Company: BLLN
Filing Date: 2025-10-17
Form Type: S-1/A
Source: 0001193125-25-242632
Chunk: 56

Company: BillionToOne, Inc.
Filing Date: 2025-10-17
Form: S-1/A
Chunk 56
---
 not recognized until launched against a target, we may be unable to anticipate these techniques or implement adequate preventative measures. We may experience security breaches that may remain undetected for an extended period. Even if
identified, we may be unable to adequately investigate or remediate incidents or breaches.

The costs of attempting to protect against the foregoing risks and
responding to a cyberattack are significant. Breaches of our and/or our vendors’ security measures and the unauthorized dissemination of sensitive personal information or proprietary or confidential information about us, our customers or other
third-parties, could result in investigations, regulatory enforcement actions, notices to affected individuals, regulators and the media, material fines and penalties, loss of customers, litigation or other actions which could have a material
adverse effect on our business, prospects, reputation, results of operations and financial condition. Breaches and incidents also cause operational harm such as by preventing us from performing our laboratory operations, preparing and providing
reports to customers, billing payors, processing reimbursement appeals, handling patient or physician inquiries, conducting research and development activities and managing the administrative aspects of our business.

We and certain of our service providers are from time to time subject to cyberattacks and security incidents. Although we have implemented security measures and an
enterprise security program to prevent unauthorized access to our systems, information and patient data, there is no assurance that these measures will be effective. As cyber threats evolve, we may be required to expend significant additional
resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities, and these efforts may not be successful.

We have contingency plans and insurance coverage for certain potential claims, liabilities and costs relating to security incidents that may arise from our business or
operations; however, the coverage may not be sufficient to cover all claims, liabilities and costs arising from the incidents, including fines and penalties. Our contracts may not contain limitations of liability, and even where they do, there can
be no assurance that limitations of

32

liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our data privacy and security obligations. The ultimate resolution of any such incidents or
estimating the amounts or ranges of potential loss, if any, that could result therefrom are highly uncertain. If we cannot successfully resolve a security incident or contain any potential loss, it could materially impact our ability to operate our
business as well as our results of operations and financial position.

If we experience a significant disruption in our information technology systems, or