Threat ActorPublished 16 Jun 2026

Cybercrime Group Claims Novo Nordisk Hack

Source SecurityWeek

Description

The cybercrime group FulcrumSec claims to have hacked Danish pharmaceutical company Novo Nordisk, stealing approximately 1.3TB of data including intellectual property and clinical trial information. The stolen data was pseudonymized, meaning patient identities were not directly exposed. The group gained access via a compromised GitHub access token and demanded a $25 million ransom, which was refused. The extortion attempt failed, and the group is threatening to leak the data, though no public leak has occurred yet. Novo Nordisk confirmed the breach but emphasized that patient identities were not compromised.

Impact

The breach exposed a large volume of sensitive intellectual property and pseudonymized clinical trial data, potentially impacting Novo Nordisk's competitive position and research confidentiality. Patient identities were not compromised according to the company. The extortion attempt failed, but the threat of data leakage remains. There is no indication of active exploitation beyond the initial breach or public data leaks at this time.

Defensive guidance

Organizations should review and secure access tokens and credentials, especially those stored in code repositories like GitHub. Novo Nordisk has not indicated any required action for external parties. Monitoring for any data leaks and reinforcing credential management are recommended.

Summary

FulcrumSec claims responsibility for a data breach at Novo Nordisk, exploiting a GitHub access token to clone repositories and obtain credentials. The group exfiltrated about 1.3 terabytes of data, including proprietary drug programs, compound structures, RNAi pipeline data, and private AI models. The stolen data was pseudonymized clinical trial data, with no direct patient identifiers accessed. FulcrumSec attempted to extort the company for $25 million but was unsuccessful. At the time of reporting, no data leak has been published on the group's leak site. Novo Nordisk acknowledged the breach and stated that patient identities remain protected.

References

securityweek.com/cybercrime-group-claims-novo-nordisk-hack/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 16 Jun 2026, 12:45 UTC

References

Community reviews