Material Cybersecurity Incidents.

On or about March 27, 2024, OraSure Technologies, Inc. (the “Company”) became aware of a cybersecurity incident in which an unauthorized third party gained access to Company data from certain information systems. Following detection of the incident, the Company initiated response protocols, commenced an investigation with the assistance of cybersecurity experts and external counsel, and notified law enforcement. The Company believes it has contained the incident and believes it has preserved the integrity of its core financial and operational systems.

Although the Company ascertained that certain files were exfiltrated, it is still investigating the extent of any sensitive information contained within the accessed systems, including any personal information. It is evaluating what, if any, regulatory and legal notifications are required as a result of this incident and will make such notifications as required based on its findings.

As of the date hereof, the incident has not had a material impact on the Company’s operations, financial systems, or its financial condition. The Company’s information systems are operational, and it does not anticipate that this incident will have a material impact on its financial condition and results of operations moving forward. While the Company believes it has contained the incident, it continues to investigate this matter to determine the full extent of the impact on the Company.