Dianthus Therapeutics (DNTH) Risk Factors

In the ordinary course of our business, we and the third parties upon which we rely collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, process) proprietary, confidential, and sensitive data, including personal data, intellectual property, trade secrets, and other sensitive data (collectively, sensitive information). Despite the implementation of security measures in an effort to protect systems that store our information, given their size and complexity and the increasing amounts of information maintained on our internal information technology systems and those of our third-party CROs, CDMOs, other contractors (including sites performing our clinical trials), third party service providers and supply chain companies, and consultants, as well as other partners, these systems are potentially vulnerable to breakdown or other damage or interruption from service interruptions, system malfunction, natural disasters, terrorism, war and telecommunication and electrical failures, as well as security breaches from inadvertent or intentional actions by employees, contractors, consultants, business partners and/or other third parties, or from cyber-attacks by malicious third parties, which may compromise system infrastructure or lead to the loss, destruction, alteration or dissemination of, or damage to, data. Some actors now engage and are expected to continue to engage in cyber-attacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we, and the third parties upon which we rely, may be vulnerable to a heightened risk of these attacks, including retaliatory cyber-attacks, that could materially disrupt our systems and operations, supply chain, and ability to produce, sell and distribute our goods and services. In particular, severe ransomware attacks are becoming increasingly prevalent and can lead to significant interruptions in our operations, ability to provide our products or services, loss of sensitive data and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. To the extent that any disruption or security breach were to result in a loss, destruction, unavailability, alteration or dissemination of, or damage to, our data or applications, or for it to be believed or reported that any of these occurred, we could incur liability and reputational damage and the development and commercialization of DNTH103, or other product candidates could be delayed. Further, our insurance policies may not be adequate to compensate us for the potential losses arising from any such disruption in, or failure or security breach of, our systems or third-party systems where information important to our business operations or commercial development is stored. As our employees work remotely and utilize network connections, computers, and devices outside our premises or network, including working at home, while in transit and in public locations, there are risks to our information technology systems and data. Additionally, business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities' systems and technologies. While we have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective. We may be unable in the future to detect vulnerabilities in our information technology systems because such threats and techniques change frequently, are often sophisticated in nature, and may not be detected until after a security incident has occurred. Further, we may experience delays in developing and deploying remedial measures designed to address any such identified vulnerabilities. Applicable data privacy and security obligations may require us to notify relevant stakeholders of security incidents. Such disclosures are costly, and the disclosure or the failure to comply with such requirements could lead to adverse consequences. We rely on third-party service providers and technologies to operate critical business systems to process sensitive information in a variety of contexts. Our ability to monitor these third parties' information security practices is limited, and these third parties may not have adequate information security measures in place. If our third-party service providers experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if our third-party service providers fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties' infrastructure in our supply chain or our third-party partners' supply chains have not been compromised. If we (or a third party upon whom we rely) experience a security incident or are perceived to have experienced a security incident, we may experience adverse consequences, such as government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive information (including personal data); litigation (including class claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; interruptions in our operations (including availability of data); increased investigation and compliance costs; financial loss; and other similar harms. Security incidents and attendant consequences may cause stakeholders (including investors and potential customers) to stop supporting our platform, deter new customers from products, and negatively impact our ability to grow and operate our business. Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our data privacy and security obligations. We cannot be sure that our insurance coverage will be adequate or sufficient to protect us from or to mitigate liabilities arising out of our privacy and security practices or from disruptions in, or failure or security breach of, our systems or third-party systems where information important to our business operations or commercial development is stored, or that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims.