Company: ZLAB
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0001628280-25-008409
Chunk: 178

Company: Zai Lab Ltd
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1A
Chunk 178
---
 we have implemented may not provide effective security. Our internal computer systems, software, devices, and networks – and those of our CROs, CMOs, and other third-party providers – may be vulnerable to cyberattacks and other cybersecurity incidents, business or supply chain disruptions, or other attempts to harm our business or reputation or misuse or steal information (including personal information). We routinely identify cybersecurity threats as well as vulnerabilities in our system and work to address them, but these efforts may be insufficient. Outside parties may attempt to induce employees, third-party partners, vendors, service providers, or other users of our systems or networks to disclose confidential, proprietary, or other information (including personal information) in order to gain access to our systems and networks and the information they contain. Unauthorized access or disclosure, or breaches of our security, also may result from human error. We may not be able to anticipate, prevent, detect, recognize, or react to threats to our systems, networks, and assets, or implement effective preventative measures against cyberattacks or other security incidents, especially because the techniques used change frequently or are not recognized until launched. 

A cyberattack or other cybersecurity incident could occur and persist for an extended period of time without detection. We expect that any investigation of such an incident would take time, during which we would not necessarily know the extent of the harm or how best to remediate it. Although we have not experienced any such incident resulting in a material impact to the company to date, our cybersecurity risk management program may not prevent such an incident from having a material impact in the future. We have obtained insurance coverage relating to cybersecurity risks, but this insurance may not be sufficient to provide adequate loss coverage (including if the insurer denies future claims) and may not continue to be available to us on economically reasonable terms, or at all. Further, any limitations of liability provisions in our agreements with vendors, customers, and other third parties with which we do business may not be enforceable or adequate or otherwise protect us from any liabilities or damages with respect to any particular claim in connection with a cyberattack or other security incident of a third party on which we rely.

The occurrence of one or more cyberattacks or other cybersecurity incidents could result in the unauthorized disclosure, misuse, or corruption of confidential, proprietary, and other information (including personal and other information about our employees and patients and company and vendor confidential data) or could otherwise cause interruptions or malfunctions in our operations or the operations of our partners, customers, vendors, and other third parties with which we