Company: VCYT
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0001384101-25-000014
Chunk: 95

Company: VERACYTE, INC.
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1A
Chunk 95
---
 working remotely, which may create additional opportunities for cybercriminals to exploit vulnerabilities.

While we are not currently aware of any cybersecurity incidents having occurred that has materially affected us, the techniques used in cybersecurity attacks or breaches change frequently and often are not recognized until launched against a target. Consequently, we may experience security breaches that may remain undetected for an extended period. Even if identified, we may be unable to adequately investigate or remediate incidents or breaches due to attackers increasingly using tools and techniques that are designed to circumvent controls, to avoid detection, and to remove or obfuscate forensic evidence. We can provide no assurance that we or our vendors will be able to detect, prevent or contain the effects of such attacks or other information security risks or threats in the future.

If such a cybersecurity event was to occur, our networks could be compromised and the information we store on those networks could potentially be accessed by unauthorized parties, publicly disclosed, lost or stolen. Any such access, disclosure or other loss of information could result in legal claims or proceedings, liability, and penalties under federal, state, and international laws and regulations that protect the privacy and security of personal information, such as the HIPAA regulations and the EU General Data Protection Regulation, or GDPR. See “Risks associated with data privacy issues, including evolving laws, regulations and associated compliance efforts, may adversely impact our business and financial results.” Unauthorized access, loss or dissemination of such data also could disrupt our operations, including our ability to process tests, provide test results, bill payers or patients, process claims and appeals, provide customer assistance services, conduct research and development activities, collect, process, and prepare company financial information, provide information about our tests and other patient and physician education and outreach efforts through our website, and manage the administrative aspects of our business, any of which could adversely affect our business, including by materially damaging our reputation.

Risks associated with data privacy issues, including evolving laws, regulations and associated compliance efforts, may adversely impact our business and financial results.

Legislation in various countries around the world with regard to cybersecurity, privacy and data protection is rapidly expanding and creating a complex compliance environment. We are subject to many federal, state, and foreign laws and regulations, including those related to privacy, rights of publicity, data protection, content regulation, intellectual property, health and safety, competition, protection of minors, consumer protection, employment, and taxation. 

The GDPR applies to our activities conducted from an establishment in the EU or related to products and services that we offer to EU