Company: DVAX
Filing Date: 2025-05-06
Form Type: 10-Q
Source: 0001029142-25-000071
Chunk: 129

Company: DYNAVAX TECHNOLOGIES CORP
Filing Date: 2025-05-06
Form: 10-Q
Item: Part I, Item 4
Chunk 129
---
 cannot guarantee that third parties and infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised or that they do not contain exploitable flaws or bugs that could result in a breach of or disruption to our information technology systems (including our products or the third-party information technology systems that support us and our goods). We rely on third parties to operate critical business systems to process sensitive information in a variety of contexts. Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. If our third-party service providers experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if our third-party service providers fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award.

It may be difficult and/or costly to detect, investigate, mitigate, contain, and remediate a security incident. Our efforts to do so may not be successful. Actions taken by us or the third parties with whom we work to detect, 

68

Table of Contents

investigate, mitigate, contain, and remediate a security incident could result in outages, data losses, and disruptions of our business. Threat actors may also gain access to other networks and systems after a compromise of our networks and systems.

The potential liability and associated consequences we could suffer as a result of any such cyber events could be catastrophic and result in irreparable harm including (a) the loss of trade secrets or other intellectual property, or (b) the public exposure of personally identifiable information (including sensitive personal information) of our employees, collaborators, clinical trial patients, and others, (c) extortion and other monetary damages due to malware or business email compromise, (d) significant interruptions in our operations, or (e) other significant damages. A data security breach or privacy violation that leads to disclosure or modification of or prevents access to patient information, including personally identifiable information or protected health information, could harm our reputation, compel us to comply with federal, state and/or international data breach notification laws, subject us to mandatory corrective action, require us to verify the correctness of database contents and otherwise subject us to liability under laws and regulations that protect personal data, including, but not limited to, HIPAA, similar state data protection regulations, and the EU GDPR and UK GDPR, resulting in significant penalties; increased costs; loss of revenue; expenses of computer or forensic investigations; material fines