Company: SUPN
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0001356576-25-000017
Chunk: 273

Company: SUPERNUS PHARMACEUTICALS, INC.
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1A
Chunk 273
---
 processing, maintenance, and transmission of information critical to our operations and business strategy.

In response to a cyberattack or security breach, as was the case following the 2021 ransomware attack, we may accelerate previously planned information technology investments in ways designed to improve our information security and technology infrastructure. We have incurred costs and expect to continue to incur costs in the future, which may be significant, in connection with efforts designed to enhance our data security and take further steps designed to protect against unauthorized access to, or manipulation of, our systems and data. In response to any future cyberattack or security breach we may further increase our information technology investments.

Despite our security measures, our information technology and infrastructure may be vulnerable to additional attacks breached due to employee error, malfeasance, or other disruptions. It is possible that the security controls we have implemented to safeguard personal data and our networks, train our employees and vendors on data security, and implement security requirements and other practices may not prevent the compromise of our networks or the improper disclosure of data that we or our vendors store and manage. Unauthorized parties may also attempt to gain access to our systems or facilities, or those of third parties with whom we do business, through fraud, trickery, other forms of deceiving our employees, contractors, and vendors. If we, our vendors, or other third parties with whom we do business experience significant data security breaches or fail to detect and appropriately respond to significant data security breaches, we could be exposed to government enforcement actions. Improper disclosure could also harm our reputation, create risks for customers, or subject us to liability under laws that protect personal information. This could adversely affect our business, revenues, and competitive position.

While integrating acquired businesses and operations and upgrading the Company's information technology systems, we may face an elevated cybersecurity risk. 

Since 2023, we have cyber insurance in addition to our business insurance coverage, however, prior to that time we self-insured by assuming the full risk of costs related to cybersecurity incidents. Such cyber insurance does not provide coverage for incidents that occurred before 2023. There can be no assurance that our insurance coverage will be sufficient to cover the full impact of a cyberattack or that it can be renewed in the future at favorable terms, or at all. 

We face significant competition in attracting and retaining talented employees. Further, managing succession for and retention of key executives is critical to our success. Our failure to do so could have an adverse impact on our future performance.

We are highly dependent upon skilled personnel in key parts of