Allogene Therapeutics (ALLO) Risk Factors

In the ordinary course of our business, we and the third parties with whom we work collect, process, receive, store, use, generate, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, process) proprietary, confidential and sensitive information, including personal data (including health information), intellectual property, trade secrets, information we collect about patients in connection with clinical trials, and proprietary business information owned or controlled by ourselves or other parties (collectively, sensitive information). We work with certain third parties, such as CROs and CDMOs, to process our proprietary, confidential and sensitive information. We may also share or receive sensitive information with our partners, CROs, CDMOs, or other third parties. Our ability to monitor these third parties' information security practices is limited, and these third parties may not have adequate information security measures in place. If we (or a third party with whom we work) experience a security incident or are perceived to have experienced a security incident, we may also experience adverse consequences. Cyberattacks, malicious internet-based activity, online and offline fraud and other similar activities threaten the confidentiality, integrity, and availability of our sensitive information and information technology systems, and those of the third parties with whom we work. Such threats are prevalent and are increasing in their frequency, sophistication and intensity, and have become increasingly difficult to detect. These threats come from a variety of sources, including traditional computer "hackers," "hacktivists," organized criminal threat actors, threat actors, personnel (such as through theft or misuse), sophisticated nation-states, and nation-state-supported actors. Some actors now engage and are expected to continue to engage in cyber-attacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we, and the third parties with whom we work, may be vulnerable to a heightened risk of these attacks, including retaliatory cyber-attacks, that could materially disrupt our systems and operations, supply chain, and ability to produce and distribute our product candidates. We and the third parties with whom we work are subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service credential stuffing attacks, credential harvesting, adware, ransomware, supply chain attacks, personnel misconduct or error, attacks enhanced or facilitated by AI, and other similar threats. Our information technology systems and data, and those of the third parties with whom we work, may also be subject to failure or disruption from software bugs, server malfunction, software or hardware failures, loss of data or other information technology assets, telecommunications failures, natural disasters such as earthquakes, fires, and floods, and other similar issues. In particular, severe ransomware attacks are becoming increasingly prevalent and severe and can lead to significant interruptions, delays, or outages in our operations, disruptions to our clinical trials, loss of data (including data related to clinical trials), significant expense to restore data or systems, reputational loss and the diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. In addition, our reliance on third-party service providers could introduce new cybersecurity risks and vulnerabilities, including supply-chain attacks, and other threats to our business operations. Such supply chain attacks have increased in frequency and severity, and we cannot guarantee that third parties and infrastructure in our supply chain have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach to our information technology systems or the third-party information technology systems that support us and our services. Additionally, future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities' systems and technologies. Furthermore, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program. Any of the previously identified or similar threats could cause a security incident or other interruption. A security incident or other interruption could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our sensitive information. A security incident or other interruption could disrupt our ability (and that of third parties with whom we work) to manufacture or deliver our product candidates. We may expend significant resources (including financial), or modify our business activities and operations, including our clinical trial activities, in an effort to protect against security incidents or to detect, investigate, mitigate, contain and remediate a security incident. Certain data privacy and security obligations may require us to implement and maintain specific security measures or use industry-standard or reasonable security measures to protect our information technology systems and sensitive information. Although we have implemented security measures designed to protect against, mitigate, and remediate security incidents, there can be no assurance that these measures will be effective. We have experienced attempts to compromise our information technology systems or otherwise cause a security incident, but, to our knowledge, such attempts have been unsuccessful. In addition, from time to time, our vendors inform us of security incidents. To date, we have not determined that such incidents as reported to us were material. However, we may not have all information related to such incidents and future incidents could have an adverse impact on our business. We take steps designed to detect, mitigate, and remediate vulnerabilities in our information systems (such as our hardware and/or software, including that of third parties with whom we work). We may, however, be unable to detect and remediate vulnerabilities in our information technology systems because such threats and techniques change frequently, are often sophisticated in nature, and may not be detected until after a security incident has occurred, meaning that such vulnerabilities could be exploited. Unremediated high risk or critical vulnerabilities pose material risks to our business that may be exploited and could result in a security incident. Further, we may experience delays in developing and deploying remedial measures designed to address any such identified vulnerabilities. We may also face heightened physical and information technology risks due to our sharing office space with other tenants at certain of our sites. Any failure to prevent or mitigate security incidents or improper access to, use of, or disclosure of our clinical data or patients' personal data could result in significant liability under state, federal, and international law and may cause a material adverse impact to our reputation, affect our ability to conduct our clinical trials and potentially disrupt our business. In addition, as many of our employees work from home at least part of the time and utilize network connections outside our premises, including while at home, or in transit, this poses increased risks to our information technology systems and data. Applicable data protection laws, privacy policies, data protection obligations and public company disclosure obligations may require us, or we may choose, to notify relevant stakeholders, including affected individuals, regulators and investors, of certain security incidents, or to implement other requirements, such as providing credit monitoring. Such disclosures and compliance with such requirements are costly, and the disclosures or the failure to comply with such requirements could lead to adverse consequences. A security incident, whether perceived or actual, experienced by us or a third party with whom we work, may cause us to experience adverse consequences. These consequences may include: government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive information (including personal data); litigation (including class claims) and mass arbitration; indemnification obligations; negative publicity; reputational harm; monetary fund diversions; interruptions in our operations (including availability of data); financial loss; and other similar harms. Whether a cybersecurity incident is reportable to our investors may not be straightforward, may take considerable time to determine, and may be subject to change as the investigation of the incident progresses, including changes that may significantly alter any initial disclosure that we provide. Moreover, experiencing a material cybersecurity incident and any mandatory disclosures could lead to negative publicity, loss of investor or partner confidence in the effectiveness of our cybersecurity measures, diversion of management's attention, governmental investigations, lawsuits, and the expenditure of significant capital and other resources. Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that the limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our data privacy and security obligations. We cannot be sure that our insurance coverage will be adequate or sufficient to protect us from or adequately mitigate liabilities arising out of our privacy and security practices, or that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims. In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position. Additionally, sensitive information could be leaked, disclosed, or revealed as a result of or in connection with the use of generative artificial intelligence technologies by our employees, personnel, or vendors.

Cellectis' TALEN technology, which we use in our oncology programs, and Arbor's CRISPR technology, which we use in our AID program, both involve relatively new approaches to gene editing, using sequence-specific DNA-cutting enzymes, or nucleases, to perform precise and stable modifications in the DNA of living-cells and organisms, and we have very little experience with Arbor's CRISPR technology. Cellectis and Arbor have not created nucleases for all gene sequences that we may seek to target, and they may not agree to or have difficulty creating nucleases for other gene sequences that we may seek to target, which could limit the usefulness of this technology. This technology may also not be shown to be effective in clinical studies that Cellectis, we or other licensees of Cellectis technology or Arbor's CRISPR technology may conduct, or may be associated with safety issues that may negatively affect our development programs. For instance, gene-editing may create unintended changes to the DNA such as a non-target site gene-editing, a large deletion, or a DNA translocation, any of which could lead to oncogenesis. In our ALPHA2 trial, we observed a chromosomal abnormality, and the FDA placed our clinical trials on hold following this observation. While our investigation concluded that gene editing was not responsible for the chromosomal abnormality and the hold was resolved, we may discover future abnormalities caused by gene editing or other factors that would impact our development plans. The gene editing of our product candidates may also not be successful in limiting the risk of GvHD or premature rejection by the patient. In addition, the gene-editing industry is rapidly developing, and our competitors may introduce new technologies that render our technology obsolete or less attractive. New technology could emerge at any point in the development cycle of our product candidates. As competitors use or develop new technologies, any failures of such technology could adversely impact our program. We also may be placed at a competitive disadvantage, and competitive pressures may force us to implement new technologies at a substantial cost, and which would delay our development programs. In addition, our competitors may have greater financial, technical and personnel resources that allow them to enjoy technological advantages and may in the future allow them to implement new technologies before we can. We cannot be certain that we will be able to implement technologies on a timely basis or at a cost that is acceptable to us. If we are unable to maintain technological advancements consistent with industry standards, our operations and financial condition may be adversely affected.