Company: ALGN
Filing Date: 2025-08-06
Form Type: 10-Q
Source: 0001097149-25-000064
Chunk: 109

Company: ALIGN TECHNOLOGY INC
Filing Date: 2025-08-06
Form: 10-Q
Item: Item 1A
Chunk 109
---
 security measures in our IT systems, we and our service providers, third-party vendors and other third parties could be targeted by or subject to physical break-ins, computer viruses and other malicious code, unauthorized or fraudulent access, programming errors or other technical malfunctions, hacking attacks, phishing, vishing, deepfakes, and other social engineering attacks, malware, ransomware, employee noncompliance, error or malfeasance, cybersecurity attacks, malicious code, and other breaches of, or incidents impacting, IT systems or similar malicious or otherwise disruptive actions, including by organized groups and nation-state actors, which may disrupt or limit the availability of, or result in damage to, our IT systems and result in loss or unavailability of, damage to, or the unauthorized acquisition, use, disclosure, or other processing of confidential information. For example, we have experienced, and may again experience in the future, cybersecurity incidents, data incidents, and unauthorized internal employee exfiltration of information. This risk is exacerbated with the advancement of technologies like AI, which malicious third parties can use to create new, more sophisticated and more frequent or other attacks. There can be no assurance our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information or any other information we maintain or otherwise process. 

Further, the frequency and sophistication of third-party cybersecurity attacks are increasing. Significant service disruptions, breaches, incidents, interruptions or other disruptive events impacting our infrastructure and IT systems, or other cybersecurity incidents, or any belief or reporting that any of the foregoing has occurred, could expose us to regulatory investigations, or other proceedings, private claims, demands, and litigation, impair our reputation and competitive position, distract management and require significant time and resources to address. Legal or regulatory action against us could prevent us from resolving issues quickly or force us to resolve them in unanticipated ways, cause us to incur significant expense and damages, or result in orders forcing us to cease operations or modify our business practices in ways that materially limit or restrict our products and services. Concerns over our practices with respect to privacy, data protection, data governance, and cybersecurity could adversely affect our reputation and deter customers and consumers from using our products and services. In addition, patient care could suffer, and we could be liable if our products, services or IT systems fail to timely deliver accurate and complete information. We have cybersecurity and other forms of insurance coverage related to cyberattacks, breaches, and other incidents or security problems, but we