FibroGen (FGEN) Risk Factors

In the ordinary course of our business, we and the third parties upon which we rely process confidential, proprietary, and sensitive data, and, as a result, we and the third parties upon which we rely face a variety of evolving threats, including but not limited to ransomware attacks, which could cause security incidents. Cyber-attacks, malicious internet-based activity, online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of our confidential, proprietary, and sensitive data and information technology systems, and those of the third parties upon which we rely. Such threats are prevalent and continue to rise, are increasingly difficult to detect, and come from a variety of sources, including traditional computer "hackers," threat actors, "hacktivists," organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors. Some actors now engage and are expected to continue to engage in cyber-attacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we and the third parties upon which we rely may be vulnerable to a heightened risk of these attacks, including retaliatory cyber-attacks, that could materially disrupt our systems and operations, supply chain, and ability to produce, sell and distribute our services. We and the third parties upon which we rely are subject to a variety of evolving cybersecurity threats, including but not limited to social-engineering attacks (including through phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks (such as credential stuffing), credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, telecommunications failures, earthquakes, fires, floods, and other similar threats. In particular, severe ransomware attacks are becoming increasingly prevalent and can lead to significant interruptions in our operations, loss of confidential, proprietary, and sensitive data and income, reputational harm, and diversion of funds. While it is possible that extortion payments may alleviate the negative impact of a ransomware attack, we may be unwilling or unable to make such payments. In addition, our reliance on third-party service providers could introduce new cybersecurity risks and vulnerabilities, including supply-chain attacks, and other threats to our business operations. We rely on third-party service providers and technologies to operate critical business systems to process confidential, proprietary, and sensitive data in a variety of contexts, including, without limitation, CROs, CMOs, cloud-based infrastructure, data center facilities, encryption and authentication technology, employee email, content delivery to customers, and other functions. We also rely on third-party service providers to provide other products, services, parts, or otherwise to operate our business. Our ability to monitor these third parties' information security practices is limited, and these third parties may not have adequate information security measures in place. If our third-party service providers experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if our third-party service providers fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties' infrastructure in our supply chain or our third-party partners' supply chains have not been compromised. Any of the previously identified or similar threats could cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our confidential, proprietary, and sensitive data or our information technology systems, or those of the third parties upon whom we rely. A security incident or other interruption could disrupt our ability (and that of third parties upon whom we rely) to provide our services. We may expend significant resources or modify our business activities to try to protect against security incidents. Additionally, certain data privacy and security obligations may require us to implement and maintain specific security measures or industry-standard or reasonable security measures to protect our information technology systems and confidential, proprietary, and sensitive data. While we have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective. We take steps designated to detect and remediate vulnerabilities, but we may not be able to detect and remediate all vulnerabilities because the threats and techniques used to exploit the vulnerability change frequently and are often sophisticated in nature. Therefore, such vulnerabilities could be exploited but may not be detected until after a security incident has occurred. These vulnerabilities pose material risks to our business. Further, we may experience delays in developing and deploying remedial measures designed to address any such identified vulnerabilities. Applicable data privacy and security obligations may require us to notify relevant stakeholders, such as governmental authorities, partners, and affected individuals, of security incidents. Such disclosures may involve inconsistent requirements and are costly, and the disclosure or the failure to comply with such requirements could lead to adverse consequences. If we (or a third party upon whom we rely) experience a security incident or are perceived to have experienced a security incident, we may experience adverse consequences, such as government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing confidential, proprietary, and sensitive data (including personal data); litigation (including class claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; interruptions in our operations (including availability of data); delays in our development or other business plans; financial loss; and other similar harms. Security incidents and attendant consequences may cause customers to stop using our services, deter new customers from using our services, and negatively impact our ability to grow and operate our business. Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our data privacy and security obligations. We cannot be sure that our insurance coverage will be adequate or sufficient to protect us from or to mitigate liabilities arising out of our privacy and security practices, that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims. In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveal competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position.

Despite implementing security measures, our internal computer systems, and those of our CROs, collaboration partners, and other third parties on which we rely, are vulnerable to damage from computer viruses, unauthorized access, natural disasters, fire, terrorism, war and telecommunication and electrical failures. We upgraded our disaster and data recovery capabilities in 2022 and continue to maintain and upgrade these capabilities. However, to the extent that any disruption or security breach, in particular with our partners' operations, results in a loss of, or damage to, our data or applications, or inappropriate disclosure of confidential or proprietary information, we could incur liability and it could result in a material disruption and delay of our drug development programs. For example, the loss of clinical trial data from completed, ongoing or planned clinical trials could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data.

Market acceptance and sales of any approved products will depend significantly on reimbursement or coverage of our products by government or third-party payors and may be affected by existing and future healthcare reform measures or prices of related products for which the government or third-party reimbursement applies. Coverage and reimbursement by the government or a third-party payor may depend upon a number of factors, including the payor's determination that use of a product is: - a covered benefit under applicable health plan;- safe, effective and medically necessary;- appropriate for the specific patient;- cost-effective; and - neither experimental nor investigational. Obtaining coverage and reimbursement approval for a product from a government or other third-party payor is a time consuming and costly process that could require us to provide supporting scientific, clinical and cost-effectiveness data for the use of our products to the payor, which we may not be able to provide. Furthermore, the reimbursement policies of governments and third-party payors may significantly change in a manner that renders our clinical data insufficient for adequate reimbursement or otherwise limits the successful marketing of our products. Even if we obtain coverage for our product candidates, the pricing may be subject to re-negotiations or third-party payors may not establish adequate reimbursement amounts, which may reduce the demand for, or the price of, our products. Reference pricing is used by various Europe member states and parallel distribution, or arbitrage between low-priced and high-priced member states, can further reduce prices. In some countries, our partner or we may be required to conduct a clinical trial or other studies that compare the cost-effectiveness of our product candidates to other available products in order to obtain or maintain reimbursement or pricing approval. Publication of discounts by third-party payors or authorities may lead to further pressure on the prices or reimbursement levels within the country of publication and other countries. If reimbursement of our products is unavailable or limited in scope or amount, or if pricing is set at unacceptable levels, our partner or we may elect not to commercialize our products in such countries, and our business and financial condition could be adversely affected.

A number of risks related to our international operations, many of which may be beyond our control, include: different regulatory requirements in different countries, including for drug approvals, manufacturing, and distribution; potential liability resulting from development work conducted by foreign distributors; economic weakness, including inflation, or foreign currency fluctuations, which could result in increased operating costs and expenses and reduced revenues, and other obligations incident to doing business in another country; workforce uncertainty in countries where labor unrest is more common than in the U.S.; compliance with tax, employment, immigration and labor laws for employees living or traveling abroad; political instability in particular foreign economies and markets; and business interruptions resulting from geopolitical actions specific to an international region, including war and terrorism, or natural disasters, including pandemics.

Our third party service providers, who we rely on for critical support functions, may be exposed to significant risks from natural disasters and other catastrophic events, including earthquakes, power outages, and unforeseen disruptions. Many of these providers are in regions prone to earthquakes and fires, such as the San Francisco Bay Area. These risks could severely impact their operations, infrastructures,or abilities to deliver services, which could in turn disrupt our business continuity and have a material adverse effect on our operations and financial results. Although we have conducted comprehensive risk assessments, the vulnerability of our third-party partners to these events remains a significant risk, particularly as many operate from single sites with limited disaster recovery capabilities. Their inability to recover promptly from such events could result in service delays or interruptions, leading to operational challenges, and increased costs for us.

The development and commercialization of new pharmaceutical products is highly competitive. Our future success depends on our ability and/or the ability of our collaboration partners to achieve and maintain a competitive advantage with respect to the development and commercialization of our product candidates. Our objective is to discover, develop and commercialize new products with superior efficacy, convenience, tolerability, and safety. We expect that in many cases, the products that we commercialize will compete with existing marketed products of companies that have large, established commercial organizations. We face competition from generics that could enter the market after expiry of our composition of matter patent. The China Health Authority has accepted abbreviated new drug applications for over 20 generic roxadustat applicants and approved two for marketing. In addition, we will likely face competition from other companies developing products in the same diseases or indications in which we are developing or commercializing products. We will also face competition for patient recruitment and enrollment for clinical trials. The success of any or all of these potential competitive products may negatively impact the development and potential for success of our products. Moreover, many of our competitors have significantly greater resources than we do. Large pharmaceutical companies have extensive experience, greater scale, and efficiency, in clinical testing, obtaining regulatory approvals, recruiting patients, manufacturing pharmaceutical products, and commercialization. If our collaboration partners and we are not able to compete effectively against existing and potential competitors, our business and financial condition may be materially and adversely affected.