Sangamo Biosciences (SGMO) Risk Factors

We are increasingly dependent on information technology systems and infrastructure to operate our business, which are large and complex. In the ordinary course of our business, we and the third parties upon which we rely, may collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, share and transmit large amounts of proprietary, confidential and sensitive information, including intellectual property, trade secrets and personal data (such as health-related information). It is critical that we do so in a secure manner to maintain the confidentiality, integrity and availability of such sensitive information. We have also outsourced elements of our operations (including elements of our information technology infrastructure) to third parties, and as a result, we manage a number of third-party vendors who may have access to our computer networks or our confidential information. Many of those third parties in turn subcontract or outsource some of their responsibilities to other third parties. Our ability to monitor third parties' information security practices is limited, and these third parties may not have adequate information security measures in place. While all information technology operations are inherently vulnerable to inadvertent or intentional security breaches, incidents, attacks and exposures, the size, complexity, accessibility and distributed nature of our information technology systems, and the large amounts of sensitive information stored on those systems, make such systems potentially vulnerable to unintentional or malicious, internal and external attacks on our technology environment. Attacks of this nature are increasing in their frequency, levels of persistence, sophistication and intensity. Threats to information systems and data are increasingly difficult to detect and come from a variety of sources, including traditional computer "hackers," threat actors, "hacktivists," organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation-states and nation-state-supported actors. Some actors now engage and are expected to continue to engage in cyber-attacks, including nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we and the third parties on which we rely may be vulnerable to a heightened risk of these attacks, including retaliatory cyber-attacks, that could materially disrupt our systems, operations and supply chain. We and the third parties upon which we rely may be subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks (such as credential stuffing), credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, telecommunications failures, natural disasters (such as earthquakes, fires, floods), war, terrorism, attacks enhanced or facilitated by artificial intelligence, or AI, and other similar threats. Ransomware attacks are becoming increasingly prevalent and severe and can lead to significant interruptions in our operations, loss of data and income, reputational harm and diversions of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. In addition, our updated work from home policies have intensified our dependence on information technology systems and could increase our cybersecurity risk as many of our critical business activities are currently being conducted remotely utilizing network connections, computers and devices outside our premises or network and our increased reliance on personnel working from home, while in transit and in public locations. While we have implemented security measures designed to protect against data security incidents, there can be no assurance that these measures will be effective. We have not always been able in the past and may be unable in the future to detect vulnerabilities in our information technology systems. We take steps designed to detect, mitigate and remediate vulnerabilities in our information security systems (such as our hardware and/or software, including that of third parties upon which we rely), but we may not be able to detect, mitigate and remediate all such vulnerabilities on a timely basis. For example, in April 2018, we announced a data security incident involving the compromise of a senior executive's company email account. Our investigation of the incident did not reveal any evidence that our systems were otherwise compromised in connection with the incident or that personal data about patients or other individuals besides the executive were accessed or disclosed. However, proprietary, confidential and other sensitive information of ours and that of other entities was accessed and may have been compromised as a result of the incident. Unforeseen developments related to this incident could occur, which could have a further adverse impact on us. Any litigation or regulatory review or investigation arising from this incident could result in significant legal exposure to us. A security incident or other interruption could also result in a material disruption of our development programs and our business operations. For example, the loss of clinical trial data from completed or future clinical trials could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. While we are aware of the company email incident described above, there is no way of knowing with certainty whether we have experienced any other data security incidents that have not been discovered. While we have no reason to believe this to be the case, attackers have become very sophisticated in the way they conceal access to systems, and many companies that have been attacked are not aware that they have been attacked. Any delay in the discovery of an attack may result in increased expense and may harm our reputation. Any security incident or interruption that we, or a third-party upon which we rely, experience (including the company email incident described above) could lead to adverse consequences, including government enforcement actions (for example, investigations, fines, penalties, audits and inspections), additional reporting requirements and/or oversight, restrictions on processing sensitive data (including personal data), litigation (including class claims), indemnification obligations, harm to our reputation, monetary fund diversions, diversion of management attention, interruptions in our operations (including availability of data) and financial loss. Applicable data privacy and security obligations may require us to notify relevant stakeholders, including affected individuals, customers, regulators and investors, of security incidents. Such disclosures are costly, and the disclosures or the failure to comply with such requirements could lead to adverse consequences. In addition, failure to maintain effective internal accounting controls related to security breaches and cybersecurity in general could impact our ability to produce timely and accurate financial statements and subject us to regulatory scrutiny. We may expend significant resources or modify our business activities in an effort to protect against security incidents or other interruptions. Further, we may experience delays in developing and deploying remedial measures designed to address any such identified vulnerabilities. Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages or claims related to our data privacy and security obligations. While we may be entitled to damages if our third-party partners fail to satisfy their privacy or data security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. Additionally, we cannot be sure that our insurance coverage, if any, will be adequate or sufficient to protect us from or mitigate liabilities arising out of our privacy and security practices, that such coverage will continue to be available on commercially reasonable terms, or at all, or that such coverage will pay future claims. In addition to experiencing a security incident, third parties may gather, collect or infer sensitive information about us from public sources, data brokers or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position. Additionally, our sensitive information could be leaked,disclosed or revealed as a result of or in connection with our employees', personnel's or vendors' use of generative AI technologies.