Company: TVRD
Filing Date: 2025-11-13
Form Type: 424B3
Source: 0001104659-25-111336
Chunk: 194

Company: Tvardi Therapeutics, Inc.
Filing Date: 2025-11-13
Form: 424B3
Chunk 194
---
 such as providing credit monitoring and identity theft protection services.
Such disclosures and related actions can be costly, and the disclosure or the failure to comply with such applicable requirements could
lead to adverse consequences.

​

Tvardi takes steps designed to detect, mitigate,
and remediate vulnerabilities in our information systems (such as our hardware and/or software, including that of third parties with whom
it works). Tvardi has not and may not in the future, however, detect and remediate all such vulnerabilities including on a timely basis.
Further, Tvardi has and may in the future experience delays in developing and deploying remedial measures and patches designed to address
identified vulnerabilities.

​

<div align='center'>113</div>

Table of Contents

Although Tvardi develops and maintains systems and
controls designed to prevent these events from occurring and Tvardi has a process to identify and mitigate threats, the development and
maintenance of these systems, controls and processes is costly and requires ongoing monitoring and updating as technologies change and
efforts to overcome security measures become increasingly sophisticated. It may be difficult and/or costly to detect, investigate, mitigate,
contain, and remediate a security incident. Our efforts to do so may not be successful. Actions taken by us or the third parties with
whom we work to detect, investigate, mitigate, contain, and remediate a security incident could result in outages, data losses, and disruptions
of our business. Threat actors may also gain access to other networks and systems after a compromise of our networks and systems. Moreover,
despite Tvardi’s efforts, the possibility of these events occurring cannot be eliminated entirely. As Tvardi outsources more of
its information systems to vendors, and relies more on cloud-based information systems, the related security risks will increase, and
Tvardi will need to expend additional resources to protect its technology and information systems.

​

In addition, there can be no assurance that Tvardi’s
internal information technology systems or those of the third-parties with whom it works, or its consultants’ efforts to implement
adequate security and control measures, will be sufficient to protect Tvardi against breakdowns, service disruption, data deterioration
or loss in the event of a system malfunction, or prevent data from being stolen or corrupted in the event of a cyberattack, security breach,
industrial espionage attacks or insider threat attacks, which could result in financial, legal, business or reputational harm. In addition
to experiencing a security incident, third parties may