55 If our security measures, or those maintained on our behalf by CROs, service providers or other third parties, are compromised now, or in the future, or the security, confidentiality, integrity or availability of our information technology, software, services, networks, communications or data is compromised, limited or fails, this could result in significant fines or other liability, interrupt our development programs, harm our reputation, or otherwise adversely affect our business. In the ordinary course of our business, we process personal data and other sensitive information, including proprietary and confidential business data, trade secrets, intellectual property, data collected about trial participants in connection with clinical trials, and sensitive third-party data. We may rely upon third-party service providers and technologies to operate critical business systems to process sensitive information in a variety of contexts, including, without limitation, third-party providers of cloud-based infrastructure, encryption and authentication technology, employee email, and other functions. Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. Cyberattacks, malicious internet-based activity, and online and offline fraud are prevalent and continue to increase. These threats are becoming increasingly difficult to detect. The information and data processed and stored in our technology systems, and those of our research collaborators, CROs, contractors, consultants, and other third parties on which we depend to operate our business, may be vulnerable to these threats. These threats come from a variety of sources, including traditional computer “hackers,” threat actors, personnel (such as through theft or misuse), sophisticated nation-states, and nation-state- supported actors. During times of war and other major conflicts, including as a result of the ongoing military conflict between Russia and Ukraine and the related sanctions imposed against Russia, we and the third parties upon which we rely may be vulnerable to a heightened risk of these attacks, including cyber-attacks that could materially disrupt our systems and operations and supply chain. We and the third parties upon which we rely may be subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks (such as credential stuffing), personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, and other similar threats. Ransomware attacks, including by organized criminal threat actors, nation-states, and nation-state-supported actors, are becoming increasingly prevalent and severe and can lead to significant interruptions in our operations, loss of data and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Similarly, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties and infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach of or disruption to our information technology systems or the third-party information technology systems that support us. Additionally, as a result of health epidemics, certain employees may remain in a remote work environment and outside of our corporate network security protection boundaries, which imposes additional risks to our business, including increased risk of industrial espionage, phishing and other cybersecurity attacks, and unauthorized dissemination of proprietary or confidential information, any of which could have a material adverse effect on our business. Any of the previously identified or similar threats could cause a security incident or other interruption. A security incident or other interruption could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, access to our sensitive information, or interruptions or stoppages in our business operations (including our clinical trials). Although to our knowledge, we have not experienced a material system failure or security incident to date, if such an event were to occur, it could result in a material disruption of our development programs and our business operations, whether due to a loss of trade secrets or other proprietary information or other similar disruptions. For example, the loss of clinical trial data from completed, ongoing or future clinical trials could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. Likewise, we rely on third- party research institution collaborators, CROs, other contractors and consultants for many aspects of our business, including research and development activities and manufacturing of our product candidates, and similar events relating to their computer systems could also have a material adverse effect on our business.