Cybersecurity and data breaches

By sector

Sector is the SEC's industry description of the company. Each count opens that sector's quotes below.

376 paragraphs · Pharmaceutical Preparations show all sectors

For example, the E.U. General Data Protection Regulation (“GDPR”) went into effect in 2018 and has imposed new obligations on us with respect to our processing of personal data and the cross-border transfer of such data, including higher standards of obtaining consent, more robust transparency requirements, data breach notification requirements, requirements for contractual language with our data processors, and stronger individual data rights. Different E.U. member states have interpreted the GDPR differently and many have imposed additional requirements, which add to the complexity of processing personal data in the E.U. The GDPR also imposes strict rules on the transfer of personal data to countries outside the E.U., including the U.S. and the U.K., and permits data protection authorities to impose large penalties for violations of the GDPR. Similarly, other jurisdictions have either introduced or enacted legislation or executive orders restricting cross-border data transfers. These regulations restrict the transfer of certain types of data (e.g., sensitive personal data) or restrict the transfer of data to certain jurisdictions. The rules related to cross border data transfers continue to evolve based on court decisions and regulator guidance, which presents certain practical challenges to compliance. Regulators also continue to focus enforcement efforts on behavioral advertising and other online tracking technologies commonly used by companies. Compliance with these evolving rules is challenging, as country specific guidance and rules are continually changing and limited alternatives currently exist in the market. Compliance with the these laws and regulations is a rigorous and time-intensive process that may increase our cost of doing business or require us to change our business practices, and despite those efforts, there is a risk that we may be subject to fines and penalties, litigation, and reputational harm in connection with any activities falling within the scope of the GDPR or other privacy laws or regulations.

Read in the 10-K filed Feb 13, 2025 ↗

We maintain and rely extensively on information technology systems and network infrastructures for the effective operation of our business. In the course of our business, we collect, store, and transmit confidential information (including personal information and intellectual property), and it is critical that we do so in a secure manner to maintain the confidentiality, integrity, and availability of such confidential information. A disruption, infiltration, or failure of our information technology systems or any of our data centers as a result of software or hardware malfunctions, computer viruses, cyber-attacks, employee theft or misuse, power disruptions, natural disasters, floods or accidents could cause breaches of data security and loss of critical data, which in turn could materially adversely affect our business and subject us to both private and governmental causes of action. While we have implemented security measures to minimize these risks to our data and information technology systems and have adopted a business continuity plan to deal with a disruption to our information technology systems, there can be no assurance that our efforts to protect our data and information systems will prevent breakdowns or breaches in our systems that could adversely affect our business. In addition, we maintain cyber liability insurance, however, this insurance may not be sufficient to cover the financial, legal, business or reputational losses that may result from an interruption or breach of our systems and those of critical third parties.

Read in the 10-K filed Feb 13, 2025 ↗

Cyber-attacks are increasing in their frequency, sophistication, and intensity, and are becoming increasingly difficult to detect. They are often carried out by well-resourced and skilled parties, including nation states, organized crime groups, “hacktivists” and employees or contractors acting carelessly or with malicious intent. Cyber-attacks include deployment of harmful malware and key loggers, ransomware, denial-of-service attacks, malicious websites, the use of social engineering, and other means to affect the confidentiality, integrity and availability of our technology systems and data. Cyber-attacks also include manufacturing, hardware or software supply chain attacks, which could cause a delay in the manufacturing of products or products produced for contract manufacturing or lead to a data privacy or security breach. Our business partners face similar risks and when they experience a security breach of their systems, our security can be adversely affected. Similar to other companies, we have experienced immaterial cybersecurity incidents, including temporary service interruptions of third-party suppliers. In addition, our increased use of cloud technologies heightens these third party and other operational risks, and any failure by cloud or other technology service providers to adequately safeguard their systems and prevent cyber-attacks could disrupt our operations and result in misappropriation, corruption, or loss of confidential or propriety information. A significant portion of our workforce continues to leverage hybrid work. Risk of cyber-attack is increased with employees working remotely. Remote work increases the risk we may be vulnerable to cybersecurity-related events such as phishing attacks and other security threats.

Read in the 10-K filed Feb 13, 2025 ↗