Company: TVRD
Filing Date: 2025-02-14
Form Type: 424B3
Source: 0001104659-25-014310
Chunk: 104

Company: Tvardi Therapeutics, Inc.
Filing Date: 2025-02-14
Form: 424B3
Chunk 104
---
 increasingly dependent upon information systems, infrastructure and data to operate its business. In the ordinary course of business, Cara collects, store, transmit and otherwise process confidential information (including but not limited to intellectual property, proprietary business information and personal data). Cara also has outsourced elements of its operations to third parties, and as a result Cara manages a number of service providers who have access to its data and information systems and infrastructure. Cara’s reliance on service providers could introduce new cybersecurity risks and vulnerabilities, including supply-chain attacks, and other threats to Cara’s business operations. Cara relies on service providers and technologies to operate critical business systems to process sensitive data in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, personnel email, and other functions. Cara also relies on third-party service providers to provide other products, services, parts, or otherwise to operate its business. Cara’s ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. If Cara’s third-party service providers experience a security incident or other interruption, Cara could experience adverse consequences. While Cara may be entitled to damages if its third-party service providers fail to satisfy their privacy or security-related obligations to Cara, any award may be insufficient to cover Cara’s damages, or Cara may be unable to recover such award. In addition, supply-chain attacks have increased in frequency and severity, and Cara cannot guarantee that third parties’ infrastructure in Cara’s supply chain or its third-party partners’ supply chains have not been compromised.

Cybersecurity risks have significantly increased in recent years in part because of the proliferation of new technologies, the use of the internet and telecommunication technologies to conduct financial

<div align='center'>56</div>

TABLE OF CONTENTS

transactions, especially as personnel are working remotely, and the increased sophistication and activities of organized crime, hackers, terrorists, nation-states and other external parties. To the extent that any disruption or cybersecurity breach were to result in a loss of, or damage to, Cara’s data or information systems, or inappropriate disclosure of confidential or proprietary information, Cara could incur liability and reputational damage and, should Cara resume development of its product candidate or any future product candidate, the further development of such product candidates could be delayed.

Some actors now engage and are expected to continue to engage in cyberattacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, Cara