Company: TVRD
Filing Date: 2025-01-27
Form Type: S-4/A
Source: 0001104659-25-006050
Chunk: 105

Company: Tvardi Therapeutics, Inc.
Filing Date: 2025-01-27
Form: S-4/A
Chunk 105
---
 such payments.

Cara and the third parties upon which Cara relies are subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks, credential stuffing, credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, attacks enhanced or facilitated by AI, telecommunications failures, earthquakes, fires, floods, and other similar threats. Additionally, future or past business transactions (such as acquisitions or integrations) could expose Cara to additional cybersecurity risks and vulnerabilities, as Cara’s systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies. Furthermore, Cara may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into Cara’s information technology environment and security program.

While Cara has implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective. Cara takes steps designed to detect, mitigate, and remediate vulnerabilities in its information systems (such as its hardware and/or software, including that of third parties upon which Cara relies). Cara may not, however, detect and remediate all such vulnerabilities including on a timely basis. Further, Cara may experience delays in developing and deploying remedial measures and patches designed to address identified vulnerabilities. Vulnerabilities could be exploited and result in a security incident.

Any of the previously identified or similar threats could cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to Cara’s sensitive data or Cara’s information technology systems, or those of the third parties upon whom Cara relies. A security incident or other interruption could disrupt Cara’s ability (and that of third parties upon whom Cara relies) to provide its services.

Cara may expend significant resources or modify its business activities to try to protect against security incidents. Additionally, certain data privacy and security obligations may require Cara to implement and maintain specific security measures or industry-standard or reasonable security measures to protect its information technology systems and sensitive data.

Applicable data privacy and security obligations may require Cara to notify relevant stakeholders, including affected individuals, customers, regulators,