Company: SION
Filing Date: 2025-08-11
Form Type: 10-Q
Source: 0002036042-25-000047
Chunk: 278

Company: Sionna Therapeutics, Inc.
Filing Date: 2025-08-11
Form: 10-Q
Item: Part II, Item 1A
Chunk 278
---
 adverse consequences.

We may not be able to detect and remediate vulnerabilities in our information technology systems because the threats and techniques used to exploit vulnerabilities change frequently and are often sophisticated in nature. Therefore, such vulnerabilities could be exploited but may not be detected until after a security incident has occurred. Such vulnerabilities could pose material risks to our business. Further, we may experience delays in developing and deploying remedial measures designed to address any such identified vulnerabilities. It is not possible to prevent all threats to our information technology systems and those of our third-party service providers, over which we exert less control, and any controls we implement to do so may prove to be ineffective.

If we (or a third party upon whom we rely) experience a security incident or are perceived to have experienced a security incident, we may experience adverse consequences, such as government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive information (including personal data); litigation (including class claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; interruptions in our operations (including availability of data); financial loss; and other similar harms. Security incidents and attendant consequences may cause delays or disruptions in our clinical trials and development of product candidates, deter customers from using our products, and negatively impact our ability to grow and operate our business.

Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages or claims related to our data privacy and security obligations. We cannot be sure that our insurance coverage will 

77

be adequate or sufficient to protect us from or to mitigate liabilities arising out of our privacy and security practices, that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims. In addition to adverse impacts relating to experiencing a security incident, third parties may gather, collect or infer sensitive information about us from public sources, data brokers or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position.

We are subject to stringent and evolving U.S. laws and regulations and foreign laws, regulations, rules, contractual obligations, policies and other obligations related to data privacy and security. Our actual or perceived failure to comply with such obligations could lead to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations, reputational harm, loss of revenue or