result;- Claims for breach of contract, damages, credits, penalties or termination of leases or other agreements;- Regulatory inquiries, investigations and fines or penalties; and - Damage to our reputation among our tenants, investors, or others.
We cannot guarantee that any costs and liabilities incurred in relation to an attack or incident will be covered by our existing insurance policies or that applicable insurance will be available to us in the future on economically reasonable terms or at all.