Inogen Inc

Previous report

We and our vendors and service providers rely on information technology networks and systems, and if we are unable to protect against service interruptions, data corruption, cybersecurity risks, data security incidents and/or network security breaches, our operations could be disrupted, and our business could be negatively affected.

Previous report

We rely on information technology networks and systems, certain of which are operated by third parties on which we rely, to process, transmit and store electronic, customer, operational, compliance, and financial information; to coordinate and otherwise operate our business; and to communicate within our company and with customers, suppliers, partners and other third parties. These information technology networks and systems may be susceptible to damage, disruptions or shutdowns, hardware or software failures, power outages, computer viruses, ransomware, and other malware, cybersecurity risks, data security incidents, telecommunication failures, user errors or catastrophic events. Like other companies, we have experienced data security incidents before.

Previous report

We have incurred remedial, legal and other costs in connection with this incident. We have insurance coverage in place for certain potential liabilities and costs relating to service interruptions, data corruption, cybersecurity risks, data security incidents and/or network security breaches, but this insurance is limited in amount, subject to a deductible, and may not be adequate to cover us for all costs arising from these incidents.

Previous report

If our information technology networks and systems or those provided by our third-party service providers and vendors suffer unauthorized access, severe damage, disruption or shutdown, and our business does not effectively identify or resolve the issues in a timely manner, our operations could be disrupted, we could be subject to regulatory and consumer lawsuits and other proceedings and our business could be negatively affected. For example, Change Healthcare, a division of UnitedHealthcare, experienced a cyberattack in late February 2024 that caused connection issues with our third-party service provider and a delay in rental revenue collections. In addition, cybersecurity risks and data security incidents could lead to potential unauthorized access to or acquisition of confidential information (including personally identifiable information and protected health information), and data loss, corruption, unavailability, or other unauthorized processing. There is no assurance that we will not experience service interruptions, security breaches, cybersecurity risks and data security incidents, or other information technology failures, whether suffered by us or third parties on which we rely, in the future.

Previous report

Due to the COVID-19 pandemic and related public health emergency, we allowed an increased number of employees to work remotely, and we continue to do so and expect that this hybrid model of work will continue. As a result, we may have increased cybersecurity or data security risks, due to increased use of home wi-fi networks and virtual private networks, as well as increased disbursement of physical machines. While we implement IT controls to reduce the risk of a cybersecurity and data security breach, there is no guarantee that these measures will be adequate to safeguard all systems with an increased number of employees working remotely.

Previous report

The methods used to obtain unauthorized access, disable or degrade service or sabotage systems are constantly evolving and may be difficult to anticipate or to detect for long periods of time. As a result of these types of risks and attacks, we have implemented and periodically review and update systems, processes, and procedures to protect against unauthorized access to or use of data and to prevent data loss. For example, we have increased the security of our systems by requiring all email users to change their passwords following our recent data security incident and sooner than they would have otherwise been required to. We also implemented multi-factor authentication for remote email access and have taken additional steps to further limit access to our systems. However, the ever-evolving threats mean we and our third-party service providers and vendors must continually evaluate and adapt our respective systems and processes and overall security environment. There is no guarantee that these measures will be adequate to safeguard against all data security breaches, system compromises or misuses of data.

Previous report

The compromise of our technology systems resulting in the loss, disclosure, misappropriation of, or access to, customers’, employees’ or business partners’ information or failure to comply with regulatory or contractual obligations with respect to such information, or the perception that any of these has occurred, could result in legal claims and proceedings, initiated by private parties, investigations or other proceedings by regulatory authorities, and liability or regulatory penalties, disruption to our operations and damage to our reputation, any or all of which could adversely affect our business. The costs to remediate breaches and similar system compromises that do occur could adversely affect our results of operations.

Previous report

Any new laws, regulations, other legal obligations or industry standards, or any changed interpretation of existing laws, regulations or other standards may require us to incur additional costs and restrict our business operations. For example, many jurisdictions have enacted laws requiring companies to notify individuals of data security breaches involving certain types of personal data. These mandatory disclosures regarding a security breach could result in negative publicity to us, which may cause our customers to lose confidence in the effectiveness of our data security measures which could adversely affect our business, financial condition and results of operations.