1 TB of Novo Nordisk Data Stolen: 11,500 Clinical Trial Patients Exposed

For healthcare organizations, the breach of a pharmaceutical giant like Novo Nordisk is a stark reminder of the patient privacy risks inherent in digital transformation. With 11,500 pseudonymised clinical trial patients and employee and physician data now potentially compromised, the incident could have far-reaching consequences under GDPR and other health data regulations. The ripple effects may extend to trust erosion in clinical trials and heightened demand for stronger identity management in health IT systems.

A cyber extortion group known as FulcrumSec has publicly claimed to have stolen more than a terabyte of data from pharmaceutical giant Novo Nordisk, demanding $25 million in ransom. The group, which first appeared in October 2025 and has been described by security researchers as credible in both capabilities and claims, says it spent over two months inside Novo Nordisk’s networks exfiltrating a broad range of sensitive information. The stolen data reportedly includes company source code, proprietary details on released and unreleased drugs, clinical trial data, personal information on employees, physicians, and roughly 11,500 pseudonymised patients, as well as information about production facilities and internal AI models. After Novo Nordisk refused to pay, FulcrumSec said it is exploring private sales of certain drug-related data and may open-source the remainder as a deterrent tactic.

“

A cyber extortion group known as FulcrumSec has publicly claimed to have stolen more than a terabyte of data from pharmaceutical giant Novo Nordisk, demanding $25 million in ransom.

The incident first came to light when Novo Nordisk disclosed a cybersecurity breach on June 11 that it characterized as unauthorized access to a limited number of internal IT systems involving some personal data. FulcrumSec, however, paints a far more extensive picture. In a message posted on its site on June 16 and in subsequent email exchanges with Reuters, the group detailed a timeline that suggests initial contact was made with unnamed executives around June 1, with the company responding two days later via a Proton Mail address for verification. Novo Nordisk confirmed to Reuters that it is aware of the published claims and is coordinating with authorities, but would not comment further on the scale of the breach.

The implications for Novo Nordisk are severe. The company, best known for its blockbuster obesity and diabetes treatments, faces not only potential regulatory penalties under GDPR and other data protection laws but also the risk that proprietary research could fall into competitors’ hands. While FulcrumSec says it will withhold employee, physician, and patient data as part of a “harm-reduction strategy,” the release or sale of drug-related intellectual property could undermine years of R&D investment. Thomas Willkan, head of research at cybersecurity firm Lab-1, who has tracked FulcrumSec closely, noted that the group’s claims are usually legitimate, adding credibility to the threat.

From a broader sector perspective, this incident underscores the growing targeting of pharmaceutical companies by sophisticated cyber extortion groups. The stolen data categories—ranging from unreleased drug information to internal AI models—reflect an understanding of which assets hold the most value, both for ransom leverage and for potential resale. The two-month dwell time indicates careful planning and a high degree of network penetration, likely evading detection while systematically mapping and exfiltrating data. FulcrumSec’s public stance on harm reduction is a notable evolution in extortion tactics; by selectively withholding certain data, the group seeks to differentiate itself and possibly apply moral pressure while still maximizing profitability.