Company: DARE
Filing Date: 2025-04-24
Form Type: ARS
Source: 0001401914-25-000018
Chunk: 209

Company: Dare Bioscience, Inc.
Filing Date: 2025-04-24
Form: ARS
Chunk 209
---
 unauthorized access to an employee’s email account by a third-party impersonator and resulted in an electronic payment of approximately $0.4 million intended for a vendor being fraudulently misdirected to unknown parties. We retained a third party to assist in our investigation of the incident and implementation of remedial measures, including enhancements to our controls relating to electronic payments to third parties. Approximately $0.2 million of the fraud loss was covered by insurance. We do not believe this incident had or will have a material impact on our business, financial condition or results of operations. However, cyber-related criminal activities continue to evolve and increase in frequency and sophistication, including as a result of advancements in generative artificial intelligence technology, and our security measures and controls may not be successful in preventing further cyber- related crimes. Despite implementing security measures, any of the information technology systems belonging to us or our collaborators and third-party service providers, including our CMOs and CROs for our clinical studies, and the sensitive and confidential information contained within them are vulnerable to damage or interruption from computer viruses and other malware, unauthorized access, including as a result of employee error (e.g., phishing or spoofing scams) or malfeasance, service interruptions, system malfunctions, natural disasters, terrorism, war, and telecommunication and electrical failure. We rely on third-party service providers and technologies for our data processing-related activities, including without limitation third-party providers of cloud-based infrastructure, encryption and authentication technology, employee email, and other functions. We rely on these third parties to implement effective security measures and identify and correct for any such failures, deficiencies or breaches. However, our ability to monitor these third parties' cybersecurity practices is limited, and these third parties may not have adequate security measures in place. In addition, we do not have our own information technology department or personnel and rely on third-party information technology consultants to assist our management in assessing, identifying and managing our cybersecurity risks. We do not control these third parties and they may fail to perform as expected. Moreover, the shift to remote working arrangements and the prevalent use of mobile devices that access sensitive or confidential information increases the risk of data security breaches. Technology security systems and other security measures in employees’ homes or other places they may work may not be as robust and more vulnerable to cybersecurity attacks. Any system failure, accident, security breach or data breach that causes interruptions in our own or in third-party collaborators’ or service providers’ operations could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss,