Company: HROW
Filing Date: 2025-03-27
Form Type: 10-K
Source: 0001641172-25-000925
Chunk: 44

Company: HARROW, INC.
Filing Date: 2025-03-27
Form: 10-K
Item: Item 1
Chunk 44
---
 resulting from attacks or lapses by employees, service providers
(including providers of information technology-specific services), business partners, nation states (including groups associated with
or supported by foreign intelligence agencies), organized crime organizations, “hacktivists” or others, create risks that
our sensitive data may be exposed to unauthorized persons, our competitors or the public. System vulnerabilities and/or cybersecurity
breaches experienced by our third-party service providers constitute a substantial share of the information security risks to our business.
There can be no assurance that a cybersecurity incident would not result in a material adverse effect on our business or results of operations.
Further, the timeliness of our awareness of a cybersecurity incident affects our ability to respond to and work to mitigate the severity
of such events.

Cyberattackers
are also increasingly exploiting vulnerabilities in commercially available software from shared or open-source code. We rely on third
party commercial software that have had and may have such vulnerabilities, but as use of open-source code is frequently not disclosed,
our ability to fully assess this risk to our systems is limited. There can be no assurances that a vulnerability in the software and
services that we use would not result in a material adverse effect on our business or results of operations.

Domestic
and global government regulators, our business partners, suppliers with whom we do business, companies that provide us or our partners
with business services and companies we have acquired or may acquire face similar risks. Security breaches of their systems or service
outages have adversely affected systems and could, in the future, affect our systems and security, leave us without access to important
systems, products, raw materials, components, services or information, or expose our confidential data or sensitive personal information.
An extended service outage affecting these or other vendors, particularly where such vendor is the single source from which we obtain
the services, could have a material adverse effect on our business or results of operations. For example, in February 2024, UnitedHealth
Group announced that a suspected nation-state associated cyber security threat actor had gained access to some of the Change Healthcare
(“Change”) information technology systems. Change is the largest clearinghouse for medical claims in the U.S. While Harrow
was not directly impacted by this cybersecurity incident, it was reported that as a reaction to the cybersecurity incident, Change temporarily
disconnected over 100 related payment systems and Change was unable to process medical claims through its primary platforms. This resulted
in the delays to the revenue and cash collection cycle for several ASCs and