Company: MIRM
Filing Date: 2025-05-07
Form Type: 10-Q
Source: 0001759425-25-000032
Chunk: 316

Company: Mirum Pharmaceuticals, Inc.
Filing Date: 2025-05-07
Form: 10-Q
Item: Part II, Item 1A
Chunk 316
---
 and recover from incidents. Ransomware attacks, including by organized criminal threat actors, nation-states, and nation-state-supported actors, are becoming increasingly prevalent and severe and can lead to significant interruptions in our operations, loss of data and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Remote work has increased risks to our information technology systems and data, 

82

as our employees utilize network connections, computers and devices outside our premises or network, including working at home, while in transit and in public locations.

Future or past business transactions (such as acquisitions or integrations) could also expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies. Furthermore, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program.

We work with third parties and technologies that operate critical business systems to process sensitive information in a variety of contexts, including, without limitation, third-party providers of cloud-based infrastructure, encryption and authentication technology, employee communications, and other functions. Likewise, we work with third-party research institution collaborators, CMOs, CROs, other contractors and consultants for many aspects of our business, including research and development activities and manufacturing of our approved medicines and our product candidates, and similar events relating to their computer systems or data could also have a material adverse effect on our business. Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. If the third parties with whom we work experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if the third parties with whom we work fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. Similarly, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties and infrastructure in our supply chain or the supply chains of the third parties with whom we work have not been compromised.

While we have implemented information security measures designed to protect against security incidents, we cannot assure you that our (or the third parties with whom we work) security measures will be effective.