Company: VRCA
Filing Date: 2025-03-11
Form Type: 10-K
Source: 0000950170-25-037172
Chunk: 130

Company: Verrica Pharmaceuticals Inc.
Filing Date: 2025-03-11
Form: 10-K
Item: Item 1A
Chunk 130
---
, floods, and other similar threats.

We rely on third-party service providers and technologies to operate critical business systems to process sensitive information in a variety of contexts. We may also rely on third-party service providers to provide other products, services, parts, or otherwise to operate our business. Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. If our third-party service providers experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if our third-party service providers fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties’ infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised.

Any of the foregoing could result in a material disruption of our clinical and product development activities and business operations, in addition to possibly requiring substantial expenditures of resources to remedy. For example, the loss or compromise of clinical trial data from completed or ongoing clinical trials could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. To the extent that any disruption or security incident was to result in a loss or damage to our data or applications, or inappropriate disclosure of confidential or proprietary information, we could incur significant unexpected losses, expenses and liabilities, such as government enforcement actions (for example, investigations, fines, penalties, audits, and 

72

inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive information (including personal data); litigation (including class claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; diversion of management attention; interruptions in our operations (including availability of data); financial loss; and other similar harms and the further development of our product candidates could be delayed.  Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our data privacy and security obligations. We cannot be sure that our insurance coverage will be adequate or sufficient to protect us from or to mitigate liabilities arising out of our privacy and security practices, that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims.

Unfavorable conditions, including inflationary