Company: MIRM
Filing Date: 2025-08-06
Form Type: 10-Q
Source: 0001759425-25-000041
Chunk: 652

Company: Mirum Pharmaceuticals, Inc.
Filing Date: 2025-08-06
Form: 10-Q
Item: Part I, Item 2
Chunk 652
---
 in a variety of contexts, including, without limitation, third-party providers of cloud-based infrastructure, encryption and authentication technology, employee communications, and other functions. Likewise, we work with third-party research institution collaborators, CMOs, CROs, other contractors and consultants for many aspects of our business, including research and development activities and manufacturing of our approved medicines and our product candidates, and similar events relating to their computer systems or data could also have a material adverse effect on our business. Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. If the third parties with whom we work experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if the third parties with whom we work fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to 

85

cover our damages, or we may be unable to recover such award. Similarly, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties and infrastructure in our supply chain or the supply chains of the third parties with whom we work have not been compromised.

While we have implemented information security measures designed to protect against security incidents, we cannot assure you that our (or the third parties with whom we work) security measures will be effective. It may be difficult and/or costly to detect, investigate, mitigate, contain, and remediate a security incident. Our efforts to detect, investigate, mitigate, contain, and remediate a security incident may not be successful. Actions taken by us or the third parties with whom we work to detect, investigate, mitigate, contain, and remediate a security incident could result in outages, data losses, and disruptions of our business. Threat actors may also gain access to other networks and systems after a compromise of our networks and systems. We take steps designed to detect, mitigate and remediate vulnerabilities in our information systems (such as our hardware and/or software, including that of third parties with whom we work). We have not and may not in the future, however, be able to detect and remediate all such vulnerabilities, including on a timely basis. Further, we have (and may in the future) experienced delays in developing and deploying remedial measures and patches designed to address identified vulnerabilities. Vulnerabilities could be exploited and result in a security incident.

Certain of the previously identified or similar threats have in the past and could in the future cause a security incident or other interruption that