Surmodics Inc. filed SEC Form 8-K: Other Events, Financial Statements and Exhibits

UNITED STATES
SECURITIES AND EXCHANGE COMMISSION
WASHINGTON, D.C. 20549

FORM 8-K

CURRENT REPORT

Pursuant to Section 13 or 15(d) of the Securities Exchange Act of 1934

Surmodics, Inc.

(Exact name of Registrant as Specified in Its Charter)

(Former Name or Former Address, if Changed Since Last Report)

Check the appropriate box below if the Form 8-K filing is intended to simultaneously satisfy the filing obligation of the registrant under any of the following provisions:

Securities registered pursuant to Section 12(b) of the Act:

Indicate by check mark whether the registrant is an emerging growth company as defined in Rule 405 of the Securities Act of 1933 (§ 230.405 of this chapter) or Rule 12b-2 of the Securities Exchange Act of 1934 (§ 240.12b-2 of this chapter).

Emerging growth company ☐

If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐

Item 8.01 Other Events.

On June 5, 2025, Surmodics, Inc (the "Company") discovered that a third party (a "Threat Actor") had gained unauthorized access to certain of its information technology ("IT") systems (the "Cyber Incident") and that certain IT systems and data were unavailable to the Company. The Company promptly initiated containment measures, including proactively taking certain IT systems offline, and implemented its security incident response plan. The Company has notified law enforcement about the matter.

Since discovering the Cyber Incident, the Company has worked with third party IT experts to contain, assess, and remediate the incident. As of the time of filing of this Current Report on Form 8-K (this "Form 8-K"), the Company's critical IT systems have been restored and IT data is being validated. The Company's remaining IT systems and data are being restored and validated in accordance with a recovery plan. Throughout the Cyber Incident to date, the Company has been able to accept customer orders and ship products without any material interruption of customer impact using alternatives to its normal IT systems.

The Company continues to analyze the scope and details of the IT data that the Threat Actor accessed. To the Company's knowledge, the Threat Actor has not released any of the Company's data, including third party data held by the Company, or used any such data for any fraudulent purposes.

The Company maintains cyber insurance, which it expects to cover much of its expenditures related to the Cyber Incident, subject to the policy's deductible and customary exclusions. The Company remains subject to various risks due to the Cyber Incident, including the adequacy of processes during the period of disruption of the Company's IT systems, diversion of management's attention, potential litigation, changes in customer behavior, and regulatory scrutiny.

Company Note Regarding Forward-Looking Statements

This Form 8-K contains “forward-looking statements” within the meaning of the U.S. federal securities laws. Such statements include statements regarding the Company's assessment of the Cyber Incident and ongoing or potential impacts, that the Company’s remaining IT data and systems are being restored and validated in accordance with a recovery Plan, that the Company is able to accept customer orders and ship products, and the Company’s expectation that insurance will cover much of its expenditures related to the Cyber Incident. Actual results may vary materially from those expressed or implied by forward-looking statements based on a number of factors, including, without limitation: any impairment of the integrity of the Company’s IT systems or data; delays or difficulties in restoring the Company’s IT systems and data; the Company’s continued ability to use alternatives to its IT systems, to the extent needed; the Company’s ability to process information it collected while using alternatives to its IT systems and the integrity of that information; the adequacy of processes during the period of disruption of the Company’s IT systems; the results of the Company analysis of the scope and details of the IT data that the Threat Actor accessed; release by the Threat Actor of any of the Company’s data, including third party data held by the Company, or the use of any such data for any fraudulent purposes; the actual coverage of the Company’s claims under its cyber insurance policy; further impact of the Cyber Incident on the Company's financial condition or results of operations; diversion of management’s attention from operations of the Company to addressing the Cyber Incident; potential litigation related to the Cyber Incident; changes in customer behavior as a result of the Cyber Incident; reputational risk related to the Cyber Incident; regulatory scrutiny of the Cyber Incident; and other factors described under the heading “Risk Factors” in Part I, Item 1A of the Company’s Annual Report on Form 10-K for the fiscal year ended September 30, 2024, filed with the Securities and Exchange Commission (the “SEC”) on November 20, 2024 (the “Form 10-K”), as updated or supplemented by subsequent reports that the Company has filed or will file with the SEC. Potential investors, shareholders and other readers are cautioned not to place undue reliance on these forward-looking statements, which speak only as of the date on which they are made. The Company assumes no obligation to publicly update any forward-looking statement after it is made, whether as a result of new information, future events or otherwise, except as required by law.

Item 9.01 Financial Statements and Exhibits.

(d) Exhibits

SIGNATURES

Pursuant to the requirements of the Securities Exchange Act of 1934, the registrant has duly caused this report to be signed on its behalf by the undersigned hereunto duly authorized.