Company: GLPG
Filing Date: 2025-03-27
Form Type: 20-F
Source: 0001558370-25-003806
Chunk: 62

Company: GALAPAGOS NV
Filing Date: 2025-03-27
Form: 20-F
Item: Item 3
Chunk 62
---
 internal control over financial reporting. Our compliance with applicable provisions of Section 404 will require that we incur substantial accounting expense and expend significant management time on compliance-related issues as we implement additional corporate governance practices and comply with reporting requirements. Moreover, if we are not able to comply with the requirements of Section 404 applicable to us in a timely manner, or if we or our independent registered public accounting firm identifies deficiencies in our internal control over financial reporting that are deemed to be material weaknesses, the market price of the ADSs or our ordinary shares could decline and we could be subject to sanctions or investigations by the SEC or other regulatory authorities, which would require additional financial and management resources. Furthermore, investor perceptions of our company may suffer if deficiencies are found, and this could cause a decline in the market price of the ADSs or our ordinary shares. Irrespective of compliance with Section 404, any failure of our internal control over financial reporting could have a material adverse effect on our stated operating results and harm our reputation. If we are unable to implement these requirements effectively or efficiently, it could harm our operations, financial reporting or financial results, and could result in an adverse opinion on our internal control over financial reporting from our independent registered public accounting firm.
​
​
Our and our third party partners’ or vendors’, information technology systems and networks could face serious disruptions or suffer security breaches, incidents, or compromises that could adversely affect our business.
​
To meet business objectives, we rely on both internal information technology (IT) systems and networks, and those of third parties and their vendors, to process and store confidential and sensitive data, including confidential research, business plans, financial information, intellectual property, patient data, customer data and personal data that may be subject to legal protection. The extensive information security and cybersecurity threats, which affect companies globally, pose a risk to the security and availability of these IT systems and networks, and the confidentiality, integrity, and availability of confidential and sensitive data. 
​
These threats may include, but are not limited to, social-engineering attacks (including through phishing attacks), business email compromise, online and offline fraud, malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks, access attacks (such as credential stuffing), ransomware attacks, and supply-chain attacks. These types of incidents continue to be prevalent 

​
41

and pervasive across industries, including in our industry, and such attacks on our systems have occurred in the past and are expected