third party vendors and other contractors and consultants, and the increasing amounts of proprietary, confidential and sensitive information that they maintain, such information technology systems have been subject to and remain vulnerable to breakdown, service interruptions, system malfunction, natural disasters, terrorism, war and telecommunication and electrical failures, as well as security breaches from inadvertent or intentional actions by our personnel, third party vendors, contractors, consultants, business partners, and/or other third parties, or from cyber-attacks by malicious third parties (including the deployment of harmful malware, ransomware, denial-of-service attacks, social engineering, and other means to affect service reliability and threaten the confidentiality, integrity, and availability of information), which may compromise our system infrastructure, or that of our third party vendors and other contractors and consultants, or lead to data leakage. The risk of a security breach or disruption, particularly through accidental actions or omissions by trusted insiders, cyber-attacks or cyber intrusions, including by computer hackers, viruses, foreign governments, and cyber terrorists, has generally increased as the number, intensity, and sophistication of attempted attacks and intrusions from around the world have increased. Although we take measures to protect sensitive data from unauthorized access, use or disclosure, we and our third party service providers frequently defend against and respond to cyber-attacks, and our information technology and infrastructure may be vulnerable to attacks by hackers or viruses or breached due to personnel error, malfeasance, or other malicious or inadvertent disruptions. Any such breach or interruption could compromise our networks and the information stored there could be accessed by unauthorized parties, manipulated, publicly disclosed, lost, or stolen.
Failures or significant downtime of our information technology or telecommunication systems or those used by our third party service providers could cause significant interruptions to our operations, including preventing us from conducting tests or research and development activities and preventing us from managing the administrative aspects of our business. For example, the loss of clinical study data from completed, ongoing or planned clinical studies could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. In addition, sophisticated operating system software and applications that we procure from third parties may contain defects in design or manufacture, including vulnerabilities, “bugs” and other problems that could unexpectedly interfere with the operation of our networks, system, or our processing of personal information or other data. To the extent that any disruption or security breach results in a loss of or damage to our data or applications, or inappropriate disclosure of confidential or proprietary information, we could incur liability, the further development of our product candidates could be delayed, and our business could be otherwise adversely affected.
We may not be able to anticipate all types of security threats, and we may not be able to implement preventative measures effective against all such security threats. We also may not be effective in responding to, containing or mitigating the risks of an attack. The techniques used by cyber criminals change frequently, may not be recognized until launched, and can originate from a wide variety of sources, including outside groups such as external service providers, organized crime affiliates, terrorist organizations, hostile foreign governments or agencies, or cybersecurity researchers. To the extent that any disruption or security breach were to result in a loss of, or damage to, our data or applications, or those of our third party vendors and other contractors and consultants, or inappropriate disclosure of confidential or proprietary information, we could incur liability and reputational damage and the further development and commercialization of our products and services could be delayed.
The costs related to significant security breaches or disruptions could be material and could exceed the limits of the cybersecurity insurance we maintain, if any, against such risks. If the information technology systems of our third party vendors and other contractors and consultants become subject to disruptions or security breaches, we may have insufficient recourse against such third parties and may have to expend significant resources to mitigate the impact of such an event, and to develop and implement protections to prevent future events of this nature from occurring.
We cannot assure you that our data protection efforts and our investment in information technology will prevent significant breakdowns, data leakages, breaches in our systems, or those of our third party vendors and other contractors and consultants, or other cyber incidents that could have a material adverse effect upon our reputation, business, operations, or financial condition. For example, if such an event were to occur and cause interruptions in our operations, or those of our third party vendors and other contractors and consultants, it could result in a material disruption of our programs and the development of our services and technologies could be delayed. Furthermore, significant disruptions of our internal information technology systems or those of our third party vendors and other contractors and consultants, or security breaches could result in the loss, misappropriation, and/or unauthorized access, use, or disclosure of, or the prevention of access to, confidential information (including trade secrets or other intellectual property, proprietary business information, and personal information), which could result in financial, legal, business, and reputational harm to us. Any such event that leads to unauthorized access, use, or disclosure of personal information, including personal information regarding our customers or employees, could harm our reputation directly, compel us to comply with federal and/or state breach notification laws and foreign law equivalents, subject us to mandatory corrective action, and otherwise subject us to liability under laws and regulations that protect the privacy and security of personal information, which could result in significant legal and financial exposure and reputational damages that could potentially have an adverse effect on our business. For example, in November 2023, we experienced a cybersecurity incident which resulted in unauthorized access of certain systems within our IT