Company: TVRD
Filing Date: 2025-02-14
Form Type: S-4/A
Source: 0001104659-25-013053
Chunk: 106

Company: Tvardi Therapeutics, Inc.
Filing Date: 2025-02-14
Form: S-4/A
Chunk 106
---
 attacks have increased in frequency and severity, and Cara cannot guarantee that third parties’ infrastructure in Cara’s supply chain or its third-party partners’ supply chains have not been compromised.

Cybersecurity risks have significantly increased in recent years in part because of the proliferation of new technologies, the use of the internet and telecommunication technologies to conduct financial

<div align='center'>56</div>

TABLE OF CONTENTS

transactions, especially as personnel are working remotely, and the increased sophistication and activities of organized crime, hackers, terrorists, nation-states and other external parties. To the extent that any disruption or cybersecurity breach were to result in a loss of, or damage to, Cara’s data or information systems, or inappropriate disclosure of confidential or proprietary information, Cara could incur liability and reputational damage and, should Cara resume development of its product candidate or any future product candidate, the further development of such product candidates could be delayed.

Some actors now engage and are expected to continue to engage in cyberattacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, Cara, and the third parties upon which Cara relies, may be vulnerable to a heightened risk of these attacks, including retaliatory cyberattacks, that could materially disrupt its systems and operations, supply chain, and ability to produce, sell and distribute Cara’s goods and services. In particular, severe ransomware attacks are becoming increasingly prevalent and can lead to significant interruptions in Cara’s operations, ability to provide its products or services, loss of sensitive data and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but Cara may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments.

Cara and the third parties upon which Cara relies are subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks, credential stuffing, credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, attacks enhanced or facilitated by AI, telecommunications failures, earthquakes, fires, floods, and other similar threats. Additionally, future or past