Company: BLLN
Filing Date: 2025-06-20
Form Type: DRS
Source: 0000950123-25-006095
Chunk: 39

Company: BillionToOne, Inc.
Filing Date: 2025-06-20
Form: DRS
Chunk 39
---
, inappropriate modification and our being unable to adequately monitor, audit or
modify our controls over such critical information. This risk extends to

28

the third-party providers, strategic partners and other contractors, subcontractors or consultants we use to manage this sensitive data or otherwise process it on our behalf.

Cyberattacks, security breaches, computer viruses, malicious internet-based activity, online and offline fraud, ransomware attacks, phishing, structured query language
injections, social engineering schemes, distributed denial-of-service attacks, supply chain attacks, malware and other incidents, as well as employee theft or misuse,
human error, fraud, denial or degradation of service attacks, unauthorized access or use by persons inside our organization or persons with access to systems inside our organization, and other similar activities threaten the confidentiality,
integrity, and availability of our sensitive information and information technology systems, and those of the third parties with whom we work. Misappropriation, exposure, loss or other unauthorized disclosure of confidential data, personal
information, materials or information, as well as interruptions, delays or cessation of service often result from these events. Increasingly complex methods have been used in cyberattacks, and the number, intensity and sophistication of attempted
attacks and intrusions from around the world have increased and come from a variety of sources, including traditional computer “hackers,” threat actors, “hacktivists,” organized criminal threat actors, personnel (such as through
theft or misuse), sophisticated nation states, and nation-state-supported actors. Because the techniques used to obtain unauthorized access to, or to sabotage, systems change frequently and often are not recognized until launched against a target,
we may be unable to anticipate these techniques or implement adequate preventative measures. We may experience security breaches that may remain undetected for an extended period. Even if identified, we may be unable to adequately investigate or
remediate incidents or breaches.

The costs of attempting to protect against the foregoing risks and responding to a cyberattack are significant. Breaches of our
and/or our vendors’ security measures and the unauthorized dissemination of sensitive personal information or proprietary or confidential information about us, our customers or other third-parties, could result in investigations, regulatory
enforcement actions, notices to affected individuals, regulators and the media, material fines and penalties, loss of customers, litigation or other actions which could have a material adverse effect on our business, prospects, reputation, results
of operations and financial condition. Breaches and incidents also cause operational harm such as by preventing us from performing our laboratory operations,