14 unchanged sentences
The ERM program establishes a risk management framework that seeks to identify, assess, and mitigate risks that could materially impact the Company’s business and operation.
+Added: We engage third-party service providers, such as consultants and independent auditors, to support elements of our cybersecurity and risk management program.
+Added: These engagements are overseen by cybersecurity leadership and results are incorporated into our ongoing risk management and continuous improvement efforts.
+Added: We maintain a third-party risk management process designed to identify and manage cybersecurity risks associated with key third-party relationships .
To date, the Company is not aware of any cybersecurity incident that has had or is reasonably likely to have a material impact on the Company’s business or operations.
−Removed: However, despite our security measures, there can be no assurance that the Company, or the third parties with which we interact, will not experience a cybersecurity incident in the future that may materially affect us.
−Removed: Risk Factors under, “We rely on the proper function, security and availability of our information technology systems and data, as well as those of third parties throughout our global supply chain and our customer and payor base, to operate our business, and a breach, cyber-attack or other disruption to these systems or data could materially and adversely affect our business, results of operations, financial condition, cash flows, reputation or competitive position.”
+Added: However, on April 24, 2026, we announced that an unauthorized third party accessed data in certain of our information technology systems.
+Added: Upon identifying the unauthorized access, we promptly took steps to contain the incident, activated our incident response protocols, and engaged leading external cybersecurity experts to support our investigation and remediation efforts.
+Added: Based on our investigation to date, we have not identified any impact to our products, patient safety, connections to customers, manufacturing and distribution operations, financial reporting systems, or our ability to meet patient needs.
+Added: In addition, we do not currently expect the incident to have a material impact on our business or financial results.
+Added: Our assessment of the incident is ongoing, and we expect to begin notifying individuals whose data may have been accessed as early as the first quarter of fiscal year 2027.
+Added: Despite our security measures, there can be no assurance that the Company, or the third parties with which we interact, will not experience a cybersecurity incident in the future that may materially affect us.
+Added: Risk Factors under, “We rely on the proper function, security and availability of our information technology systems and data, as well as those of third parties throughout our global supply chain and our customer and payor base, to
+Added: Table of Conten ts
+Added: operate our business, and a breach, cyber-attack or other disruption to these systems or data could materially and adversely affect our business, results of operations, financial condition, cash flows, reputation or competitive position.”
The cybersecurity risk management program is led by the Chief Information Security Officer (CISO) .
1 unchanged sentence
The CISO has held various executive level positions within Fortune 500 companies.
−Removed: Table of Content
−Removed: reports to the Chief Information Officer (CIO), who leads the Global Information Technology (IT) organization and works closely with the Executive Committee to guide strategic direction and IT decisions to drive business outcomes .
+Added: Our CISO reports to the Chief Information Officer (CIO), who leads the Global Information Technology (IT) organization and works closely with the Executive Committee to guide strategic direction and IT decisions to drive business outcomes .
Our Board of Directors is engaged in the Company’s ERM program and receives briefings on the outcomes of the ERM program and the steps the Company takes to mitigate risks that the program identifies.
−Removed: The Quality Committee of the Board oversees the Company’s cybersecurity strategies, systems, and controls to ensure reliability and prevent unauthorized access.
+Added: The Quality Committee of the Board oversees the Company’s cybersecurity strategies, systems, and controls to ensure product reliability and prevent unauthorized access.
The Audit Committee discusses policies with respect to risk assessment and risk management, including risks associated with the reliability and security of the Company’s information technology and security systems, and the steps management has undertaken to monitor and control such exposures.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.