behalf. The secure processing, storage, maintenance and transmission of our critical information are vital to our operations and business strategy, and we devote significant resources to protecting such information.
Although we take reasonable measures to protect critical information and other data from unauthorized access, acquisition, use or disclosure, our information technology and infrastructure and that of our service providers handling and storing information on our behalf may be vulnerable to a variety of disruptions, including data breaches, attacks by hackers and other malicious third parties (including the deployment of computer viruses, malware, ransomware, denial-of-service attacks, social engineering, and other events that affect service reliability and threaten the confidentiality, integrity, and availability of information), unauthorized access, natural disasters, fires, terrorism, war, telecommunications or electrical interruptions or failures, employee error or malfeasance or other malicious or inadvertent disruptions. In particular, the risk of a security breach or disruption, particularly through cyber-attacks or cyber intrusion, has generally increased as the number, intensity, and sophistication of attempted attacks and intrusions from around the world have increased. We may not be able to anticipate all types of security threats, and we may not be able to implement preventive measures effective against all such security threats. Because the techniques used by cyber criminals change frequently, may not be recognized until launched, and can originate from a wide variety of sources, including outside groups such as external service providers, organized crime affiliates or terrorist organizations, we and our services providers and other partners may be unable to anticipate these techniques or implement adequate preventative measures. Further, we do not have any control over the operations of the facilities or technology of third parties that collect, process and store sensitive information on our behalf. Any unauthorized access or acquisition, breach, or other loss, of information could result in legal claims or proceedings, and liability under U.S. federal or state, or non-U.S., laws regarding the privacy and protection of information, including personal information, and could disrupt our operations and harm our reputation. In addition, notice of breaches may be required to affected individuals, regulators, credit reporting agencies or the media. Any such publication or notice could harm our reputation and our ability to compete. The financial exposure from the events referenced above could either not be insured against or not be fully covered through any insurance that we may maintain, and there can be no assurance that the limitations of liability in any of our contracts would be enforceable or adequate or would otherwise protect us from liabilities or damages as a result of the events referenced above.
In December 2019, we experienced a ransomware incident, which resulted in the encryption of certain Company files. We did not experience a loss of information and determined that we were not required to notify any person of such incident. The breach was caused by a consultant’s support access application becoming compromised which allowed for the installation of malware that encrypted large datasets within our internal network. Upon discovery of the malware, we immediately terminated the consultant’s access, files were restored to their original state prior to the encryption, the access application and malware were removed and all users were required to update their passwords. After investigation, we determined that no personal information was accessed or lost. In order to protect against similar occurrences, we took a series of remedial measures, including limiting remote access to our network by third parties, implementing a robust intrusion detection system to protect the network, installing multiple scanning applications on all systems, and implementing a required cybersecurity awareness training program to ensure end users can identify potentially harmful emails and files. However, despite these remedial measures, there can be no assurance that we will be able to protect against similar incidents in the future. Though we determined the ransomware incident had no material impact on our business, including no access to or loss of personal information, this event or similar events in the future may subject us to unfavorable publicity, claims by one or more state attorneys general, or other regulators, any of which could expose us to a disruption or challenges relating to our daily operations, as well as to litigation, disputes, regulatory investigations, orders, damages, fines, indemnity obligations, damages for contract breach, penalties for violation of applicable laws and regulations, and significant increases in compliance costs, and could inhibit sales. Any of the foregoing could have a material adverse effect on our business, financial condition, results of operations and prospects.
Seasonality may cause fluctuations in our revenue and results of operations.
We operate on a December 31st year end and believe that there are seasonal factors which may cause sales of our products to vary on a quarterly or yearly basis and increase the magnitude of quarterly or annual fluctuations in our operating results. We believe that this seasonality results from a number of factors, including the procurement and budgeting cycles of many of our customers, especially government- or grant-funded customers, whose cycles often coincide with government fiscal year ends. For example, the United States government’s fiscal year end occurs in our
