Company: KROS
Filing Date: 2025-11-05
Form Type: 10-Q
Source: 0001664710-25-000089
Chunk: 400

Company: Keros Therapeutics, Inc.
Filing Date: 2025-11-05
Form: 10-Q
Item: Item 8
Chunk 400
---
 protection services. Most jurisdictions have enacted laws requiring companies to notify individuals, regulatory authorities, and others of security incidents involving certain types of data. In addition, our agreements with collaborators may require us to notify them in the event of a security incident. Such mandatory disclosures and related actions can be costly, and the disclosure or the failure to comply with such applicable requirements could lead to adverse consequences such as negative publicity, may cause our collaborators to lose confidence in the effectiveness of our security measures and require us to expend significant capital and other resources to respond to and/or alleviate problems caused by the actual or perceived security incident.

In addition, any actual or perceived security incident could result in legal claims or proceedings, regulatory investigations or actions, and other types of liability under laws that protect the privacy and security of personal information, including federal, state and foreign data protection and privacy regulations, violations of which could result in significant penalties and fines in the EU, UK and United States notably. In addition, security incidents and other incidents of unauthorized access to our information technology systems and data can be difficult to detect and any delay in identifying such breaches or incidents may lead to increased harm and legal exposure of the type described above.

Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our data privacy and security obligations. We cannot be sure that our insurance coverage will be adequate or sufficient to protect us from or to mitigate liabilities arising out of our privacy and security practices, that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims. The successful assertion of one or more large claims against us that exceeds our available insurance coverage, or results in changes to our insurance policies (including premium increases or the imposition of large deductible or co-insurance requirements), could have an adverse effect on our business. In addition to experiencing a security incident, third parties may gather, collect or infer sensitive information about us from public sources, data brokers or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position.

We and the third parties with whom we work are subject to stringent and evolving U.S. and foreign laws, regulations and rules, contractual obligations, industry standards, policies and other obligations related to data privacy and security. Our (or the third parties with whom we work) actual or perceived failure to comply with such obligations could lead to government enforcement actions