Novo Nordisk Hit by Major Cyberattack: FulcrumSec Leaks 1.3TB of Stolen Data Including Clinical Trial Records and AI Models

Cybercrime group FulcrumSec has begun leaking what it claims are samples from 1.3 terabytes of data stolen from Danish pharmaceutical giant Novo Nordisk查看公司主页, the maker of blockbuster drugs Wegovy查看药品详情 and Ozempic查看药品详情, after the company refused to pay a $25 million ransom demand.

The hacking group, which emerged in October 2025, said in a message posted to its website that the stolen data includes company source code, proprietary information on released and unreleased drugs, clinical trial data, employee and patient information, production facility data, and internal AI model data. FulcrumSec said it spent more than two months inside Novo Nordisk查看公司主页's networks before making the demand.

Novo Nordisk查看公司主页 disclosed a cybersecurity incident on June 11 involving unauthorized access to a limited number of internal IT systems. The company acknowledged that the breach affected personal data stored on its systems, including some information related to patients participating in various clinical trials, and that some "non-public" data was copied externally without authorization.

In a statement to ISMG, Novo Nordisk查看公司主页 said it is aware of claims that data copied externally from its systems has been published online. "We take this matter seriously and maintain continued operations of our main platforms. We are in contact with the relevant authorities," the company said, adding that "protecting the security and integrity of our systems and delivering reliable products and support to patients remain our highest priorities."

Scope of the Breach

FulcrumSec claims the stolen trove contains a wide range of clinical trial information and intellectual property, including proprietary artificial intelligence models apparently used in drug development. The group said it is now exploring "private sales" for much of the exfiltrated data, allegedly including 30 "trained" AI models, 70 datasets, and 494 gigabytes of "proprietary cell painting microscopy images."

"To be frank, 99% of what these models are capable of is over our heads," FulcrumSec wrote on its leak site.

The hacked systems also reportedly contained details about tens of thousands of drug compounds being tested or used for treatment of diabetes (搜索)搜索该疾病, weight loss, chronic kidney disease (搜索)搜索该疾病, and sickle cell disease (搜索)搜索该疾病. DataBreaches.net, a cybersecurity blog, reported that FulcrumSec shared purported correspondence with the company beginning June 1, including a list of more than 700,000 files totaling roughly 1.3 terabytes.

FulcrumSec said it would withhold some of what it took, including information on thousands of employees and physicians, roughly 11,500 pseudonymised clinical trial patients, and operational technology data related to Novo Nordisk查看公司主页's production facilities, describing the decision as part of a harm-reduction strategy.

Method of Intrusion

According to FulcrumSec's claims, the group gained initial access in March to Novo Nordisk查看公司主页's IT environment through an Azure container registry credential "baked" into a client-side JavaScript bundle, and also through a GitHub personal access token with access to "hundreds of private repositories." Access to the two repositories allegedly contained "API tokens, database credentials and service account passwords," allowing the hackers to laterally move through Novo Nordisk's systems.

The lateral movement allegedly enabled the hackers to access a number of Novo Nordisk查看公司主页 systems, including a collaborative drug discovery database, clinical trial data, employee information, and various AI models.

Thomas Willkan, head of research at cybersecurity firm Lab-1, told Reuters that FulcrumSec is "usually quite legit in terms of both their capabilities and also their claims."

Expert Analysis and Implications

Cybersecurity experts warn that if FulcrumSec's allegations are accurate, the breach carries profound implications for the pharmaceutical industry.

"Clinical trial data — for example testing on human subjects — is one of the most valuable types of data that can be held by a healthcare sector organization," said Mike Hamilton, CISO emeritus at IT services firm Datec, Inc. He cautioned that "the integrity of the information accessed cannot be trusted: If you can steal a record, you can modify it. This calls into question all the clinical testing results that are in scope of the theft."

Hamilton also noted that "clinical trial data is also sought by nation-states for the purpose of jump-starting their own research."

Matt Kimpel, CISO at cybersecurity vendor Magna5, highlighted the significance of the reported dwell time. "The industry has spent years investing in prevention. The bigger gap for most organizations now is how quickly they detect and contain an active intruder," he said, adding that "these incidents are no longer pure ransomware or pure data theft. Extortion and intellectual property theft are now routinely combined."

Kimpel emphasized that "third-party and identity-based access remain the most common entry paths" and recommended that "pharma security programs should keep emphasizing identity hardening, vendor risk and monitoring of privileged research environments rather than only perimeter defense."

"Pharmaceutical R&D represents some of the highest-value data in the economy. A single late-stage drug candidate can carry billions in projected revenue and a decade of investment, which makes the underlying research a massive target for theft," Kimpel said.

Reuters reported that it could not independently verify the authenticity of the data claimed by FulcrumSec.