Cybersecurity risks for companies like ours have significantly increased in recent years, in part because of the proliferation of new technologies, the use of the internet and certain technologies to conduct business, and the increased sophistication and activities of organized crime, hackers, terrorists, and other external parties, including foreign state-sponsored actors.
Like many companies, from time to time we have been, and expect to continue to be, the target of attempted cyberattacks and other cybersecurity incidents. Such incidents may include malware, ransomware, denial-of-service attacks, social engineering, unauthorized access, human error, theft or misconduct, fraud, and phishing, as part of an effort to disrupt operations, potentially test cybersecurity capabilities, or obtain confidential, proprietary, or other information (including personal information). Our cybersecurity risk and exposure depend on various factors, including the evolving nature and increasing frequency, levels of persistence, sophistication, and intensity of these threats, the outsourcing of some of our business operations, and the current global economic and political environment. The increase in remote work environments also may increase our cybersecurity risk if our employees, vendors, service providers, and other third parties with which we interact are working remotely on less secure systems and environments.
Because we are dependent on third parties for certain elements of our business and operations, we could also be adversely affected if any of them are subject to a successful cyberattack or other cybersecurity incident. Third parties with which we do business may also be sources of cybersecurity or other technology risks. We routinely transmit and receive confidential, proprietary, and other information (including personal information) by electronic means. This information could be subject to interception, misuse, or mishandling. Our exposure to these risks could increase as a result of our migration of core systems and applications to a third-party cloud environment. While we generally perform cybersecurity diligence on our key vendors, because we do not control third parties with whom we do business and our ability to monitor their cybersecurity posture is limited, the cybersecurity measures they take may not be sufficient to protect any information we share with them.
Although we devote significant resources to protect our systems, network, and information, the security measures we have implemented may not provide effective security. Our internal computer systems, software, devices, and networks – and those of our CROs, CMOs, and other third-party providers – may be vulnerable to cyberattacks and other cybersecurity incidents, business or supply chain disruptions, or other attempts to harm our business or reputation or misuse or steal information (including personal information). We routinely identify cybersecurity threats as well as vulnerabilities in our system and work to address them, but these efforts may be insufficient. Outside parties may attempt to induce employees, third-party partners, vendors, service providers, or other users of our systems or networks to disclose confidential, proprietary, or other information (including personal information) in order to gain access to our systems and networks and the information they contain. Unauthorized access or disclosure, or breaches of our security, also may result from human error. We may not be able to anticipate, prevent, detect, recognize, or react to threats to our systems, networks, and assets, or implement effective preventative measures against cyberattacks or other security incidents, especially because the techniques used change frequently or are not recognized until launched.
A cyberattack or other cybersecurity incident could occur and persist for an extended period of time without detection. We expect that any investigation of such an incident would take time, during which we would not necessarily know the extent of the harm or how best to remediate it. Although we have not experienced any such incident resulting in a material impact to the company to date, our cybersecurity risk management program may not prevent such an incident from having a material impact in the future. We have obtained insurance coverage relating to cybersecurity risks, but this insurance may not be sufficient to provide adequate loss coverage (including if the insurer denies future claims) and may not continue to be available to us on economically reasonable terms, or at all. Further, any limitations of liability provisions in our agreements with vendors, customers, and other third parties with which we do business may not be enforceable or adequate or otherwise protect us from any liabilities or damages with respect to any particular claim in connection with a cyberattack or other security incident of a third party on which we rely.
The occurrence of one or more cyberattacks or other cybersecurity incidents could result in the unauthorized disclosure, misuse, or corruption of confidential, proprietary, and other information (including personal and other information about our employees and patients and company and vendor confidential data) or could otherwise cause interruptions or malfunctions in our operations or the operations of our partners, customers, vendors, and other third parties with which we do business. This could result in significant losses or reputational damage, adversely affect our relationships with our partners, customers, vendors, and other third parties, negatively affect our competitive position, or otherwise harm our business. We could also face regulatory and other legal action, including for any failure to provide timely disclosure concerning, or appropriately to limit trading in our securities following, an incident. We may be required to expend significant additional resources to repair or replace information systems or networks, modify our internal controls, and implement or enhance other protective measures or to investigate or remediate vulnerabilities or other exposures. We also may be subject to litigation and financial losses that are not fully insured.