Company: AGIO
Filing Date: 2025-05-01
Form Type: 10-Q
Source: 0001439222-25-000036
Chunk: 257

Company: AGIOS PHARMACEUTICALS, INC.
Filing Date: 2025-05-01
Form: 10-Q
Item: Part I, Item 4
Chunk 257
---
 or business partners, or from cyber incidents by malicious third parties. Cybersecurity incidents are increasing in their frequency, sophistication and intensity, and have become increasingly difficult to detect. Cybersecurity incidents could include the deployment of harmful malware, ransomware, denial-of-service attacks, unauthorized access to or deletion of files, social engineering and other means to affect service reliability and threaten the confidentiality, integrity and availability of information. Cybersecurity incidents also could include phishing attempts or e-mail fraud to cause payments or information to be transmitted to an unintended recipient. Attackers may use artificial intelligence and machine learning to launch more automated, targeted and coordinated attacks against targets. We could be subject to risks caused by misappropriation, misuse, leakage, falsification or intentional or accidental release or loss of information maintained in the information systems and networks of our company, including personal information of our employees. We may not be able to anticipate all types of security threats, and we may not be able to implement preventive measures effective against all such security threats. The techniques used by cyber criminals change frequently, may not be recognized until launched, and can originate from a wide 

36

variety of sources, including outside groups such as external service providers, organized crime affiliates, terrorist organizations or hostile foreign governments or agencies.

System failures, accidents, cybersecurity incidents or security breaches could cause interruptions in our operations, and could result in a material disruption of our clinical and commercialization activities and business operations, whether due to a loss of our trade secrets or other proprietary information or other similar disruptions, in addition to possibly requiring substantial expenditures of resources to remedy. For example, the loss of clinical trial data from completed or future trials could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. To the extent that any disruption or security breach were to result in a loss of, or damage to, our data or applications, or inappropriate disclosure of confidential or proprietary information, we could incur liability, our competitive position could be harmed and our product research, development and commercialization efforts could be delayed. In addition, we may not have adequate insurance coverage to provide compensation for any losses associated with such events.

If a material breach of our security or that of our vendors occurs, the market perception of the effectiveness of our security measures could be harmed, and, as a result, we could lose business and our reputation and credibility could be damaged. We could be required to expend significant amounts of money and other resources to repair or replace information systems or networks. Although we develop and maintain processes, systems