Company: MIRM
Filing Date: 2025-11-04
Form Type: 10-Q
Source: 0001759425-25-000054
Chunk: 105

Company: Mirum Pharmaceuticals, Inc.
Filing Date: 2025-11-04
Form: 10-Q
Item: Part I, Item 3
Chunk 105
---
 exploited and result in a security incident.

Certain of the previously identified or similar threats have in the past and could in the future cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our sensitive information or our information technology systems, or those of the third parties with whom we work. For example, in February through March of 2024, along with many others in our industry, we became aware of a security incident at Change Healthcare which impacted the ability of patient claims to be adjudicated and patient prescriptions to be filled. Our internal team had to work closely with our specialty pharmacy and logistic providers to assess and resolve the matter. A security incident or other interruption could disrupt our ability (and that of third parties with whom we work) to provide our approved medicines and services.

We may expend significant resources or modify our business activities (including our clinical trial activities) to try to protect against security incidents. Certain data privacy and security obligations require us to implement and maintain specific security measures, industry-standard or reasonable security measures to protect our information technology systems and sensitive information. Applicable data privacy and security obligations may require us, or we may choose, to notify relevant stakeholders, including affected individuals, customers, regulators, and investors, of security incidents, or to take other actions, such as providing credit monitoring and identity theft protection services. Such disclosures and compliance with applicable requirements are costly, and the disclosure or the failure to comply with such requirements could lead to adverse consequences. If a material security incident was to occur, or we (or a third party with whom we work) are perceived to have experienced such an event, we may experience adverse consequences. These consequences may include: government enforcement actions (for example, investigations, fines, penalties, audits, and inspections), additional reporting requirements and/or oversight, restrictions on processing sensitive information (including personal data), litigation (including class claims), indemnification obligations, negative publicity, reputational harm, monetary fund diversions, interruptions in our operations (including availability of data), financial loss, and other similar harms. Security incidents and attendant consequences may negatively impact our ability to grow and operate our business. More specifically, for example, the loss of clinical trial data from completed, ongoing or future clinical trials could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. Security incidents and any unauthorized access or disclosure of our sensitive information could also compromise our intellectual property and patent portfolio, expose