Company: TVRD
Filing Date: 2025-10-07
Form Type: S-1/A
Source: 0001104659-25-097519
Chunk: 115

Company: Tvardi Therapeutics, Inc.
Filing Date: 2025-10-07
Form: S-1/A
Chunk 115
---
 of the Company’s employees and clinical trial subjects, and the Company’s confidential data. In addition, outside parties may attempt to penetrate the Company’s systems or those of the third parties with whom it works or fraudulently induce its personnel or the personnel of the third parties with whom it works to disclose sensitive information in order to gain access to the Company’s data and/or systems (or those of the third parties with whom it works). The Company may experience threats to its data and systems, including malicious code and viruses, supply chain attacks, phishing and other cyberattacks. The number and complexity of these threats continue to increase over time. In particular, severe ransomware attacks are becoming increasingly prevalent and can lead to significant interruptions in our operations, ability to provide our products or services, loss of sensitive data and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but the Company may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Remote work has increased risks to our information technology systems and data, as our employees utilize network connections, computers and devices outside our premises or network, including working at home, while in transit and in public locations. Future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies. Furthermore, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program.

If a material breach of, or accidental or intentional loss of data from, the Company’s information technology systems or those of its vendors occurs, the market perception of the effectiveness of its security measures could be harmed and the Company’s reputation and credibility could be damaged, and the Company could be subject to adverse legal and regulatory consequences. The Company could be required to expend significant amounts of money and other resources to repair or replace information systems or networks. Applicable data privacy and security obligations may require us, or we may voluntarily choose, to notify relevant stakeholders, including affected individuals, customers, regulators, and investors, of security incidents, or to take other actions, such as providing credit monitoring and identity theft protection services. Such disclosures and related actions can be costly, and the disclosure or the failure to comply with such applicable requirements could lead to adverse consequences.

The Company takes steps designed to detect,