Company: DVAX
Filing Date: 2025-08-07
Form Type: 10-Q
Source: 0001029142-25-000117
Chunk: 459

Company: DYNAVAX TECHNOLOGIES CORP
Filing Date: 2025-08-07
Form: 10-Q
Item: Part I, Item 2
Chunk 459
---
 a variety of sources, including traditional computer “hackers,” threat actors, “hacktivists,” organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors. 

Ransomware attacks, including by organized criminal threat actors, nation-states, and nation-state-supported actors, are becoming increasingly prevalent and severe and can lead to significant interruptions in our operations, loss of data and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Similarly, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties and infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised or that they do not contain exploitable flaws or bugs that could result in a breach of or disruption to our information technology systems (including our products or the third-party information technology systems that support us and our goods). We rely on third parties to operate critical business systems to process sensitive information in a variety of contexts. Our ability to monitor these third parties’ information security practices is limited, and these third parties may not 

69

have adequate information security measures in place. If our third-party service providers experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if our third-party service providers fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award.

It may be difficult and/or costly to detect, investigate, mitigate, contain, and remediate a security incident. Our efforts to do so may not be successful. Actions taken by us or the third parties with whom we work to detect, investigate, mitigate, contain, and remediate a security incident could result in outages, data losses, and disruptions of our business. Threat actors may also gain access to other networks and systems after a compromise of our networks and systems.

The potential liability and associated consequences we could suffer as a result of any such cyber events could be catastrophic and result in irreparable harm including (a) the loss of trade secrets or other intellectual property, or (b) the public exposure of personally identifiable information (including sensitive personal information) of our employees, collaborators, clinical trial patients, and others, (c) extortion and other monetary damages due to malware or business email