buildings from our collaborator to construct the production lines and other production facilities within such buildings. Our collaborations with CMOs, our operation of our new manufacturing facilities (upon construction completed) and our ability to obtain supplies for manufacturing our drug candidates or future approved drugs could be disrupted if the operations of these collaborators, suppliers or our new manufacturing facilities are affected by a man-made or natural disaster or other business interruption. In addition, damage or extended periods of interruption to our corporate, development, research or manufacturing facilities due to fire, natural disaster, power loss, communications failure, unauthorized entry or other events could cause us to cease or delay development or commercialization of some or all of our drug candidates. Our insurance might not cover all losses under such circumstances and our business and financial condition may be seriously harmed by such delays and interruption.

Our internal information technology and other infrastructure, or those used by our CROs or partners or other contractors or consultants, may fail or suffer security breaches, which may require us to expend additional resources to protect our technology and information systems and could materially adversely affect our business, financial condition, results of operations and prospects.

Despite the implementation of security measures, our information technology systems and those of our current or future partners, CROs, CMOs, consultants and other service providers or suppliers are vulnerable to damage from cyber-attacks, computer viruses, malicious codes, unauthorized access, employee theft or misuse, natural disasters, fire, power loss, terrorism, war, and telecommunication and electrical failures, among other things. If such an event were to occur and cause interruptions in our operations, it could result in a material disruption of our research and development programs. For example, our data may not be backed up in a timely manner and the loss of clinical trial data from ongoing or future clinical trials for any of our drug candidates could result in delays in regulatory approval efforts and significantly increase costs to recover or reproduce the data. To the extent that any disruption or security breach were to result in a loss of or damage to data or applications, or inappropriate disclosure of confidential or proprietary information, we could incur liability and the further development of our drug candidates could be delayed. In addition, a security breach may result in the loss of, damage to, or public disclosure of personally identifiable information, and such an event could have serious negative consequences, including disputes, regulatory action, investigation, litigation, fines, penalties and damages, and time-consuming and expensive litigation, any of which could have a material adverse effect on our business, financial condition, results of operations, or prospects.

In the ordinary course of our business, we collect and store sensitive data, including, among other things, legally protected patient health information, personally identifiable information about our employees, intellectual property and proprietary business information. We manage and maintain our applications and data utilizing on-site systems and outsourced vendors. These applications and data encompass a wide variety of business critical information including research and development information, commercial information and business and financial information. Because information systems, networks and other technologies are critical to many of our operating activities, shutdowns or service disruptions at our Company or suppliers that provide information systems, networks or other services to us pose increasing risks. Such disruptions may be caused by events such as computer hacking, phishing attacks, ransomware, dissemination of computer viruses, worms and other destructive or disruptive software, denial of service attacks and other malicious activity, as well as power outages, natural disasters (including extreme weather), terrorist attacks or other similar events. Such events could have a material adverse impact on us and our business, including loss of data and damage to

equipment, among other things. In addition, system redundancy may be ineffective or inadequate, and our disaster recovery planning may not be sufficient to cover all eventualities. Significant events could result in a disruption of our operations, damage to our reputation or a loss of revenues.

We could be subject to risks caused by misappropriation, misuse, leakage, falsification, system malfunction or intentional or accidental release or loss of information maintained in the information systems and networks of us and our suppliers, including but not limited to personal information of our employees and patients. In addition, outside parties may attempt to penetrate our systems or those of our suppliers or fraudulently induce our personnel or the personnel of our suppliers to disclose sensitive information in order to gain access to our data or systems. The risk of a security breach or disruption, particularly through cyber-attacks or cyber intrusion, including by computer hackers, foreign governments and cyber terrorists, has generally increased as the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased. We may not be able to anticipate all types of security threats, nor may we be able to implement preventive measures effective against all such security threats. The techniques used by cyber criminals change frequently, may not be recognized until launched and can originate from a wide variety of sources, including outside groups such as external service providers, organized crime affiliates, terrorist organizations or hostile foreign governments or agencies. We cannot assure you that our data protection efforts and our investment in information technology will prevent significant breakdowns, data leakages, breaches in our systems or those of our third-party vendors and other contractors and consultants, or other cyber incidents that could have a material adverse effect upon our reputation, business, results of operations, financial condition or prospects. If we experienced any such material system failure or security breach and interruptions in our operations, it could result in a material disruption of our development programs and our business operations, a breach of sensitive personal information or a loss or corruption of critical data assets including trade secrets or other proprietary information. For example, the loss of clinical trial data from completed or future clinical trials could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data.

If a material breach of our information technology systems or those of our suppliers occurs, the market perception of the effectiveness of our security measures could be harmed and our reputation and credibility could be damaged. We could be required to expend significant amounts of money and other resources to repair or replace information systems or networks. In addition, we could be subject to regulatory actions or claims made by individuals and groups in private litigation involving privacy issues related to data collection and use practices and other data privacy laws and regulations, including claims for misuse or inappropriate disclosure of data, as well as unfair or deceptive practices. Moreover, despite our efforts, the possibility of these events occurring cannot be eliminated. As we engage in more electronic transactions with payers, suppliers and patients, and collect and store an increasing volume of data, the related security risks will increase and we will need to expend additional resources to protect our technology and information systems.

We may not have adequate insurance coverage to compensate for any losses associated with a system failure, any breach of our computer systems or other cybersecurity attack or any violation of any privacy laws or other obligations. Any breach or failure of our or our suppliers’ computer systems, information technology and other infrastructure could materially adversely affect our business, financial condition, results of operations and prospects.