We have experienced significant growth in the complexity of our data and the software tools that our hardware infrastructure supports. We rely significantly upon information technology systems and infrastructure owned and maintained by us or by third party providers to generate, collect, store, and transmit confidential and proprietary information and data (including but not limited to intellectual property, proprietary business information, and personal information) and to operate our business. We also outsource elements of our operations to, and obtain products and services from, third parties and engage in collaborations for drug discovery with third parties, each of which has or could have access to our confidential or proprietary information.
We deploy and operate an array of technical and procedural controls to reduce the risks to our information technology systems, infrastructure and data and to work to maintain the availability, confidentiality and integrity of our data, and we expect to continue to incur significant costs on such detection and prevention efforts. Despite these measures, our information technology and other internal infrastructure systems face the risk of failures, interruptions, security breaches and incidents, or other harm from various causes or sources, and third parties with whom we share confidential or proprietary information face similar risks and may experience similar events that materially impact us. These causes or sources include but are not limited to the following:
- service interruptions;- system malfunctions;- computer viruses and other malicious code;- natural disasters;- global political instability;- warfare;- telecommunication and electrical failures;- inadvertent or intentional actions by our employees or third-party providers; and - cyber-attacks by malicious third parties, including the deployment of ransomware and malware, denial-of-service attacks, social engineering, and other means to affect service reliability and threaten the confidentiality, integrity, and availability of information.
With respect to cyber-attacks, the techniques used by cyber criminals change frequently, may not be recognized until launched, and can originate from a wide variety of sources, including outside groups and individuals with a range of motives (including industrial espionage) and expertise, such as organized crime affiliates, terrorist organizations, or hostile foreign governments or agencies. These risks may be heightened in connection with geopolitical events such as the conflict between Russia and Ukraine. The costs to us to investigate and mitigate actual and suspected cybersecurity breaches and incidents could be significant. We may not be able to anticipate all types of security threats and implement preventive measures effective against all such threats. In addition, an increased amount of work is occurring remotely, including through the use of mobile devices. This could increase our cybersecurity risk, create data accessibility concerns, and make us more susceptible to communication disruptions.
We have experienced, and may continue to experience, cyber-attacks, security breaches and incidents, and other system failures, although to our knowledge we have not experienced any material interruption or incident as of December 31, 2023. The loss, corruption, unavailability of, or damage to our data would interfere with and undermine the insights we draw from our platform and could impair the integrity of our clinical trial data, leading to regulatory delays or the inability to get our drug candidates approved. If we do not accurately predict and identify our infrastructure requirements and failures and timely enhance our infrastructure, or if our remediation efforts are not successful, it could result in a material disruption of our business operations and development programs, including the loss or unauthorized disclosure of our trade secrets, individuals' personal information, or other proprietary or sensitive data. A security breach or incident that leads to unauthorized acquisition, disclosure, or other processing of our intellectual property or other proprietary information could also affect our intellectual property rights and enable competitors to compete with us more effectively. Likewise, as we rely on third parties for the manufacture of our drug candidates and to conduct clinical trials, similar events relating to their systems and operations could also have a material adverse effect on our business and lead to regulatory agency actions.
Moreover, any security breach or other event that leads to loss of, unauthorized access to, disclosure of, or other processing of personal information, including personal information regarding clinical trial subjects, contractors, directors, or employees, or the perception any of these has occurred, could harm our reputation, compel us to comply with federal and/or state notification laws and foreign law equivalents, subject us to mandatory corrective action, and otherwise subject us to liability under laws and regulations that protect the privacy and security of personal information. For more information see "Risk Factors- We are subject to U.S. and foreign laws regarding privacy, data protection, and data security that could entail substantial compliance costs, while the failure to comply could subject us to significant liability" set forth below.
Failures, disruptions, security breaches and incidents, cyber-attacks, and other harmful events impacting data processed or maintained in our business, or information technology systems or infrastructure used in our business, including those resulting in a loss of or damage to our information technology systems or infrastructure, or the loss of or inappropriate acquisition, disclosure, or other processing of confidential, proprietary, or personal information, or the perception any of these has occurred, could expose us to a risk of loss, enforcement measures, regulatory agency investigations, proceedings, and other actions, penalties, fines, indemnification claims, litigation, potential civil or criminal liability, collaborators' loss of confidence, damage to our reputation, and other consequences, which could materially adversely affect our business and results of operations. While we maintain insurance coverage for certain expenses and liabilities related to failures or breaches of our information technology systems, it may not be adequate to cover all losses associated with such events. In addition, such insurance may not be available to us in the future on satisfactory terms or at all. Furthermore, if the information technology systems of third parties with whom we do business become subject to disruptions or security breaches or incidents, we may have insufficient recourse against them.