Cybersecurity attacks include attempts to gain unauthorized access to our data and/or computer systems to disrupt operations, corrupt data, or steal confidential information. We may face such cybersecurity attacks through malware, computer viruses, attachments to e-mails, persons inside our organization or persons with access to systems inside our organization, and other significant disruptions of our information technology ("IT") systems. The risk of a cybersecurity attack, including by computer hackers (individual or hacking organizations), foreign governments, and cyber terrorists, has generally increased as the number, intensity, and sophistication of attempted attacks and intrusions from around the world have increased. The techniques and sophistication used to conduct cyber attacks and breaches of IT systems, as well as the sources and targets of these attacks, change frequently and are often not recognized until such attacks are launched or have been in place for a period of time.
Our IT networks and related systems are essential to the operation of our business and our ability to perform day-to-day operations and, in some cases, may be critical to the operations of certain of our Neighbors. In addition to our own IT systems, we also depend on third parties to provide IT services relating to several key business functions, such as administration, accounting, communications, document management and storage, human resources, payroll, tax, investor relations, and certain finance functions. Our IT systems and those provided by third parties may contain personal, financial, or other information that is entrusted to us by our Neighbors and associates, as well as proprietary PECO information and other confidential information related to our business. We and such third parties employ a number of measures to prevent, detect, and mitigate these threats, including password protection, firewalls, backup servers, malware detection, intrusion sensors, threat monitoring, user training, and periodic penetration testing; however, there is no guarantee that such cybersecurity risk management programs and processes, including our and their policies, controls, and procedures, will be fully implemented, complied with or effective in protecting our and their systems and information.
As have many companies, we and our third party vendors have been impacted by security incidents in the past, and will likely continue to experience security incidents of varying degrees. While we do not believe these incidents have had a material impact to date, as our reliance on technology has increased, so have the risks posed to our systems, both internal and those we have outsourced. The primary risks that could directly result from the occurrence of a cyber incident include operational interruption, damage to our relationship with our Neighbors, and private data exposure. Our financial results and business operations may be negatively affected by such an incident or the resulting negative media attention. A cybersecurity attack could: (i) disrupt the proper functioning of our networks and systems and therefore our operations and/or those of certain of our Neighbors; (ii) compromise the confidential or proprietary information of our Neighbors, associates, and vendors, which others could use to compete against us or for disruptive, destructive, or otherwise harmful purposes and outcomes; (iii) result in our inability to maintain the building systems relied upon by our Neighbors for the efficient use of their leased space; (iv) require significant management attention and resources to remedy the damages that result; (v) result in misstated financial reports, violations of loan covenants, and/or missed reporting deadlines; (vi) result in our inability to properly monitor our compliance with the rules and regulations regarding our qualification as a REIT; (vii) subject us to claims for breach of contract, damages, credits, penalties, or termination of leases or other agreements or relationships; (viii) cause reputational damage that adversely affects Neighbor, investor, and associate confidence in us, which could negatively affect our ability to attract and retain Neighbors, investors, and associates; (ix) result in significant remediation costs, some or all of which may not be recoverable from our insurance carriers; and (x) result in increases in the cost of obtaining insurance on favorable terms, or at all, if the attack results in significant insured losses. Such security breaches also could result in a violation of applicable federal and state privacy and other laws, and subject us to private consumer, business partner, or securities litigation and governmental investigations and proceedings, any of which could result in our exposure to material civil or criminal liability, and we may not be able to recover these expenses from our service providers, responsible parties, or insurance carriers. Similarly, our Neighbors rely extensively on IT systems to process transactions and manage their businesses and thus are also at risk from and may be adversely affected by cybersecurity attacks. An interruption in the business operations of our Neighbors or a deterioration in their reputation resulting from a cybersecurity attack, including unauthorized access to customers' credit card data and other confidential information, could indirectly negatively affect our business and cause lost revenues.