BIOMARIN PHARMACEUTICAL INC.

Form 10-K Item 1C cybersecurity disclosure describing the registrant's NIST-aligned cybersecurity risk management program, governance structure (Board, Audit Committee, Executive Cybersecurity Committee, Cybersecurity Risk Committee), and the roles of the Chief Information Officer and Global Head of Cybersecurity. The filing explicitly states that, as of the date of the Annual Report, the company has not experienced a cybersecurity incident that resulted in a material adverse impact on its business or operations. No specific breach incident is disclosed.

BioMarin Pharmaceutical Inc. disclosed a phishing incident in California where an attacker accessed two email accounts using a temporary employee's stolen credentials. The breach exposed names, Social Security Numbers, and health insurance policy numbers. BioMarin contained the breach by changing credentials and offered one year of LifeLock identity protection to affected individuals.