Company: CORT
Filing Date: 2025-11-04
Form Type: 10-Q
Source: 0001628280-25-048841
Chunk: 91

Company: CORCEPT THERAPEUTICS INC
Filing Date: 2025-11-04
Form: 10-Q
Item: Part I, Item 8
Chunk 91
---
 and complying with U.S. and foreign privacy and security laws and regulations is complex and costly as it is rigorous and time intensive and requires significant resources and a review of our technologies, systems and practices, as well as those of any third-party collaborators, service providers, CROs, contractors or consultants that process or transfer personal data collected in the EU. The GDPR and other changes in laws or regulations associated with the enhanced protection of certain types of sensitive data, such as healthcare data or other personal data from our clinical trials, and access to certain data such as the European Health Data Space Regulation, could require us to change our business practices and put in place additional compliance mechanisms, may interrupt or delay our development, regulatory and commercialization activities and increase our cost of doing business, and could lead to government enforcement actions, private litigation and significant fines and penalties against us and could have a material adverse effect on our business, financial condition or results of operations. Similarly, failure to comply with federal and state laws regarding privacy and security of personal data could expose us to fines and penalties under such laws. Even if we are not determined to have violated these laws, government investigations into these issues typically require the expenditure of significant resources and generate negative publicity, which could harm our reputation and our business.

We rely on information technology to conduct our business. A breakdown or breach of our information technology systems or our failure to protect confidential information concerning our business, patients or employees could interrupt the operation of our business and subject us to liability.

We store valuable confidential information relating to our business, patients and employees on our computer networks and on the networks of our vendors. In addition, we rely heavily on internet technology, including video conference, teleconference and file-sharing services, to conduct business. Despite our security measures, our networks and the networks of our vendors are at risk of break-ins, installation of malware or ransomware, denial-of-service attacks, data theft and other forms of malfeasance by persons seeking to commit fraud or theft, which could result in unauthorized access to, and/or misuse of, our clinical data or other confidential information, including confidential information relating to our patients or employees. We may continue to increase our cybersecurity risks, due to our reliance on internet technology and the number of our employees that are working remotely, which may create additional opportunities for cybercriminals to exploit vulnerabilities.

40

We and our vendors have experienced data breaches, theft, “phishing” attacks and other unauthorized access to confidential data and information. There can be no assurance that our cybersecurity systems and processes