Company: BLLN
Filing Date: 2025-12-10
Form Type: 10-Q
Source: 0001628280-25-056321
Chunk: 110

Company: BillionToOne, Inc.
Filing Date: 2025-12-10
Form: 10-Q
Item: Part I, Item 4
Chunk 110
---
collectively, process) proprietary, confidential, and sensitive data, including protected health information (PHI) and other personally identifiable information, credit card and other financial information, intellectual property and proprietary business information owned or controlled by us or other parties such as customers and payors. We manage and maintain our applications and data utilizing a combination of on-site systems and cloud-based data centers. We utilize external security and infrastructure vendors to manage parts of our data centers. Our information technology systems store a wide variety of information critical to our business, including research and development information, patient data, commercial information and business and financial information. We face a number of risks related to protecting this critical information, including loss of access, inappropriate use or disclosure, unauthorized access, inappropriate modification and our being unable to adequately monitor, audit or modify our controls over such critical information. This risk extends to the third-party providers, strategic partners and other contractors, subcontractors or consultants we use to manage this sensitive data or otherwise process it on our behalf.

Cyberattacks, security breaches, computer viruses, malicious internet-based activity, online and offline fraud, ransomware attacks, phishing, structured query language injections, social engineering schemes, distributed denial-of-service attacks, supply chain attacks, malware and other incidents, as well as employee theft or misuse, human error, fraud, denial or degradation of service attacks, unauthorized access or use by persons inside our organization or persons with access to systems inside our organization, and other similar activities threaten the confidentiality, integrity, and availability of our sensitive information and information technology systems, and those of the third parties with whom we work. Misappropriation, exposure, loss or other unauthorized disclosure of confidential data, personal information, materials or information, as well as interruptions, delays or cessation of service often result from these events. Increasingly complex methods have been used in cyberattacks, and the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased and come from a variety of sources, including traditional computer “hackers,” threat actors, “hacktivists,” organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors. Because the techniques used to obtain unauthorized access to, or to sabotage, systems change frequently and often are not recognized until launched against a target, we may be unable to anticipate these techniques or implement adequate preventative measures. We may experience security breaches that may remain undetected for an extended period. Even if identified, we may be unable to adequately investigate or remediate