Company: PHAT
Filing Date: 2025-03-06
Form Type: 10-K
Source: 0000950170-25-034183
Chunk: 189

Company: Phathom Pharmaceuticals, Inc.
Filing Date: 2025-03-06
Form: 10-K
Item: Item 1A
Chunk 189
---
 create additional opportunities for threat actors to exploit vulnerabilities. Furthermore, because the techniques used to obtain unauthorized access to, or to sabotage, systems change frequently and often are not recognized until launched against a target, we may be unable to anticipate these techniques or implement adequate preventative measures. We may also experience cybersecurity incidents or data breaches that may remain undetected for an extended period. If such an event were to occur and cause interruptions in our operations, result in the unauthorized access to, disclosure, loss, processing or other compromise of, personal information or individually identifiable health information (violating certain privacy laws such as GDPR) or confidential information, or jeopardize the confidentiality, integrity, or availability of our information systems or any information residing therein, it could result in a material disruption of our development programs and our business operations, whether due to a loss of our trade secrets or other similar disruptions. Some of the federal, state and foreign government requirements include obligations of companies to notify individuals of certain cybersecurity breaches involving particular personal information, which could result from breaches experienced by us or by our vendors, contractors, or organizations with which we have formed strategic relationships. Even though we may have contractual protections with such vendors, contractors, or other organizations, notifications and follow-up actions related to a cybersecurity breach could impact our reputation, cause us to incur significant costs, including legal expenses, harm customer confidence, hurt our expansion into new markets, cause us to incur remediation costs, or cause us to lose existing customers. For example, the loss of clinical trial data from completed or future clinical trials could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. We also rely on third parties to manufacture vonoprazan and any future product candidates, and similar events relating to their computer systems could also have a material adverse effect on our business. There can no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our information systems and personal or confidential information. To the extent that any disruption or cybersecurity incident were to jeopardize the confidentiality, integrity, or availability of our information systems, or result in a loss of, or damage to, our data or applications, or inappropriate disclosure of confidential or proprietary information, we could incur liability, the further development and commercialization of vonoprazan and any future product candidates could be delayed, and we could be subject to significant fines, penalties or liabilities for any noncompliance to certain privacy and cybersecurity laws. Further,