Company: ATRA
Filing Date: 2025-03-07
Form Type: 10-K
Source: 0000950170-25-035507
Chunk: 154

Company: Atara Biotherapeutics, Inc.
Filing Date: 2025-03-07
Form: 10-K
Item: Item 1A
Chunk 154
---
 and financial exposure and reputational damages that could potentially have an adverse effect on our business.  For example, in November 2023, we experienced a cybersecurity incident which resulted in unauthorized access of certain systems within our IT environment and a third party obtaining certain of our documents. Such unauthorized access was detected and contained within several hours and it was determined the third party did not access any of our material confidential information. Following such incident, we’ve taken additional measures to strengthen our IT environment. 

Although we take measures to protect sensitive data from unauthorized access, use or disclosure, our information technology and infrastructure may be vulnerable to attacks by hackers or viruses or breached due to personnel error, malfeasance, or other malicious or inadvertent disruptions. Any such breach or interruption could compromise our networks and the information stored there could be accessed by unauthorized parties, manipulated, publicly disclosed, lost, or stolen. 

Any such access, breach, or other loss of information could result in legal claims or proceedings, liability under domestic or foreign privacy, data protection and data security laws such as HIPAA and HITECH, and penalties. Notice of certain security breaches must be made to affected individuals, the Secretary of HHS, and for extensive breaches, notice may need to be made to the media or state attorneys general. Such notice could harm our reputation and our ability to compete. Although we have implemented security measures, such data is currently accessible through multiple channels, and there is no guarantee we can protect our data from breach. Unauthorized access, loss or dissemination could also damage our reputation or disrupt our operations, including our ability to conduct our analyses, conduct research and development activities, collect, process and prepare company financial information, and manage the administrative aspects of our business.

Penalties for violations of these laws vary. For instance, penalties for failure to comply with a requirement of HIPAA and HITECH vary significantly, and include significant civil monetary penalties and, in certain circumstances, criminal penalties with fines up to $250,000 per violation and/or imprisonment. A person who knowingly obtains or discloses individually identifiable health information in violation of HIPAA may face a criminal penalty of up to $50,000 and up to one-year imprisonment. The criminal penalties increase if the wrongful conduct involves false pretenses or the intent to sell, transfer or use identifiable health information for commercial advantage, personal gain or malicious harm.

77

Further, various states, such as California and Massachusetts, have implemented similar privacy laws and regulations, such as the California Confidentiality of Medical Information Act, that impose restrictive