Company: KROS
Filing Date: 2025-08-06
Form Type: 10-Q
Source: 0001664710-25-000070
Chunk: 392

Company: Keros Therapeutics, Inc.
Filing Date: 2025-08-06
Form: 10-Q
Item: Item 8
Chunk 392
---
 may in the future cause a security incident or other interruption that have in the past and may in the future result in unauthorized, unlawful or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of or access to our sensitive information or our information technology systems, or those of the third parties with whom we work. A security incident or other interruption could disrupt our ability (and that of third parties with whom we work) to operate our business. We may expend significant resources or modify our business activities (including our clinical trial activities) to try to protect against security incidents. Certain data privacy and security obligations have required us to implement and maintain specific security measures or industry-standard or reasonable security measures to protect our information technology systems and sensitive information.

The costs to respond to a security incident and/or to mitigate any security vulnerabilities that we identify could be significant, our efforts to address these problems may not be successful, and these problems could result in unexpected interruptions, delays, cessation of service, negative publicity, and other harm to our business and our competitive position.

If we (or a third party with whom we work) experience a security incident or are perceived to have experienced a security incident, we may experience adverse consequences. Additionally, our sensitive information could be leaked, disclosed, or revealed as a result of or in connection with our employee’s, personnel’s, or vendor’s use of generative AI technologies, resulting in adverse consequences. In each case, these consequences may include: government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive information (including personal data); litigation (including class action claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; diversion of management attention; interruptions in our operations (including availability of data); financial loss; and other similar harms. Security incidents and attendant consequences may prevent or cause individuals to stop conducting business with us or negatively impact our ability to grow and operate our business. For example, the loss of preclinical or clinical data could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. Any security incident affecting us, our current and future CROs, collaborators, contractors, consultants or other partners or our industry, whether real or perceived, could harm our reputation, erode confidence in the effectiveness of our security measures and lead to regulatory scrutiny. Likewise, we use third parties for the manufacture of our product candidates and to conduct clinical trials, and similar events relating to