Company: MIRM
Filing Date: 2025-05-07
Form Type: 10-Q
Source: 0001759425-25-000032
Chunk: 317

Company: Mirum Pharmaceuticals, Inc.
Filing Date: 2025-05-07
Form: 10-Q
Item: Part II, Item 1A
Chunk 317
---
 It may be difficult and/or costly to detect, investigate, mitigate, contain, and remediate a security incident. Our efforts to detect, investigate, mitigate, contain, and remediate a security incident may not be successful. Actions taken by us or the third parties with whom we work to detect, investigate, mitigate, contain, and remediate a security incident could result in outages, data losses, and disruptions of our business. Threat actors may also gain access to other networks and systems after a compromise of our networks and systems. We take steps designed to detect, mitigate and remediate vulnerabilities in our information systems (such as our hardware and/or software, including that of third parties with whom we work). We have not and may not in the future, however, be able to detect and remediate all such vulnerabilities, including on a timely basis. Further, we have (and may in the future) experienced delays in developing and deploying remedial measures and patches designed to address identified vulnerabilities. Vulnerabilities could be exploited and result in a security incident.

Certain of the previously identified or similar threats have in the past and could in the future cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our sensitive information or our information technology systems, or those of the third parties with whom we work. For example, in February through March of 2024, along with many others in our industry, we became aware of a security incident at Change Healthcare which impacted the ability of patient claims to be adjudicated and patient prescriptions to be filled. Our internal team had to work closely with our specialty pharmacy and logistic providers to assess and resolve the matter. A security incident or other interruption could disrupt our ability (and that of third parties with whom we work) to provide our approved medicines and services.

We may expend significant resources or modify our business activities (including our clinical trial activities) to try to protect against security incidents. Certain data privacy and security obligations require us to implement and maintain specific security measures, industry-standard or reasonable security measures to protect our information technology systems and sensitive information. Applicable data privacy and security obligations may require us, or we may choose, to notify relevant stakeholders, including affected individuals, customers, regulators, and investors, of security incidents, or to take other actions, such as providing credit monitoring and identity theft protection services. Such disclosures and compliance with applicable requirements are costly, and the disclosure or the failure to comply with such requirements