Company: SUPN
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0001356576-25-000017
Chunk: 449

Company: SUPERNUS PHARMACEUTICALS, INC.
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1A
Chunk 449
---
 cause our business and reputation to suffer.

Our operations involve the use of multiple systems that process, store and transmit sensitive information about our customers, suppliers, employees, financial position, operating results, and strategies. In the ordinary course of our business, we or our vendors collect and store sensitive data in our or their data centers and on our networks, including: intellectual property; proprietary business information; proprietary information of our customers, suppliers, and business partners; and identifiable personal information of our employees and patients in our clinical trials. Hardware, software, or applications we develop or procure from third parties or through open source solutions may contain defects in design or other problems that could unexpectedly compromise information security. Additionally, cyberattacks or security breaches, such as the 2021 ransomware attack, could compromise confidential client information, confidential employee information or other sensitive data, cause a disruption or delay in our operations, harm our reputation, result in improper use of our systems and networks, the manipulation and destruction of data, or the release of defective products and may otherwise expose us to liability, including as a result of the release of third party information improperly obtained from our systems, any of which in turn could negatively impact our business, financial results, reputation and the value of our common shares. We have and continue to implement measures to safeguard our systems and information and mitigate potential risks, but there is no assurance that such actions will be sufficient to prevent cyberattacks, security breaches, or other disruptions that manipulate or improperly use our systems, compromise sensitive information, destroy or corrupt data, or otherwise disrupt our operations. The occurrence of such events, including additional breaches of our security measures or those of our third-party service providers, could negatively impact our reputation and our competitive position and could result in litigation with third parties, regulatory action, loss of business due to disruption of operations, and/or reputational damage, potential liability and increased remediation and protection costs, any of which could have a material adverse effect on our financial condition and results of operations. Any future attacks or other security breaches 

53

Table of ContentsITEM 1A. RISK FACTORS.

could also cause us to incur remediation costs with respect to our information technology systems, as occurred following the 2021 ransomware attack. Additionally, a cyberattack, security breach, or other incident may remain undetected for an extended period of time, potentially escalating the adverse effects of any such incident.

The continued occurrence of high-profile data breaches provides evidence of an external environment which is increasingly hostile to information security and to the secure