Precipio, Inc.

Current report

Cybersecurity risks could compromise our information and expose us to liability, which may harm our ability to operate effectively and may cause our business and reputation to suffer.

Current report

Cybersecurity refers to the combination of technologies, processes and procedures established to protect information technology systems and data from unauthorized access, misuse, attack, or damage. We rely on our information systems to provide security for processing, transmission and storage of confidential information and personal information about our patients, customers and personnel and rely on our third-party providers to implement effective security measures and identify and correct for any such failures, deficiencies, data breaches or cybersecurity incidents. We also rely on our

Current report

employees and consultants to safeguard their security credentials and follow our policies and procedures regarding use and access of computers and other devices that may contain our sensitive information. If we or our third-party providers fail to maintain or protect our information technology systems and data integrity effectively or fail to anticipate, plan for or manage significant disruptions to our information technology systems, we or our third-party providers could have difficulty preventing, detecting and controlling such cyberattacks and any such attacks could result in losses described above, as well as disputes with physicians, patients and our partners, regulatory sanctions or penalties, increases in operating expenses, expenses or lost revenues or other adverse consequences, any of which could have a material adverse effect on our business, results of operations, financial condition, prospects and cash flows. Any failure by such third-parties to prevent or mitigate cybersecurity incidents, data breaches or improper access to, misuse of, or disclosure of such information could have similarly adverse consequences for us. If we are unable to prevent or mitigate the impact of such cybersecurity incidents, data breaches or other adverse events, we could be exposed to litigation and governmental investigations, which could lead to a potential disruption to our business.

Current report

Cyberattacks are increasing in their frequency, sophistication and intensity, and have become increasingly difficult to detect. Cyberattacks could include wrongful conduct by hostile foreign governments, intentional or inadvertent wrongful conduct by insider employees or vendors, industrial espionage, wire fraud and other forms of cyber fraud, the deployment of harmful ransomware, malware, denial-of-service attacks, social engineering fraud (including phishing attacks) or other means to threaten data security, confidentiality, integrity and availability. A successful cyberattack could cause serious negative consequences for us, including, without limitation, the disruption of operations, the misappropriation of confidential business information, including financial information, trade secrets, financial loss and the disclosure of corporate strategic plans. The regulatory environment surrounding information security and privacy is increasingly demanding, with the frequent imposition of new and changing requirements. Compliance with changes in privacy and information security laws and with rapidly evolving industry standards may result in our incurring significant expense due to increased investment in technology and the development of new operational processes.

Current report

We maintain our information technology systems with safeguards designed to protect against cyberattacks including passive intrusion protection, firewalls and virus detection software. However, these safeguards do not ensure that a significant cyberattack could not occur. Although we have taken steps to protect the security of our information systems and the data maintained in those systems, it is possible that our safety and security measures will not prevent the systems’ improper functioning or damage or the improper access or disclosure of personally identifiable information such as in the event of cyberattacks.

Current report

Security incidents, including physical or electronic break-ins, computer viruses, attacks by hackers and similar cybersecurity incidents, and data breaches, can create system disruptions or shutdowns or the unauthorized disclosure of, access to, or misuse of confidential information. If personal information or protected health information is improperly accessed, tampered with, misused or disclosed as a result of a cybersecurity incident or data breach, we may incur significant costs to notify impacted stakeholders (including affected individuals, investors and regulators) and mitigate potential harm to affected individuals, and we may be subject to sanctions and civil or criminal penalties if we are found to be in violation of the privacy or security rules under HIPAA or other similar federal or state laws protecting confidential personal information. In addition, a cybersecurity incident, data breach of or other adverse event affecting our information systems could damage our reputation, subject us to liability claims or regulatory penalties for compromised personal information and could have a material adverse effect on our business, financial condition and results of operations. Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our privacy and data security obligations. Further, although we maintain cyber liability insurance, this insurance may not provide adequate coverage against potential liabilities related to any experienced cybersecurity incident or data breach. Cybersecurity incidents could result in operational disruption, regulatory investigations, required notifications and remediation, litigation, fines, reputational harm, or financial costs that could materially adversely affect our business, financial condition, results of operations, or prospects.

Current report

On December 4, 2025, we reported that we experienced a cybersecurity incident involving unauthorized access to an employee’s cloud-based storage account that resulted in unauthorized access to certain personally identifiable information and protected health information of individuals. In response, we initiated an investigation, engaged third-party

Current report

cybersecurity specialists, secured the impacted account, notified law enforcement authorities, and undertook a review of the affected files, which was preliminarily completed in March 2026. We began providing notice to potentially affected individuals in April 2026. We continue to assess the potential impacts of the incident, including any regulatory, legal, or financial implications. In April and May 2026, two putative class action complaints were filed against us in the United States District Court for the District of Connecticut on behalf of individuals whose information was allegedly affected by the incident. Those actions have been consolidated. We intend to defend the actions vigorously, but we are unable to predict their outcome or estimate the amount or range of any potential loss. We may become subject to additional litigation, regulatory inquiries or enforcement actions arising from the incident, and the costs of defending these matters and any resulting liability could be significant and may exceed our available insurance coverage. While we have taken mitigation steps, there can be no assurance that similar incidents will not occur in the future or that additional impacts from this or related incidents will not be identified.