Immunovant (IMVT) Risk Factors

In the ordinary course of our business, we collect, Process and store proprietary, confidential and sensitive information, including personal information (including health information), intellectual property, trade secrets and proprietary business information owned or controlled by ourselves or other parties ("Sensitive Information"). We may use third-party service providers and subprocessors to help us operate our business and engage in Processing on our behalf, such as RSL and its affiliates, our CROs and other contractors. We may also share Sensitive Information with our affiliates or other third parties in conjunction with our business. If we, our service providers, affiliates or other relevant third parties have experienced, or in the future experience, any security incident(s) that result in any accidental or unlawful data loss, deletion or destruction, unauthorized access to, loss of, unauthorized acquisition or disclosure of or inadvertent exposure or disclosure of Sensitive Information, or compromise related to the security, confidentiality, integrity or availability of our (or their) information technology, software, services, communications or data (collectively a "Security Breach"), it may result in a material adverse effect on our business, including without limitation, disruptions of our drug development programs, delays in our regulatory approval efforts, regulatory investigations or enforcement actions, litigation, indemnity obligations, negative publicity and financial loss. Cyberattacks, malicious internet-based activity and online and offline fraud threaten the confidentiality, integrity, and availability of our sensitive information and information technology systems, and those of the third parties upon which we rely. Such threats are prevalent and continue to rise, are increasingly difficult to detect, and come from a variety of sources, including traditional computer "hackers," threat actors, "hacktivists", organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation-state and nation-state-supported actors. Some actors now engage and are expected to continue to engage in attacks, including without limitation, nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we and the third parties upon which we rely may be vulnerable to a heightened risk of these attacks, including retaliatory cyber-attacks, that could materially disrupt our systems and operations, supply chain, and ability to produce, sell and distribute our goods and services. We and the third parties upon which we work (including our CROs and trial sites) are subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), software bugs, malicious code (such as viruses and worms), employee theft or misuse, supply chain attacks, denial-of-service attacks (such as credential stuffing) and ransomware attacks, phishing attacks, viruses, malware installation (including as a result of advanced persistent threat intrusions), server malfunction, software or hardware failures, loss of data or other computer assets, adware or other similar issues. In particular, severe ransomware attacks are becoming increasingly prevalent and can lead to significant interruptions in our operations, loss of sensitive data and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Remote work has become more common and has increased risks to our information technology systems and data, as more of our employees utilize network connections, computers and devices outside our premises or network, including working at home, while in transit and in public locations. Additionally, future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities' systems and technologies. Furthermore, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program. We rely on third-party service providers and technologies to operate critical business systems to process sensitive information in a variety of contexts, including, without limitation, cloud-based infrastructure, clinical trial operations, encryption and authentication technology, employee email, and other functions. Our ability to monitor these third parties' information security practices is limited, and these third parties may not have adequate information security measures in place. If our third-party service providers experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if our third-party service providers fail to satisfy their privacy- or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties' infrastructure in our supply chain or our third-party partners' supply chains have not been compromised. Any of the previously identified or similar threats could cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our sensitive information or our information technology systems, or those of the third parties upon whom we rely. A security incident or other interruption could disrupt our ability (and that of third parties upon whom we rely) to conduct our business operations. We may be required to expend significant resources, fundamentally change our business activities and practices, or modify our operations (including our clinical trial activities) or information technology in an effort to protect against Security Breaches and to mitigate, detect and remediate actual and potential vulnerabilities. Applicable Data Protection Laws, Privacy Policies and Data Protection Obligations may require us to implement and maintain specific security measures or use industry-standard or reasonable security measures to protect our information technology systems and sensitive information. While we have implemented security measures designed to protect against Security Breaches, there can be no assurance that our security measures or those of our service providers, partners and other third parties will be effective in protecting against all Security Breaches and adverse effects on our business that may arise from such breaches. The recovery systems, security protocols, network protection mechanisms and other security measures that we (and our third parties) have integrated into our platform, systems, networks and physical facilities, which are designed to protect against, detect and minimize Security Breaches, may not be adequate to prevent or detect service interruption, system failure or data loss. We have not always been able in the past and may be unable in the future to detect, anticipate, measure or prevent Security Breaches or threats or techniques used to detect or exploit vulnerabilities in our (or our service providers', partners' or other relevant third parties') information technology, services, communications or software because such threats and techniques change frequently and are often sophisticated in nature. Therefore, such vulnerabilities could be exploited but may not be detected until after a security incident has occurred. In addition, security researchers and other individuals have and will continue to actively search for and exploit actual and potential vulnerabilities in our (or our third parties') information technology and communications. These vulnerabilities pose material risks to our business. We cannot be certain that we will be able to address any such vulnerabilities, in whole or part, and there may be delays in developing and deploying patches and other remedial measures to adequately address vulnerabilities. Applicable Data Protection Laws, Privacy Policies and Data Protection Obligations may require us to notify relevant stakeholders of Security Breaches, including affected individuals, customers, regulators and credit reporting agencies. Such disclosures are costly and the disclosures or the failure to comply with such requirements could lead to adverse effects on our business including, without limitation, government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive information (including personal data); litigation (including class claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; interruptions in our operations (including availability of data); financial loss; and other similar harms. There can be no assurance that the limitations of liability in our contracts would be enforceable or adequate or would otherwise protect us from liabilities or damages if we fail to comply with applicable Data Protection Laws, Privacy Policies or Data Protection Obligations related to information security or Security Breaches. Failures or significant downtime of our information technology or telecommunication systems or those used by our third-party service providers could also cause significant interruptions in our operations and adversely impact the confidentiality, integrity and availability of sensitive or confidential information, including preventing us from conducting clinical trials, tests or research and development activities and preventing us from managing the administrative aspects of our business. While we maintain general liability insurance coverage and coverage for errors or omissions, we cannot assure that such coverage will be adequate or otherwise protect us from or adequately mitigate liabilities or damages with respect to claims, costs, expenses, litigation, fines, penalties, business loss, data loss, regulatory actions or adverse effects on our business arising out of our privacy and security practices, Processing or Security Breaches, or that such coverage will continue to be available on acceptable terms or at all. The successful assertion of one or more large claims against us that exceeds our available insurance coverage or results in changes to our insurance policies (including premium increases or the imposition of large deductible or co-insurance requirements), could have an adverse effect on our business. In addition, we cannot be sure that our existing insurance coverage and coverage for errors and omissions will continue to be available on acceptable terms or that our insurers will not deny coverage as to any future claim. In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position. Additionally, our sensitive information could be leaked, disclosed, or revealed as a result of or in connection with the use of generative AI technologies by our employees, personnel, or vendors, even if such use is not authorized by us or permitted by our internal policies.