Company: VRCA
Filing Date: 2025-03-11
Form Type: 10-K
Source: 0000950170-25-037172
Chunk: 129

Company: Verrica Pharmaceuticals Inc.
Filing Date: 2025-03-11
Form: 10-K
Item: Item 1A
Chunk 129
---
; limited ability to develop or commercialize our products; expenditure of time and resources to defend any claim or inquiry; adverse publicity; or substantial changes to our business model or operations.

If our information technology systems or those third parties upon which we rely or our data, are or were compromised or were to encounter computer system failures, we could experience adverse consequences, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences.

In the ordinary course of our business, we and the third parties upon which we rely may process, receive, store, generate, use, secure, or share proprietary, confidential, and sensitive data, including personal data (such as health-related data), intellectual property, trade secrets and other sensitive data.  We take steps designed to detect, mitigate, and remediate vulnerabilities in our information systems (such as our hardware and/or software, including that of third parties upon which we rely). We may not, however, detect and remediate all such vulnerabilities including on a timely basis.  Further, we may experience delays in deploying remedial measures and patches designed to address identified vulnerabilities.

Our internal computer systems, and those of third parties on which we rely, are vulnerable to damage from computer viruses, malware, natural disasters, terrorism, war, telecommunication and electrical failures, cyber-attacks or cyber-intrusions over the Internet, attachments to emails, persons inside our organization, or persons with access to systems inside our organization. Cyberattacks, malicious internet-based activity, and online and offline fraud are prevalent and continue to increase. These threats are becoming increasingly difficult to detect. These threats come from a variety of sources. In addition to traditional computer “hackers,” threat actors, personnel (such as through theft or misuse), sophisticated nation-states, and nation-state-supported actors now engage in attacks.  We and the third parties upon which we rely may be subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through deep fakes (which may be increasingly more difficult to identify as fake) and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks (such as credential stuffing), personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, telecommunications failures, earthquakes, fires