There are growing risks related to the security, confidentiality and integrity of personal and corporate information stored and transmitted electronically due to increasingly diverse and sophisticated threats to networks, systems and data security. Potential attacks span a spectrum from attacks by criminal hackers, hacktivists, and nation state or state-sponsored actors, to employee malfeasance and human or technological error. Cyberattacks against companies have increased in frequency and potential harm over time, and the methods used to gain unauthorized access constantly evolve, making it increasingly difficult to anticipate, prevent, and/or detect incidents successfully in every instance.
Despite the implementation of security measures, our internal computer systems, and those of third parties on which we rely (including our vendors, contractors and other third-party partners who process information on our behalf or have access to our systems), are vulnerable to damage from computer viruses, malware, ransomware, phishing attacks and other forms of social engineering, denial-of-service attacks, third party or employee theft or misuse and other negligent actions, natural disasters, terrorism, war, telecommunication and electrical failures, cyberattacks or cyber-intrusions over the internet, security incidents, disruptions, attachments to emails, persons inside our organization, or persons with access to systems inside our organization. The risk of a security breach or disruption, particularly through cyberattacks or cyber intrusion, including by computer hackers, foreign governments, and cyber terrorists, has generally increased as the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased. If such an event were to occur and cause interruptions in our operations, it could result in a material disruption of our product development programs. To the extent that any disruption or security breach was to result in a loss of or damage to our data or applications, or inappropriate disclosure of confidential or proprietary information, we could incur material legal claims (including class claims) and liability, substantial remediation costs, regulatory enforcement, liability under data protection laws, additional reporting requirements and damage to our reputation, and the further development of our product candidates could be delayed.