{"id":109420,"date":"2026-06-16T20:58:08","date_gmt":"2026-06-16T20:58:08","guid":{"rendered":"https:\/\/www.europesays.com\/dk\/109420\/"},"modified":"2026-06-16T20:58:08","modified_gmt":"2026-06-16T20:58:08","slug":"hackers-begin-to-leak-novo-nordisks-stolen-data","status":"publish","type":"post","link":"https:\/\/www.europesays.com\/dk\/109420\/","title":{"rendered":"Hackers Begin to Leak Novo Nordisk’s Stolen Data"},"content":{"rendered":"

\n Artificial Intelligence & Machine Learning<\/a>
\n ,
\n Data Privacy<\/a>
\n ,
\n Data Security<\/a>\n <\/p>\n

Cybercrime Gang FulcrumSec Claims AI Models Are Among Drug Maker’s 1.3TB Trove<\/p>\n

Marianne Kolbasuk McGee<\/a> (HealthInfoSec<\/a>) \u2022
\n June 16, 2026 \u00a0 \u00a0 <\/p>\n

\"Hackers
\n Hackers claim to have stolen 1.3 terabytes of pharmaceutical giant Novo Nordisk’s data and intellectual property, including proprietary AI models used for drug development. (Image: Novo Nordisk) <\/p>\n

Cybercrime gang FulcrumSec has begun leaking what it claims are samples from 1.3 terabytes of data stolen from Danish pharmaceutical giant Novo Nordisk. <\/p>\n

See Also: Know Thy Enemy: Threats to Cyber Resilience<\/a><\/p>\n

The hackers claim the trove contains a wide range of clinical trial information and intellectual property, including proprietary artificial intelligence models apparently used in drug development.<\/p>\n

FulcrumSec on its leak site Tuesday posted what it claims are login screenshots for Novo Nordisk IT systems, clinical trial-related information and samples of details related to the company’s AI models.<\/p>\n

The crime group said that it started leaking the trove after Novo Nordisk refused to pay a $25 million ransom demand. FulcrumSec also said it was exploring “private sales” for much of the pharmaceutical maker’s exfiltrated data, allegedly including 30 “trained” AI models, 70 datasets and 494 gigabytes of “proprietary cell painting microscopy images.” <\/p>\n

“To be frank, 99% of what these models are capable of is over our heads,” FulcrumSec wrote. <\/p>\n

Novo Nordisk on June 11 disclosed<\/a> that it had “recently” discovered an IT security incident involving unauthorized access “to a limited number of internal IT systems.” <\/p>\n

The breach affected personal data stored on the company’s systems, including some information related to patients participating in various clinical trials, said the maker of popular weight loss and diabetes treatment drugs including Wegovy and Ozempic (see: Ozempic Drug Maker Loses Clinical Trial Data in Hack<\/a>).<\/p>\n

Some of the affected “non-public” data was copied externally without authorization, the company said.<\/p>\n

On Tuesday in a statement to ISMG, Novo Nordisk said it’s aware of claims that data copied externally from its systems without authorization has been published online. “We take this matter seriously and maintain continued operations of our main platforms. We are in contact with the relevant authorities.”<\/p>\n

The company did not immediately respond to ISMG’s request for comment on FulcrumSec’s specific claims.<\/p>\n

“Protecting the security and integrity of our systems and delivering reliable products and support to patients remain our highest priorities,” Novo Nordisk told ISMG.<\/p>\n

FulcrumSec claims it gained initial access in March to Novo Nordisk’s IT environment through an Azure container registry credential “baked” into a client-side JavaScript bundle, and also through a GitHub personal access token with access to “hundreds of private repositories.”<\/p>\n

Access to the two repositories allegedly contained “API tokens, database credentials and service account passwords” – allowing the hackers to laterally “spider” through Novo Nordisk’s systems, the gang claimed.<\/p>\n

That lateral movement allegedly enabled the hackers to access a number of Novo Nordisk systems, including a collaborative drug discovery database, clinical trial data for about 11,500 pseudo-anonymized patients, employee information and various AI models, the gang claims.<\/p>\n

The hacked systems also contained details about tens of thousands of drug compounds being tested or used for treatment of diabetes, weight loss, chronic kidney and sickle cell diseases, the gang claims.<\/p>\n

If FulcrumSec’s allegations are accurate, the Novo Nordisk hack is especially disturbing for a number of reasons, experts said.<\/p>\n

“Clinical trial data – for example testing on human subjects – is one of the most valuable types of data that can be held by a healthcare sector organization,” said Mike Hamilton, CISO emeritus at IT services firm Datec, Inc. <\/p>\n

The unauthorized disclosure of the information “is bad enough,” but the breach raises other concerns, including potential regulatory scrutiny, as well as data reliability issues.<\/p>\n

“The integrity of the information accessed cannot be trusted: If you can steal a record, you can modify it. This calls into question all the clinical testing results that are in scope of the theft,” said Hamilton, who is former CISO of the city of Seattle. “Additionally, clinical trial data is also sought by nation-states for the purpose of jump-starting their own research, he said.<\/p>\n

If FulcrumSec’s claims of months inside the Novo Nordisk environment hold up, “the real story is dwell time,” said Matt Kimpel, CISO at cybersecurity vendor Magna5. <\/p>\n

“The industry has spent years investing in prevention. The bigger gap for most organizations now is how quickly they detect and contain an active intruder,” he said.<\/p>\n

“These incidents are no longer pure ransomware or pure data theft. Extortion and intellectual property theft are now routinely combined,” Kimpel said. <\/p>\n

Third-party and identity-based access remain the most common entry paths, he said. “Pharma security programs should keep emphasizing identity hardening, vendor risk and monitoring of privileged research environments rather than only perimeter defense,” he said.<\/p>\n

“Organizations holding strategically important IP should assume they are being actively pursued by capable actors and build their programs to that reality,” he said.<\/p>\n

“Pharmaceutical R&D represents some of the highest-value data in the economy. A single late-stage drug candidate can carry billions in projected revenue and a decade of investment, which makes the underlying research a massive target for theft.”<\/p>\n