Company: TVRD
Filing Date: 2025-01-27
Form Type: S-4/A
Source: 0001104659-25-006050
Chunk: 104

Company: Tvardi Therapeutics, Inc.
Filing Date: 2025-01-27
Form: S-4/A
Chunk 104
---
 of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, personnel email, and other functions. Cara also relies on third-party service providers to provide other products, services, parts, or otherwise to operate its business. Cara’s ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. If Cara’s third-party service providers experience a security incident or other interruption, Cara could experience adverse consequences. While Cara may be entitled to damages if its third-party service providers fail to satisfy their privacy or security-related obligations to Cara, any award may be insufficient to cover Cara’s damages, or Cara may be unable to recover such award. In addition, supply-chain attacks have increased in frequency and severity, and Cara cannot guarantee that third parties’ infrastructure in Cara’s supply chain or its third-party partners’ supply chains have not been compromised.

Cybersecurity risks have significantly increased in recent years in part because of the proliferation of new technologies, the use of the internet and telecommunication technologies to conduct financial transactions, especially as personnel are working remotely, and the increased sophistication and activities of organized crime, hackers, terrorists, nation-states and other external parties. To the extent that any disruption or cybersecurity breach were to result in a loss of, or damage to, Cara’s data or information systems, or inappropriate disclosure of confidential or proprietary information, Cara could incur liability and reputational damage and, should Cara resume development of its product candidate or any future product candidate, the further development of such product candidates could be delayed.

Some actors now engage and are expected to continue to engage in cyberattacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, Cara, and the third parties upon which Cara relies, may be vulnerable to a heightened risk of these attacks, including retaliatory cyberattacks, that could materially disrupt its systems and operations, supply chain, and ability to produce, sell and distribute Cara’s goods and services. In particular, severe ransomware attacks are becoming increasingly prevalent and can lead to significant interruptions in Cara’s operations, ability to provide its products or services, loss of sensitive data and income, reputational

<div align='center'>52</div>

harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but Cara may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting