Company: HRTX
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0000950170-25-028374
Chunk: 78

Company: HERON THERAPEUTICS, INC. /DE/
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1A
Chunk 78
---
 as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks (such as credential stuffing), credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, telecommunications failures, earthquakes, fires, floods, and other similar threats. In particular, severe ransomware attacks are becoming increasingly prevalent and can lead to significant interruptions in our operations, loss of sensitive data and income, reputational harm, and diversion of funds.  Extortion payments may alleviate the negative impact of a ransomware 

48

attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments.  

The increase in remote work has increased risks to our information technology systems and data, as more of our employees utilize network connections, computers, and devices outside our premises or network, including working at home, while in transit and in public locations.  Additionally, future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies.

Further, our reliance on third-party service providers could introduce new cybersecurity risks and vulnerabilities, including supply-chain attacks, and other threats to our business operations.  We may rely on third-party service providers and technologies to operate critical business systems to process sensitive data in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, employee email, and other functions.  We may also rely on third-party service providers to provide other products, services, parts, or otherwise to operate our business.  Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place.  If our third-party service providers experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if our third-party service providers fail to satisfy their data privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award.  In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties’ infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised.

Any of the previously identified or similar threats could cause a security incident or other interruption that