Despite the implementation of security measures in an effort to protect systems that store our information, given their size and complexity and the increasing amounts of information maintained on our internal information technology systems and external processing and storage (e.g., cloud) systems, and those of our third-party CROs, other contractors (including sites performing our current or future clinical trials), consultants and other third-party service providers, these systems are potentially vulnerable to breakdown or other damage or interruption. Our systems and the systems of third parties who support our operations are vulnerable to service interruptions, system malfunction, natural disasters, terrorism, war (such as the ongoing conflicts in the Middle East and between Ukraine and Russia), and telecommunication and electrical failures, as well as security breaches and incidents arising from or caused by inadvertent or intentional actions by our employees, contractors, consultants, business partners, or other third parties, or from cyberattacks by malicious third parties (including the deployment of harmful malware, ransomware, denial-of-service attacks, social engineering, and other means to affect service reliability and threaten the confidentiality, integrity, or availability of information), which may compromise our system infrastructure or lead to unauthorized access to or disruption of our or third-party systems and the unauthorized access to, misuse, disclosure, loss, destruction, alteration or dissemination of, or damage to, our data, including trade secrets or other confidential information, intellectual property, proprietary business information, and personal information. For example, companies have experienced an increase in phishing and social engineering attacks in recent years. Our employees generally work in a hybrid model in our offices and from home, and we may need to adjust our working model from time to time. As a result, we may have increased cyber security and data security risks, due to increased use of home wi-fi networks and virtual private networks. While we implement controls to reduce the risk of a resulting cyber security or data security incident or breach, we may experience data security incidents, and there is no guarantee that the measures we have implemented will be adequate to safeguard all systems and data, especially with some employees working from home or in a hybrid model where it is more difficult for us to monitor.
Any disruption, security incident, or security breach resulting in any loss, destruction, unavailability, alteration or dissemination of, or damage to, our data (including confidential information) or other data we or any of our CROs, other contractors, consultants, potential future collaborators, or other third-party service providers maintain or otherwise process, or our applications, or for it to be believed or reported that any of these occurred, could result in us incurring liability and reputational damage, and the development and commercialization of our product candidates could be delayed. For example, if a security incident were to cause interruptions in our operations, it could result in a material disruption of our programs and the development of our product candidates could be delayed. In addition, the loss or unavailability of clinical trial data for our product candidates could result in delays in our marketing approval efforts and result in us incurring significant costs to recover or reproduce the data. Furthermore, disruptions of our internal information technology systems or those of third parties used in our business, or security breaches or incidents affecting us or any of our CROs, other contractors, consultants, potential future collaborators, or other third-party service providers, could result in the loss, misappropriation, or unauthorized access to, use or disclosure of, or the inability to access, data (including trade secrets or other confidential information, intellectual property, proprietary business information, and personal information), which could result in financial, legal, business, and reputational harm to us. Unauthorized access, use, or disclosure of personal information, including personal information regarding our clinical trial subjects or employees, could harm our reputation directly, compel us to notify individuals or regulators under data breach notification laws, cause us to incur costs related to investigation of the incident (including legal expenses, forensic examination costs, and remediation costs), subject us to mandatory corrective action, and otherwise subject us to liability under laws and regulations that protect the privacy and security of personal information, which could result in significant legal and financial exposure and reputational damage that could have an adverse effect on our business. Our preclinical studies in China could increase our risk to such disruptions.
We expect to incur significant costs in our efforts to detect, prevent, and respond to security incidents. We also rely on third parties to manufacture our product candidates, and similar events relating to their systems could also have a material adverse effect on our business. There have been and may continue to be significant supply chain attacks and operational technology attacks globally, and we cannot guarantee that our systems or those of third-party service providers or other third parties that support us or our operations have not been breached or that they do not contain exploitable defects or bugs that could result in a security incident or breach of, or other disruption to, our systems or the systems of third parties that support us and our operations. To the extent that any disruption or security incident were to result in a loss, destruction or alteration of, or damage to, our data, or inappropriate disclosure of confidential or proprietary information, we could be exposed to litigation and governmental investigations, the further development and commercialization of our product candidates could be delayed, and we could be subject to significant fines or penalties for any noncompliance with certain state, federal or international laws relating to privacy, data protection, and information security. Litigation and governmental investigations could force us to spend money in defense or settlement, divert management's time and attention, increase our costs of doing business, and adversely affect our reputation. We could be required to fundamentally change our business activities and practices in response to such litigation or investigations, which could have an adverse effect on our business. Any actual or perceived inability to adequately protect data in our possession, custody, or control could have a material adverse effect upon our reputation, business, operations, or financial condition.
Our insurance policies may not be adequate to compensate us for the potential losses arising from any such disruption to, failure or security breach of, or incident impacting, our systems or third-party systems where information important to our business operations is stored. In addition, such insurance may not be available to us in the future on economically reasonable terms, or at all. Further, our insurance may not cover all claims made against us and could have high deductibles in any event, and defending a suit, regardless of its merit, could be costly and divert management attention.