Company: ERAS
Filing Date: 2025-03-20
Form Type: 10-K
Source: 0000950170-25-042682
Chunk: 196

Company: Erasca, Inc.
Filing Date: 2025-03-20
Form: 10-K
Item: Item 1A
Chunk 196
---
 if those products may have caused or contributed to those adverse events. The timing of our obligation to report would be triggered by the date we become aware of the adverse event as well as the nature of the event. We and any of our potential future collaborators or CROs may fail to report adverse events within the prescribed timeframe. If we or any of our potential future collaborators or CROs fail to comply with such reporting obligations, the FDA or a foreign regulatory authority could take action, including criminal prosecution, the imposition of civil monetary penalties, seizure of our products or delay in approval or clearance of future products.

Our information technology systems, or those of any of our CROs, manufacturers, other contractors or consultants or current or potential future collaborators, may fail or suffer cybersecurity incidents or breaches, which could result in a material disruption of our product development programs, harm to our reputation, significant fines, penalties and liability and loss of customers or sales.

In the ordinary course of business, we collect, store, transmit and otherwise process large amounts of data including, without limitation, proprietary business information and personal information. Despite the implementation of security measures, our information technology systems (including infrastructure) and those of our current and any future CROs and other contractors, consultants, third-party service providers, vendors and collaborators are vulnerable to numerous and evolving cybersecurity risks, including from diverse threat actors such as state-sponsored organizations, opportunistic hackers and hacktivists, as well as through diverse attack vectors (such as denial-of-service attacks, malware, ransomware, supply chain attacks, computer viruses, cyber-attacks or cyber-intrusions over the Internet, hacking, phishing and other social engineering attacks), and as a result of malicious code, misconfigurations, 'bugs' or other vulnerabilities in software that is integrated into our (or our suppliers’ or service providers’) IT systems, products or services, alongside damage from natural disasters, terrorism, war and telecommunication and electrical failures. Our systems are also subject to compromise from internal threats, such as theft, misuse, unauthorized access or other improper or accidental actions by employees, vendors and other third parties with otherwise legitimate access to our 

85

systems. Third parties may also attempt to fraudulently induce our employees and contractors into disclosing sensitive information such as usernames, passwords or other information, or otherwise compromise the security of our electronic systems, networks, and/or physical facilities in order to gain access to our data. Attacks upon information technology systems are increasing in their frequency, levels of persistence, sophistication and intensity, and