Company: BLLN
Filing Date: 2025-12-10
Form Type: 10-Q
Source: 0001628280-25-056321
Chunk: 21

Company: BillionToOne, Inc.
Filing Date: 2025-12-10
Form: 10-Q
Item: Part I, Item 3
Chunk 21
---
 may be unable to adequately investigate or remediate incidents or breaches.

The costs of attempting to protect against the foregoing risks and responding to a cyberattack are significant. Breaches of our and/or our vendors’ security measures and the unauthorized dissemination of sensitive personal information or proprietary or confidential information about us, our customers or other third-parties, could result in investigations, regulatory enforcement actions, notices to affected individuals, regulators and the media, material fines and penalties, loss of customers, litigation or other actions which could have a material adverse effect on our business, prospects, reputation, results of operations and financial condition. Breaches and incidents also cause operational harm such as by preventing us from performing our laboratory operations, preparing and providing reports to customers, billing payors, processing reimbursement appeals, handling patient or physician inquiries, conducting research and development activities and managing the administrative aspects of our business.

We and certain of our service providers are from time to time subject to cyberattacks and security incidents. Although we have implemented security measures and an enterprise security program to prevent unauthorized access to our systems, information and patient data, there is no assurance that these measures will be effective. As cyber threats evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities, and these efforts may not be successful.

We have contingency plans and insurance coverage for certain potential claims, liabilities and costs relating to security incidents that may arise from our business or operations; however, the coverage may not be sufficient to cover all claims, liabilities and costs arising from the incidents, including fines and penalties. Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our data privacy and security obligations. The ultimate resolution of any such incidents or estimating the amounts or ranges of potential loss, if any, that could result therefrom are highly uncertain. If we cannot successfully resolve a security incident or contain any potential loss, it could materially impact our ability to operate our business as well as our results of operations and financial position.

58

If we experience a significant disruption in our information technology systems, or those of third-parties upon which we rely, our business operations and financial condition could be adversely affected.

Our IT and communications systems support a variety of functions, including sample processing, tracking, quality control, customer service and support, billing, research and development activities, and various general and administrative activities