Company: PHAT
Filing Date: 2025-03-06
Form Type: 10-K
Source: 0000950170-25-034183
Chunk: 188

Company: Phathom Pharmaceuticals, Inc.
Filing Date: 2025-03-06
Form: 10-K
Item: Item 1A
Chunk 188
---
 distribution, use, security, and storage of personally identifiable information and other data relating to individuals, and federal and state consumer protection laws are being applied to enforce regulations related to the online collection, use, and dissemination of data. Despite the implementation of cybersecurity measures, our internal information systems and those of our current and any future CROs, contract manufacturers, and other service providers, contractors, consultants and collaborators are 

80

vulnerable to numerous and evolving cybersecurity risks that threaten the confidentiality, integrity and availability of our information systems and confidential information, including from diverse threat actors, such as state-sponsored organizations, opportunistic hackers and hacktivists, as well as through diverse attack vectors, such as social engineering/phishing, malware (including ransomware), malfeasance by insiders, human or technological error, and as a result of malicious code embedded in open-source software, or misconfigurations, 'bugs' or other vulnerabilities in commercial software that is integrated into our (or our suppliers’ or service providers’) IT systems, products or services, alongside damage from natural disasters, terrorism, war and telecommunication and electrical failures. Attacks upon information technology systems are increasing in their frequency, levels of persistence, sophistication and intensity, and are being conducted by sophisticated and organized groups and individuals with a wide range of motives, expertise, technique and tools – including artificial intelligence – to circumvent security controls, evade detection and remove forensic evidence. For example, on February 22, 2024, UnitedHealth Group, or UHG, disclosed that a suspected nation-state associated cyber security threat actor had gained access to some of the information technology systems at Change Healthcare, one of UHG’s affiliates that provides numerous services to the healthcare industry such as payment systems, claims submission, benefits verification, and prior authorization. This breach, among other things, disrupted the processing of transactions under our patient co-pay assistance card program, and the ability of certain pharmacies to fill prescriptions, including prescriptions for VOQUEZNA for a period of time. As a result, we were forced to make alternative arrangements in order to facilitate processing of patient co-pay assistance card program transactions. While the Change Healthcare-related disruption were limited in time, a similar incident in the future with Change Healthcare or other service providers could have a material adverse effect on our business and financial condition.

We also face increased cybersecurity risks due to our reliance on internet technology and the increased number of our employees (and employees of our vendors, contractors and other organizations with whom we have formed strategic relationships) who are working remotely, which may