Company: CRNX
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0000950170-25-029050
Chunk: 223

Company: Crinetics Pharmaceuticals, Inc.
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1A
Chunk 223
---
 and collaborators are vulnerable to attack, interruption and damage from computer viruses and malware (e.g. ransomware), malicious code, cyberattacks, hacking, phishing attacks, deep fakes and other social engineering schemes, attacks enhanced or facilitated by artificial intelligence, theft, misconduct or misuse by personnel or third parties, human error, fraud, denial or degradation of service attacks, credential harvesting, supply-chain attacks, technological malfunctions or failures, software bugs, data and information loss, sophisticated nation-state and nation-state-supported actors or unauthorized access or use by persons inside our organization, or persons with access to systems inside our organization. Cyber threats may be generic, or they may be custom crafted against our information systems. Our network and storage applications and those of our vendors may be subject to unauthorized access by hackers or information security breaches due to operator error, malfeasance or other system disruptions. Attacks upon information technology systems are increasing in their frequency, levels of persistence, sophistication and intensity, and are being conducted by sophisticated and organized groups and individuals, including nation states and nation-state-supported actors, with a wide range of motives and expertise. We may also face increased cybersecurity risks due to our reliance on internet technology and the number of our personnel who are working remotely, which may create additional opportunities for cybercriminals to exploit vulnerabilities. Furthermore, because the techniques used to obtain unauthorized access to, or to sabotage, systems change frequently and often are not recognized until launched against a target, we may be unable to anticipate these techniques or implement adequate preventative measures. We may also experience security breaches that may remain undetected for an extended period. Even if identified, we may be unable to adequately investigate or remediate incidents or breaches due to attackers increasingly using tools and techniques that are designed to circumvent controls, to avoid detection, and to remove or obfuscate forensic evidence. 

We and certain of our service providers are from time to time subject to cyberattacks and security incidents, including several of the types of attacks noted above. While no prior attacks or incidents have had a material impact on us, if such an event 

65

were to occur and cause interruptions in our operations, it could result in a material disruption of our development programs and our business operations, whether due to a loss of our trade secrets or other similar disruptions. For example, the loss of clinical trial data from completed or future clinical trials could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. A data security breach could also lead to public exposure of personal information of