As owners and operators of critical infrastructure, we face a heightened risk of physical attack and cyber attacks from internal or external sources, including nation-state cyber actors. Our water and wastewater systems have been, and may in the future be, vulnerable to disability or failures as a result of physical or cyber attacks, acts of war or terrorism, vandalism and other causes. By way of example, on October 3, 2024, we identified unauthorized activity within our information technology computer networks and systems, which we determined to be the result of a cybersecurity incident. See Item 7—Management's Discussion and Analysis of Financial Condition and Results of Operations—Other Matters—Cybersecurity Incident, for more information regarding this incident. Our operational and information technology systems are also vulnerable to unauthorized external or internal access, due to hacking, viruses, social engineering attacks, acts of violence, war or terrorism, and other causes. Unauthorized access to confidential information located or stored on these systems could negatively and materially impact our reputation, customers, employees, suppliers and other third parties. Such unauthorized access could be caused through, among other causes, failure to follow established policies and procedures on the part of our employees, agents, vendors, suppliers, contractors or other third parties. Further, third parties, including vendors, suppliers and contractors, who perform certain services for us or administer and maintain our networks and sensitive information, have been, and may in the future be, targets of cyber attacks and unauthorized access to their operational or information technology systems, and any cyber incident affecting our third-party business partners could significantly disrupt our operations.
While we believe that we have appropriate security measures and safeguards to protect our operational and information technology systems, the recent cybersecurity incident that we experienced in October 2024 demonstrated that those protections alone may not prevent a cyber attack, and we cannot guarantee that such protections will be completely successful in preventing or mitigating a future cyber attack. The Company has completed its investigation into the scope, nature and impact of the cybersecurity incident and determined the incident did not have a material effect on the Company or its financial condition or results of operations; however, the Company remains subject to various risks as a result of this incident, including those related to litigation, governmental and regulatory scrutiny, including from putative class action lawsuits that have been filed in connection with the recent incident. See Item 3—Legal Proceedings—Cybersecurity Incident Class Action Lawsuits.
Future cybersecurity events could cause our operations to be disrupted, property to be damaged, and customer and other confidential information to be lost or stolen; we could experience substantial loss of revenues, response costs and other financial loss; we would likely suffer a loss or redirection of management time, attention and resources from our regular business operations; we may be subject to increased regulatory requirements; our ability to comply with environmental standards and to continue to provide reliable service to our customers may be impacted; we would likely experience litigation and other claims against us; and we may suffer damage to our reputation, any of which could have a negative impact on our business, financial condition, results of operations and cash flows. Applicable laws and regulations or contracts may require us to report cybersecurity events or breaches of securely maintained confidential data, which may cause us to incur costs related to legal claims or proceedings and regulatory fines or penalties. These types of events, and their resulting impacts, either to our facilities or assets, those of third parties, or the industry in general, may also cause us to incur additional security and insurance related costs. In addition, in the ordinary course of business, we collect and retain sensitive information, including personally identifiable information, about our customers and employees. In many cases, we outsource administration of certain functions to vendors that have been and will continue to be targets of cyber attacks. Any theft, loss or fraudulent use of customer, employee or proprietary data as a result of a cyber attack on us or a vendor, supplier, contractor or other third-party business partner could also subject us to significant litigation, liability and costs, as well as adversely impact our reputation with customers and regulators, among others.
We have obtained insurance to provide coverage for a portion of the losses and damages that may result from a physical attack, cyber attack or a security breach, but such insurance is subject to a number of exclusions and may not cover the total loss or damage caused by an attack or a breach. We have incurred, and may continue to incur, certain expenses related to the October 2024 cybersecurity incident, and we maintain a cybersecurity insurance policy as part of our overall insurance program. However, adequate insurance may not be available at rates that we believe are reasonable, and the costs of responding to and recovering from a physical attack, cyber attack or security breach incident may not, in whole or in part, be covered by insurance or recoverable in rates. See Item 1A—Risk Factors Risks Related to our Industry and Business Operations—We may sustain losses that exceed or are excluded from our insurance coverage or for which we are self-insured, below for more information.