GILEAD SCIENCES, INC.

Form 10-K Item 1C disclosure for a biopharmaceutical company stating no material cybersecurity risks or incidents have been identified since the beginning of fiscal year 2025. The filing details standard cybersecurity governance, risk management processes, and incident response plans but reports no actual breaches.

Gilead Sciences, Inc. notified the California Attorney General of a data breach involving its mailing vendor, Billing Document Specialists (BDS). On February 7, 2025, BDS inadvertently mailed 1095-C tax forms with shipping labels containing visible personal information, including Social Security numbers, through envelope windows. Trusaic, which assists Gilead with ACA compliance, discovered the incident on February 18, 2025. No database intrusions occurred. Affected individuals are offered 24 months of Equifax Credit Watch Gold.

Gilead Sciences Inc reported a data breach to the Indiana Attorney General. The breach occurred on 2025-02-12 and was reported on 2025-04-02. 40 Indiana residents were affected. 12,224 individuals affected in total.

Gilead Sciences, Inc. (CA, Health Plan) reported to HHS on 2025-04-02 an Unauthorized Access/Disclosure affecting 12,224 individuals. The covered entity's business associate made individuals' PHI viewable during mailing. Exposed information included names, addresses, and Social Security numbers. Breached information located on Paper/Films. The CE notified HHS, the media, and affected individuals, and provided free credit monitoring.

Trusaic's mailing distribution vendor, Billing Document Specialists (BDS), inadvertently mailed 1095-C tax forms with Social Security numbers visible in the shipping label window. Discovered February 18, 2025; mailing occurred around February 7, 2025. The 18-digit label identifier embedded the recipient's SSN. Trusaic provides ACA compliance services to Gilead Sciences. 4 Maine residents affected out of 12,224 total. Equifax credit monitoring offered for 24 months.