Our internal computer systems and infrastructure and those of our strategic collaborators, vendors, contractors, consultants or regulatory authorities with whom we share confidential, protected or sensitive data or information, or upon which our business relies, are vulnerable to damage from computer viruses, unauthorized access, misuse, natural disasters, terrorism, cybersecurity threats, war and telecommunication and electrical failures, as well as security compromises or breaches, which may compromise our systems, infrastructure, data or that of those with whom we share such data or information or upon which our business relies, or lead to data compromise, misuse, misappropriation or leakage. We have experienced, and may experience additional, cyber-attacks on our information technology systems and infrastructure by threat actors of all types (including nation states, criminal enterprises, individual actors or advanced persistent threat groups). In addition, we may experience intrusions on our physical premises by these threat actors. In addition to extracting sensitive information, such attacks could include the deployment of harmful malware, ransomware, digital extortion, business email compromise and denial-of-service attacks, social engineering and other means to affect server reliability and threaten the confidentiality, integrity and availability of information, systems or infrastructure. If any such cyber-attack or physical intrusion against us or those with whom we share confidential, protected or sensitive data or information, or upon which our business relies, were to result in a loss of or damage to our data, systems or infrastructure, or interrupt our operations, such as a material disruption of our development programs or our manufacturing operations, or due to a loss of any of our proprietary or confidential information, it would have a material adverse effect on us. For example, the loss of clinical trial data could delay our regulatory approval efforts and increase our costs to recover or reproduce the data. In addition, because we run multiple clinical trials in parallel, any breach or compromise of our computer systems or infrastructure or physical premises may result in a loss of data or compromised data integrity across multiple programs in many stages of development. While we seek to take steps to address cybersecurity risks, our efforts may not wholly mitigate such risks. Further, our cybersecurity liability insurance may not cover all damages we would sustain based on any breach or compromise of our computer security protocols or cybersecurity attack.
Any data breach, security incident or compromise of confidential, protected or personal information, including any clinical trial participant personal data, may also subject us to civil fines and penalties, litigation, regulatory investigations or enforcement actions, or claims for damages under the GDPR and UK GDPR and relevant member state law in the EU, other foreign laws, and the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA), and other relevant state and federal privacy laws in the United States including the California Consumer Privacy Act, as amended by the California Privacy Rights Act (the CCPA). We have from time to time received information that companies working on vaccine research and development may be a particular focus for those planning cyberattacks, including by nation states and affiliated cyber actors. To the extent that any disruption or security compromise incident or breach were to result in a loss of, or damage to, our data, systems, infrastructure or applications, or inappropriate use or disclosure of confidential or proprietary information, including information related to the research and manufacturing of our products, we could incur liability, our competitive and reputational position could be harmed and the further development and commercialization of our product candidates could be delayed.