We rely on proprietary and third-party information technology systems to process, transmit and store information and to manage or support our business processes. We store and maintain confidential financial and business information regarding us and persons with whom we do business on our information technology systems. We also collect and hold personally identifiable information of our residents and prospective residents in connection with our leasing and property management activities, and we collect and hold personally identifiable information of our employees in connection with their employment. In addition, we engage third-party service providers that may collect and hold personally identifiable information of our residents, prospective residents and employees in connection with providing business services to us, including web hosting, property management, leasing, accounting, payroll and benefit services. The protection of the information technology systems on which we rely is critically important to us. As described in more detail under the heading "Cybersecurity" in this Annual Report on Form 10-K, we take steps, and generally require third-party service providers to take steps, to protect the security of the information maintained in our and our service providers' information technology systems, including the use of systems, software, tools and monitoring to provide security for processing, transmitting and storing of the information. However, we face risks associated with breaches or security failures of the information technology systems on which we rely, which could result from, among other incidents, cyber-attacks or cyber-intrusions over the internet, malware, computer viruses or employee error or misconduct. This risk of a data breach or security failure, particularly through cyber-attacks or cyber-intrusion, has generally increased due to the rise in new technologies, such as ransomware and generative artificial intelligence, and the increased sophistication and activities of the perpetrators of attempted attacks and intrusions, including as a result of the intensification of state-sponsored cybersecurity attacks during periods of geopolitical conflict, such as the ongoing conflicts involving Ukraine and in the Middle East.
The security measures put in place by us and our service providers cannot provide absolute security and there can be no assurance that we or our service providers will not suffer a data security incident in the future, that unauthorized parties will not gain access to sensitive information stored on our or our service providers' systems, that such access will not, whether temporarily or permanently, impact, interfere with or interrupt our operations, or that any such incident will be discovered in a timely manner. Even the most well-protected information, networks, systems and facilities remain potentially vulnerable as the techniques used in such attempted security breaches evolve and generally are not recognized until launched against a target, and in some cases are designed to not be detected and, in fact, may not be detected. The rapid evolution and increased adoption of artificial intelligence technologies, by us and our third-party service providers, may also heighten our cybersecurity risks by making cyber attacks more difficult to detect, contain and mitigate. In addition, third-party information technology providers may not provide us with fixes or updates to hardware or software in a manner as to avoid an unauthorized loss or disclosure or to address a known vulnerability, which may subject us to known threats or downtime as a result of those delays. Accordingly, we and our service providers may be unable to anticipate these techniques or to implement adequate security barriers or other preventative measures. Further, we may be required to expend significant additional resources to continue to enhance information security measures and internal processes and procedures or to investigate and remediate any information security vulnerabilities.
A data security incident could compromise our or our service providers' information technology systems, and the information stored by us or our service providers, including personally identifiable information of residents, prospective residents and employees, could be accessed, misused, publicly disclosed, corrupted, lost or stolen. Any failure to prevent a data breach or a security failure of our or our service providers' information technology systems could interrupt our operations, result in downtime, divert our planned efforts and resources from other projects, damage our reputation and brand, damage our competitive position, make it difficult for us to attract and retain residents, subject us to liability claims or regulatory penalties and could materially and adversely affect our business, financial condition or results of operations. Similarly, if our service providers fail to use adequate security or data protection processes, or use personal data in an unpermitted or improper manner, we may be liable for certain losses and it may damage our reputation.