Crinetics Pharmaceuticals Inc

We do not believe that there have been any material changes to the risk factors set forth in Part II, Item 1A of our Annual Report on Form 10-K for the year ended December 31, 2023 except as follows:

The U.S. government has recently made statements and taken certain actions that may lead to potential changes to U.S. and international trade policies, including imposing several rounds of tariffs and export control restrictions affecting certain products manufactured in China. Both China and the United States have each imposed tariffs indicating the potential for further trade barriers, including the U.S. Commerce Department adding numerous Chinese entities to its “unverified list,” which requires U.S. exporters to go through more procedures before exporting goods to such entities. It is unknown whether and to what extent new tariffs, export controls, or other new laws or regulations will be adopted, or the effect that any such actions would have on us or our industry. Most recently, in February 2024, U.S. lawmakers have called for investigations into and the imposition of possible economic sanctions against Chinese biotechnology companies WuXi AppTec and WuXi Biologics, or collectively WuXi, over alleged ties to the Chinese military. Any unfavorable government policies on international trade, such as export controls, capital controls or tariffs, may increase the cost of manufacturing our product candidates and platform materials, affect our ability to commercialize our product candidates if approved, the competitive position of our product candidates, and import or export of raw materials and finished product candidate used in our preclinical studies and clinical trials, particularly with respect to any product candidates and materials that we import from China, including pursuant to our manufacturing service arrangements with WuXi. If any new tariffs, export controls, legislation and/or regulations are implemented, or if existing trade agreements are renegotiated or, in particular, if either the U.S. or Chinese government takes retaliatory trade actions due to the recent trade tension, such changes could have an adverse effect on our business, financial condition and results of operations.

Our information technology systems, or those of any of our CROs, manufacturers, other contractors or consultants or potential future collaborators, may fail or suffer security breaches, which could result in a material disruption of our product development programs.

We collect and maintain information in digital form that is necessary to conduct our business, and we are increasingly dependent on information technology systems, infrastructure, and data to operate our business. In the ordinary course of our business, we collect, store, process, and transmit large amounts of confidential information, including intellectual property, proprietary business information and personal information of third parties and our employees and contractors. It is critical that we do so in a secure manner to maintain the confidentiality and integrity of such confidential information. Despite the implementation of security measures, our information technology systems and those of our current and any future CROs and other contractors, consultants and collaborators are vulnerable to attack, interruption and damage from computer viruses and malware (e.g. ransomware), malicious code, cyberattacks, hacking, phishing attacks, deep fakes and other social engineering schemes, attacks enhanced or facilitated by artificial intelligence, theft, misconduct or misuse by personnel or third parties, human error, fraud, denial or degradation of service attacks, credential harvesting, supply-chain attacks, technological malfunctions or failures, software bugs, data and information loss, sophisticated nation-state and nation-state-supported actors or unauthorized access or use by persons inside our organization, or persons with access to systems inside our organization. Cyber threats may be generic, or they may be custom-crafted against our information systems. Our network and storage applications and those of our vendors may be subject to unauthorized access by hackers or information security breaches due to operator error, malfeasance or other system disruptions. Attacks upon information technology systems are increasing in their frequency, levels of persistence, sophistication and intensity, and are being conducted by sophisticated and organized groups and individuals, including nation states and nation-state-supported actors, with a wide range of motives and expertise. We may also face increased cybersecurity risks due to our reliance on internet technology and the number of our personnel who are working remotely, which may create additional opportunities for cybercriminals to exploit vulnerabilities. Furthermore, because the techniques used to obtain unauthorized access to, or to sabotage, systems change frequently and often are not recognized until launched against a target, we may be unable to anticipate these techniques or implement adequate preventative measures. We may also experience security breaches that may remain undetected for an extended period. Even if identified, we may be unable to adequately investigate or remediate incidents or breaches due to attackers increasingly using tools and techniques that are designed to circumvent controls, to avoid detection, and to remove or obfuscate forensic evidence. We and certain of our service providers are from time to time subject to cyberattacks and security incidents, including several of the types of attacks noted above. While no prior attacks or incidents have had a material impact on us, if such an event were to occur and cause interruptions in our operations, it could result in a material disruption of our development programs and our business operations, whether due to a loss of our trade secrets or other similar disruptions. For example, the loss of clinical trial data from completed or future clinical trials could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. A data security breach could also lead to public exposure of personal information of our clinical trial patients, customers and others. We also rely on third parties to manufacture our product candidates, and similar events relating to their computer systems could also have a material adverse effect on our business. To the extent that any disruption or security breach were to result in a loss of, or damage to, our data or applications, or inappropriate disclosure of confidential or proprietary information, we could incur liability and the further development and commercialization of our product candidates could be delayed. If a disruption or security breach were to result in a loss of, or damage to, our data or systems, or inappropriate disclosure of confidential or proprietary or personal information, we could also incur liability, including litigation exposure, penalties and fines, expose us to significant expenses, including remediation expenses, and cause significant harm to our reputation and business. Reputational harm resulting from a significant cyber incident may cause unquantifiable damage to our established goodwill. Furthermore, federal, state and international laws and regulations can expose us to enforcement actions and investigations by regulatory authorities, and potentially result in regulatory penalties, fines and significant legal liability, if our information technology security efforts fail. The cyber threat landscape is continually changing, and we cannot guarantee that we will be able to adapt and change our cyber program to manage and mitigate associated risks. We maintain cyber liability insurance; however, this insurance may not be sufficient to cover the financial, legal, business or reputational losses that may result from an interruption or breach of our systems.