Company: RPID
Filing Date: 2025-05-09
Form Type: 10-Q
Source: 0001380106-25-000102
Chunk: 97

Company: RAPID MICRO BIOSYSTEMS, INC.
Filing Date: 2025-05-09
Form: 10-Q
Item: Part I, Item 3
Chunk 97
---
 information technology and infrastructure may still be vulnerable to, and we have in the past experienced and may continue to experience in the future, attacks by hackers or viruses or data breaches due to employee error, malfeasance or other 

51

Table of Contents

malicious or inadvertent disruptions. Further, attacks upon information technology systems, including ransomware attacks and digital extortion, business email compromises, social engineering, including phishing attacks, denial of service attacks, computer malware, malicious codes, viruses, wrongful intrusions, wrongful conduct by insider employees or vendors, data breaches, and other malicious internet-based activity are increasing in their frequency, levels of persistence, sophistication and intensity, and are being conducted by sophisticated and organized groups and individuals with a wide range of motives, capabilities, and expertise. We may also face increased cybersecurity risks due to our reliance on internet technology and the number of our employees who are working remotely, which may create additional opportunities for cybercriminals to exploit vulnerabilities. Furthermore, because the techniques used to obtain unauthorized access to, or to sabotage, systems change frequently and often are not recognized until launched against a victim entity, we may be unable to anticipate these techniques or implement adequate preventative measures. While we have measures in place to identify, detect and mitigate security threats and incidents, they are not failproof, so we may also experience security incidents that may remain undetected for an extended period. Any such incident could result in the compromise of our information systems, and the data stored there could be accessed, encrypted, corrupted, modified, publicly disclosed, lost or stolen. Any such incident could result in legal notifications and/or disclosures, as well as legal claims or proceedings, including for breaches of confidential information obligations with contractual counterparties, and liability under federal or state laws that protect the privacy of personal information, and regulatory penalties. Notice of cybersecurity incidents and data breaches may be required to affected individuals, customers, or other state, federal or foreign regulators, and for extensive breaches, notice may need to be made to the media or State Attorneys General. Such a notice could harm our reputation and our ability to compete. Although we have implemented security measures to prevent, detect and respond to security incidents, our data is currently accessible through multiple channels, and there is no guarantee we can protect our data from breach. Unauthorized access to our information systems, and the loss, destruction or, dissemination of data stored within them could also disrupt or halt our operations and damage our reputation, any of which could adversely affect our business.

Further, our contracts may not contain limitations of