Company: ALGN
Filing Date: 2025-05-08
Form Type: 10-Q
Source: 0001097149-25-000034
Chunk: 23

Company: ALIGN TECHNOLOGY INC
Filing Date: 2025-05-08
Form: 10-Q
Item: Item 4
Chunk 23
---
 employee, applicant and customer personal, health and financial, and our own proprietary information and data essential to our operations. We rely on the effectiveness of our IT systems, policies and contracts and the policies of our third-party vendors, and their IT systems to safeguard information and data. Additionally, our cybersecurity controls depend on our customers, many of whom are individual or small healthcare providers with limited IT experience and inadequate or untested security protocols, to successfully manage data privacy and security requirements. It is critical that the facilities, infrastructure and IT systems on which we depend and the products and services we develop remain secure and be perceived as secure. Despite the implementation of security features in our products and services and security measures in our IT systems, we and our service providers, third-party vendors and other third parties could be targeted by or subject to physical break-ins, computer viruses and other malicious code, unauthorized or fraudulent access, programming errors or other technical malfunctions, hacking attacks, phishing, vishing, deepfakes, and other social engineering attacks, malware, ransomware, employee noncompliance, error or malfeasance, cybersecurity attacks, malicious code, and other breaches of, or incidents impacting, IT systems or similar malicious or otherwise disruptive actions, including by organized groups and nation-state actors, which may disrupt or limit the availability of, or result in damage to, our IT systems and result in loss or unavailability of, damage to, or the unauthorized acquisition, use, disclosure, or other processing of confidential information. For example, we have experienced, and may again experience in the future, cybersecurity incidents, data incidents, and unauthorized internal employee exfiltration of information. This risk is exacerbated with the advancement of technologies like AI, which malicious third parties can use to create new, more sophisticated and more frequent or other attacks. There can be no assurance our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information or any other information we maintain or otherwise process. 

Further, the frequency and sophistication of third-party cybersecurity attacks are increasing. Significant service disruptions, breaches, incidents, interruptions or other disruptive events impacting our infrastructure and IT systems, or other cybersecurity incidents, or any belief or reporting that any of the foregoing has occurred, could expose us to regulatory investigations, or other proceedings, private claims, demands, and litigation, impair our reputation and competitive position, distract management and require significant time and resources to address. Legal or regulatory action against us could prevent us from resolving issues