Our services involve the storage and transmission of our and our customers' proprietary information and protected health, financial, payment, and other personal information of patients. We rely on proprietary and commercially available systems, software, tools, and monitoring, as well as other processes, to provide the security for processing, transmission, and storage of such information. Due to the sensitivity of this information, the effectiveness of such security efforts is very important. The breach of our systems or failure of our security measures, including as a result of third-party action, employee error, malfeasance, defective design, or otherwise, may lead to unauthorized access to customer or patient data or our proprietary data. Improper activities by third parties, advances in computer and software capabilities and encryption technology, new tools and discoveries, and other events or developments may facilitate or result in a compromise or breach of our information technology systems. Techniques used to obtain unauthorized access or to sabotage systems change frequently and generally are not recognized until launched against a target, and we may be unable to anticipate these techniques or to implement adequate preventive measures. Our security measures may not be effective in preventing these types of activities, and the information technology security measures of our third-party data centers and service providers may not be adequate.
In 2023, the healthcare industry suffered its highest occurrence of cyber incidents, with an average of 52 organizations each month impacted by one or more incidents, according to an October 2023 report by Atlas VPN, which utilized publicly available healthcare security incident data from the HHS. The Atlas VPN report reveals there were 480 healthcare data breaches through September 2023, with over 87 million Americans impacted, compared to 37 million in 2022.
To date, cyber attacks have not had a material impact on our business, operating results, or financial condition; however, we could suffer material losses in the future as a result of cyber attacks. We may not be able to predict the timing or severity of these attacks. Our exposure to cyber attacks remains heightened because of, among other things, the evolving nature of cyber threats, the ongoing shortage of qualified cybersecurity professionals, and connectivity and interdependence among our systems and those of third parties. In addition, ransomware attacks are a common threat impacting healthcare organizations. The occurrence of a cyber attack, breach, ransomware attack, unauthorized access, misuse, computer virus or other malicious code, or other cybersecurity event could jeopardize or result in the unauthorized disclosure, gathering, monitoring, misuse, corruption, loss, or destruction of confidential information that belongs to us or our customers or PHI that is processed and stored in, and transmitted through, our computer systems and networks. The occurrence of a cybersecurity event could also result in damage to our software, computers, or systems, or otherwise cause interruptions or malfunctions in our, our customers', or third parties' operations.
If a breach of our information technology security occurs, we could face damages for contract breach, penalties for violation of applicable laws or regulations, possible lawsuits by individuals affected by the breach, and significant remediation costs and efforts to prevent future occurrences. Although we currently carry insurance coverage to protect ourselves against some of these risks, our inability to continue to obtain such insurance coverage at a reasonable cost, or the lack of coverage for particular cybersecurity incidents under the terms of the applicable insurance policies, could also have a material adverse effect on us. In addition, if there is an actual or a perceived breach of our information technology security, the market perception of the effectiveness of our security measures could be harmed, and we could lose current or potential customers.
Additionally, cybersecurity has become a top priority for regulators around the world, and every state in the U.S. has laws in place requiring companies to notify users if there is a security breach that compromises certain categories of their personal identifiable information ("PII"). In addition, in the U.S., the SEC adopted rules in 2023 for mandatory disclosure of material cybersecurity incidents suffered by public companies, as well as cybersecurity governance and risk management. Any failure or perceived failure by us to comply with these laws and regulations may subject us to enforcement action or litigation, which could harm our business.