Company: RCUS
Filing Date: 2025-08-06
Form Type: 10-Q
Source: 0001724521-25-000101
Chunk: 388

Company: Arcus Biosciences, Inc.
Filing Date: 2025-08-06
Form: 10-Q
Item: Part I, Item 2
Chunk 388
---
 supply chain attacks have increased in frequency and severity, and we cannot guarantee that third parties’ infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised.

Despite the implementation of security measures, given the size and complexity and the increasing amounts of sensitive information that they maintain, our internal information technology systems and those of our third-party CROs and other third parties upon which we rely are vulnerable to breakdown or other damage or interruption from service interruptions, system malfunction, natural disasters, terrorism, war and telecommunication and electrical failures, as well as security breaches from inadvertent or intentional actions by our employees, contractors, consultants, business partners, and/or other third parties, or from cyberattacks by malicious third parties (including the deployment of harmful malware, ransomware, denial-of-service attacks, social engineering and other means to affect service reliability and threaten the confidentiality, integrity and availability of information and other assets), which may compromise our system infrastructure, lead to data leakage, impair key business processes or other critical business operations, delay our development programs, or result in the loss of assets or other liability. Our reliance on internet technology and the number of our employees who are working remotely has increased the opportunities for cybercriminals to exploit vulnerabilities. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information. Further, we cannot assure you that our data protection efforts and our investment in information technology will prevent 

52

breakdowns, data leakages, breaches in our systems or other cyber incidents that could have a material adverse effect upon our reputation, business, operations or financial condition. 

Furthermore, as the cyber threat landscape evolves, these attacks are growing in frequency, sophistication and intensity, and becoming increasingly difficult to detect. There can be no assurance that we and our third-party CROs and other third parties upon which we rely will be successful in detecting, preventing or fully recovering systems or data from all breakdowns, service interruptions, attacks or breaches of systems that could adversely affect our business and operations and/or result in the loss or disclosure of critical or sensitive data or other assets, which could result in financial, legal, business or reputational harm to us. Ransomware attacks have risen dramatically and we may be forced to pay to unlock our data and information, re-access our systems and resume our ability to conduct business operations. Extortion payments may alleviate the negative impact of a ransomware attack, but we may