Company: KROS
Filing Date: 2025-05-06
Form Type: 10-Q
Source: 0001664710-25-000046
Chunk: 409

Company: Keros Therapeutics, Inc.
Filing Date: 2025-05-06
Form: 10-Q
Item: Item 4
Chunk 409
---
; diversion of management attention; interruptions in our operations (including availability of data); financial loss; and other similar harms. Security incidents and attendant consequences may prevent or cause individuals to stop conducting business with us or negatively impact our ability to grow and operate our business. For example, the loss of preclinical or clinical data could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. Any security incident affecting us, our current and future CROs, collaborators, contractors, consultants or other partners or our industry, whether 

72

real or perceived, could harm our reputation, erode confidence in the effectiveness of our security measures and lead to regulatory scrutiny. Likewise, we use third parties for the manufacture of our product candidates and to conduct clinical trials, and similar events relating to their computer systems could also have a material adverse effect on our business. To the extent that any disruption or security incident were to result in a loss of, or damage to, our data or applications, or inappropriate disclosure of confidential or proprietary information, we could face governmental reporting obligations, fines, incur liability and the further development and commercialization of our product candidates could be delayed.

Furthermore, applicable data privacy and security obligations may require us, or we may voluntarily choose, to notify relevant stakeholders, including affected individuals, customers, regulators, and investors, of security incidents, or to take other actions, such as providing credit monitoring and identity theft protection services. Most jurisdictions have enacted laws requiring companies to notify individuals, regulatory authorities, and others of security incidents involving certain types of data. In addition, our agreements with collaborators may require us to notify them in the event of a security incident. Such mandatory disclosures and related actions can be costly, and the disclosure or the failure to comply with such applicable requirements could lead to adverse consequences such as negative publicity, may cause our collaborators to lose confidence in the effectiveness of our security measures and require us to expend significant capital and other resources to respond to and/or alleviate problems caused by the actual or perceived security incident.

In addition, any actual or perceived security incident could result in legal claims or proceedings, regulatory investigations or actions, and other types of liability under laws that protect the privacy and security of personal information, including federal, state and foreign data protection and privacy regulations, violations of which could result in significant penalties and fines in the EU, UK and United States notably. In addition, security incidents and other incidents of unauthorized access to our information technology systems and data can be difficult to detect and any delay in identifying such breaches