Company: IMCR
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0001671927-25-000006
Chunk: 186

Company: Immunocore Holdings plc
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1A
Chunk 186
---
 threat actors, nation-states, and nation-state-supported actors, are becoming increasingly prevalent and severe and can lead to significant interruptions in our operations, loss of data and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments.

Remote working poses increased risks to our information technology systems and data as some of our personnel work from remote locations and use network connections outside of our control.

Potential business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies. Furthermore, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program.

It may be difficult and/or costly to detect, investigate, mitigate, contain, and remediate a security incident. Our efforts to do so may not be successful. Actions taken by us or the third parties with whom we work to detect, investigate, mitigate, contain, and remediate a security incident could result in outages, data losses, and disruptions of our business. Threat actors may also gain access to other networks and systems after a compromise of our networks and systems. While we have implemented security measures designed to protect our information technology systems and data, there can be no assurance that these measures will be effective. We have not always been able in the past to protect against security breaches (for example, we experienced two minor phishing attacks in 2018 and 2019). We take steps designed to detect, mitigate, and remediate vulnerabilities in our information systems (such as our hardware and/or software, including that of third parties upon which we rely). We may not, however, detect and remediate all such vulnerabilities including on a timely basis. Further, we may experience delays in developing and deploying remedial measures and patches designed to address identified vulnerabilities. Vulnerabilities could be exploited and result in a security incident.

98

Table of Contents

Any of the previously identified or similar threats could cause a security breach or other interruption. A security breach or other interruption could result in unauthorized, unlawful or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to data. A security breach or other interruption could disrupt our ability (and that of third parties upon whom we rely