HARROW, INC. 10-Q

Item 1A. Risk Factors In addition to the other information contained in this Quarterly Report you should consider the risk factors below which have been updated based on recent events as well as the other risk factors and information in our Annual Report on Form 10-K for the year ended December 31, 2023, including our audited financial statements and the related notes and “Management’s Discussion and Analysis of Financial Condition and Results of Operations.” If any such risks actually occur, our business, financial condition, results of operations and future growth prospects would likely be materially and adversely affected. In these circumstances, the market price of our common stock would likely decline and you may lose all or part of your investment. Additional risks and uncertainties not presently known to us or that we currently deem immaterial also may impair our business operations. Our business and operations could suffer in the event of cybersecurity or other system failures. Despite the implementation of security measures, our internal computer systems and those of any third parties with which we partner are vulnerable to damage from computer viruses, unauthorized access, natural disasters, terrorism, war and telecommunication and electrical failures. While we have not experienced any cybersecurity or system failure, accident or breach to date that has been determined to have had a material impact, if a significant event were to occur, it could result in a material disruption of our operations, substantial costs to rectify or correct the failure, if possible, and potentially violation of HIPAA and other privacy laws applicable to our operations. For example, the California Consumer Privacy Act (the “CCPA”) became effective on January 1, 2020 and gave California residents expanded rights to access and require deletion of their personal information, opt out of certain personal information sharing and receive detailed information about how their personal information is used. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that may increase data breach litigation. Although the CCPA includes exemptions for certain clinical trials data, and HIPAA-protected health information, the law may increase our compliance costs and potential liability with respect to other personal information we collect about California residents. The CCPA has prompted a number of proposals for new federal and state privacy legislation. Other countries also have, or are developing, laws governing the collection, use and transmission of personal information, such as the General Data Protection Regulation (“GDPR”) in the European Union (the “EU”) that became effective in May 2018 and the Personal Information Protection and Electronic Documents Act that became effective in Canada in April 2000. We anticipate that over time we may expand our business outside of the United States. With such expansion, we would be subject to increased governmental regulation in the EU countries in which we might operate, including the GDPR. These laws and similar laws adopted in the future could increase our potential liability, increase our compliance costs and adversely affect our business. If any disruption or security breach resulted in a loss of or damage to our data or applications or inappropriate disclosure of confidential or protected information, we could incur liability, further development of our proprietary formulations could be delayed, and our pharmacy operations could be disrupted, subject to restriction or forced to terminate their operations, any of which could severely harm our business and prospects. A breakdown of our information technology systems, or a cyberattack or information security breach could significantly compromise the confidentiality, integrity and availability of our information technology systems, network-connected control systems and/or our data, interrupt the operation of our business and/or affect our reputation. To achieve our business objectives, we rely on sophisticated information technology systems, including hardware, software, technology infrastructure, online sites and networks for both internal and external operations, mobile applications, cloud services and network-connected control systems, some of which are managed, hosted, provided or serviced by third parties. Internal or external events that compromise the confidentiality, integrity and availability of our systems and data may significantly interrupt the operation of our business, result in significant costs and/or adversely affect our reputation. Our information technology systems are highly integrated into our business, including our customer service infrastructure, R&D efforts, clinical and commercial manufacturing processes and product sales and distribution processes. Further, as the large part of our employees work remotely for some portion of their jobs, our reliance on our third-party information technology systems has increased substantially and is expected to continue to increase. Remote and hybrid working arrangements can increase cybersecurity risks due to the challenges associated with managing remote computing assets and security vulnerabilities that are present in many non-corporate and home networks. The complexity and interconnected nature of software, hardware and our systems make them vulnerable to breakdown or other service interruptions, and to software errors or defects, misconfiguration and other security vulnerabilities. Upgrades or changes to our systems or the software that we use have resulted and we expect, in the future, will result in the introduction of new cybersecurity vulnerabilities and risks. Our systems are also subject to frequent perimeter network reconnaissance and scanning, phishing and other cyberattacks. As the cyber-threat landscape evolves, these attacks are growing in frequency, sophistication, and intensity, and are becoming increasingly difficult to detect and increasingly sophisticated in using techniques and tools—including artificial intelligence—that circumvent security controls, evade detection and remove forensic evidence. Such attacks could include the use of harmful and virulent malware, including ransomware or other denials of service, which can be deployed through various means, including the software supply chain, e-mail, malicious websites and/or the use of social engineering/phishing. We have experienced attacks against our network, although none that have had a material adverse impact to our business. Recently, in November 2024, we became aware of a cybersecurity incident that involved unauthorized access of an employee’s email account. Through this unauthorized access the threat actor was able to fraudulently divert Company funds to its bank account. We detected the incident in a time that management believes minimized the financial, operational or reputational risk to the Company, and at no point was our ability to generate revenues disrupted. However, we, along with our external cybersecurity experts, are continuing to work diligently to fully investigate and assess the impact of the incident and have notified, and are cooperating with, federal law enforcement. As the investigation of the incident is ongoing, the full scope, nature and impact of the incident are not yet fully known. 34 There can be no assurance that our efforts to guard against the wide and growing variety of potential attack techniques will be successful. Attacks such as those experienced by government entities (including those that approve and/or regulate our products) and other multi-national companies, including some of our peers, could leave us unable to utilize key business systems or access or protect important data, and could have a material adverse effect on our ability to operate our business, including developing, gaining regulatory approval for, manufacturing, selling and/or distributing our products. For example, in 2017, a pharmaceutical company experienced a cyberattack involving virulent malware that significantly disrupted its operations, including its research and sales operations and the production of some of its medicines and vaccines. As a result of the cyberattack, its orders and sales for certain products were negatively affected. In late 2020, SolarWinds Corporation, a leading provider of software for monitoring and managing information technology infrastructure, disclosed that it had suffered a cybersecurity incident whereby attackers had inserted malicious code into legitimate software updates for its products that were installed by myriad private and government customers, enabling the attackers to access a backdoor to such systems. In 2022, Okta, Inc., a provider of software that helps companies manage user authentication, disclosed that several hundred of its corporate customers were vulnerable to a security breach that allowed attackers to access Okta’s internal network. Although this breach did not have a significant effect on our business, there can be no assurance that a similar future breach would not result in a material adverse effect on our business or results of operations . Our systems contain and use a high volume of sensitive data, including intellectual property, trade secrets and other proprietary business information, financial information, regulatory information, strategic plans, sales trends and forecasts, litigation materials and/or personal identifiable information belonging to us, our staff, our patients, customers and/or other parties. In some cases, we utilize third-party service providers to collect, process, store, manage or transmit such data, which have increased our risk. Intentional or inadvertent data privacy or security breaches (including cyberattacks) resulting from attacks or lapses by employees, service providers (including providers of information technology-specific services), business partners, nation states (including groups associated with or supported by foreign intelligence agencies), organized crime organizations, “hacktivists” or others, create risks that our sensitive data may be exposed to unauthorized persons, our competitors or the public. System vulnerabilities and/or cybersecurity breaches experienced by our third-party service providers constitute a substantial share of the information security risks to our business. There can be no assurance that a cybersecurity incident would not result in a material adverse effect on our business or results of operations. Further, the timeliness of our awareness of a cybersecurity incident affects our ability to respond to and work to mitigate the severity of such events. Cyberattackers are also increasingly exploiting vulnerabilities in commercially available software from shared or open-source code. We rely on third party commercial software that have had and may have such vulnerabilities, but as use of open-source code is frequently not disclosed, our ability to fully assess this risk to our systems is limited. There can be no assurances that a vulnerability in the software and services that we use would not result in a material adverse effect on our business or results of operations. Domestic and global government regulators, our business partners, suppliers with whom we do business, companies that provide us or our partners with business services and companies we have acquired or may acquire face similar risks. Security breaches of their systems or service outages have adversely affected systems and could, in the future, affect our systems and security, leave us without access to important systems, products, raw materials, components, services or information, or expose our confidential data or sensitive personal information. An extended service outage affecting these or other vendors, particularly where such vendor is the single source from which we obtain the services, could have a material adverse effect on our business or results of operations. For example, in February 2024, UnitedHealth Group announced that a suspected nation-state associated cyber security threat actor had gained access to some of the Change Healthcare (“Change”) information technology systems. Change is the largest clearinghouse for medical claims in the U.S. While Harrow was not directly impacted by this cybersecurity incident, it was reported that as a reaction to the cybersecurity incident, Change temporarily disconnected over 100 related payment systems and Change was unable to process medical claims through its primary platforms. This resulted in the delays to the revenue and cash collection cycle for several ASCs and physician offices, putting a strain on their cash resources. While temporary, the cash constraints for these ASCs and physician offices, we believe, impacted sales of some of our products, such as IHEEZO, during this disrupted period of time. In addition, we distribute our products in the United States primarily through three pharmaceutical wholesalers, and a security breach that impairs the distribution operations of our wholesalers could significantly impair our ability to deliver our products to healthcare providers and patients. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be effective in protecting our information technology systems and sensitive data. We will continue to experience varying degrees of cyberattacks and other incidents in the future. Even though we continue to invest in the monitoring, protection and resilience of our critical and/or sensitive data and systems, there can be no assurances that our efforts will detect, prevent or fully recover systems or data from all breakdowns, service interruptions, attacks and/or breaches of our systems that could adversely affect our business and operations and/or result in the loss or exposure of critical, proprietary, private, confidential or otherwise sensitive data, which could result in material financial, legal business or reputational harm to us or negatively affect our stock price. While we maintain cyber-liability insurance, our insurance is not sufficient to cover us against all losses that could potentially result from a service interruption, breach of our systems or loss of our critical or sensitive data. We are also subject to various laws and regulations globally regarding privacy and data protection, including laws and regulations relating to the collection, storage, handling, use, disclosure, transfer and security of personal data. The legislative and regulatory environment regarding privacy and data protection is continuously evolving and developing and the subject of significant attention globally. For example, we are subject to the CCPA, which became effective in January 2020, which can result in substantial penalties for noncompliance. The CCPA was amended in late 2020, to create the California Privacy Rights Act to create opt in requirements for the use of sensitive personal data and the formation of a new dedicated agency for the enforcement of the law, the California Privacy Protection Agency. Similar consumer privacy laws went into effect in Virginia, Colorado, Utah, Connecticut and Florida in 2023. Consumer privacy laws were also passed in 11 other states, with the earliest effective dates later this year, and proposed in three additional states. Failure to comply with these current and future laws could result in significant penalties and reputational harm and could have a material adverse effect on our business and results of operations. 35 Item 2. Unregistered Sales of Equity Securities and Use of Proceeds None. Item 3. Defaults Upon Senior Securities Not applicable. Item 4. Mine Safety Disclosures Not applicable.