Company: ACHV
Filing Date: 2025-03-11
Form Type: 10-K
Source: 0000950170-25-036831
Chunk: 69

Company: ACHIEVE LIFE SCIENCES, INC.
Filing Date: 2025-03-11
Form: 10-K
Item: Item 1A
Chunk 69
---
 fail or suffer security breaches and cyber-attacks, which could result in a material disruption of our development programs.

We believe that we take reasonable steps that are designed to protect the security, integrity and confidentiality of the information we collect, use, store, and disclose, but inadvertent or unauthorized data access may occur despite our efforts. Our system protections may be ineffective or inadequate, or we could be impacted by software bugs or other technical malfunctions, as well as employee error or malfeasance. Additionally, privacy and data protection laws are evolving, and it is possible that these laws may be interpreted and applied in a manner that is inconsistent with our data handling safeguards and practices that could result in fines, lawsuits, and other penalties, and significant changes to our or our third-party collaborators or service providers business practices and products and service offerings. To the extent that the measures we or our third-party collaborators or service providers have taken prove to be insufficient or inadequate, we may become subject to litigation, breach notification obligations, or regulatory or administrative sanctions, which could result in significant fines, penalties, damages, harm to our reputation, or loss of customers. While we have not experienced any material losses as a result of any system failure, accident or security breach to date, we have been the subject of certain phishing attempts in the past. If such an event were to occur and cause interruptions in our operations, it could result in a material disruption of our development programs and our business operations, whether due to a loss of our trade secrets or other proprietary information or other similar disruptions. Additionally, a party who circumvents our security measures could, among other 

34

effects, appropriate patient information or other proprietary data, cause interruptions in our operations, or expose our collaborators to hacks, viruses, and other disruptions. For example, the loss of clinical trial data from completed or future clinical trials could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. In addition, insurance coverage to compensate for any losses associated with such events, if available, may not be adequate to cover all potential losses. The development and maintenance of these systems, controls and processes is costly and requires ongoing monitoring and updating as technologies change and efforts to overcome security measures become increasingly sophisticated.

To the extent that any disruption, security breach, or cyber-attack were to result in a loss of, or damage to, our data or applications, or inappropriate disclosure of personal, confidential or proprietary information, we could incur liability, our competitive position could be harmed and the further development