1TB of Patient Data Exposed in Novo Nordisk Hack, $25M Extortion Attempt

For healthcare providers and health IT leaders, the Novo Nordisk breach is a stark reminder that patient data remains a prime target for cyber criminals. With over a terabyte of data allegedly stolen—ranging from clinical trial records to employee and physician information—the incident underscores the urgent need for robust data governance and immediate breach response plans, especially as regulators intensify enforcement of HIPAA and GDPR. The threat of such data being sold or leaked could have long-lasting repercussions for patient trust and care delivery.

On June 16, 2026, cyber extortion group FulcrumSec publicly claimed to have breached Danish pharmaceutical giant Novo Nordisk, exfiltrating over a terabyte of highly sensitive data and demanding a $25 million payment. Novo Nordisk had already disclosed a cybersecurity incident on June 11, acknowledging unauthorized access to some internal IT systems and personal data, but the full scope alleged by the attackers—including source code, proprietary drug information, clinical trial data, employee and patient records, manufacturing details, and internal AI model data—would represent one of the most severe intellectual property and data thefts in the industry's history. The group, which first surfaced in October 2025, says it spent more than two months inside Novo Nordisk’s networks before initiating contact with executives on June 1. After the company refused to pay, FulcrumSec announced it is now exploring private sales of select drug-related data while withholding employee and patient data, citing a preference to open-source material as a deterrent against future non-payment.

“

On June 16, 2026, cyber extortion group FulcrumSec publicly claimed to have breached Danish pharmaceutical giant Novo Nordisk, exfiltrating over a terabyte of highly sensitive data and demanding a $25 million payment.

The incident highlights a troubling shift in cyber extortion tactics. Unlike traditional ransomware attacks that encrypt data and demand payment for decryption keys, FulcrumSec focused entirely on data theft and the threat of public release or sale. This removes the technical overhead of encryption and puts the onus squarely on the victim to prevent exfiltration. The $25 million demand is far above typical ransomware amounts, reflecting the perceived market value of pharmaceutical intellectual property, which can exceed a billion dollars in R&D investment for a single blockbuster drug. Novo Nordisk’s portfolio includes leading diabetes and obesity treatments, making its stolen data a potential goldmine for competitors, generic manufacturers, or even nation-states seeking to accelerate their own drug development programs.

From a regulatory perspective, the breach carries massive compliance implications. The alleged theft of patient and doctor data likely triggers notification requirements under GDPR in Europe and potentially HIPAA in the U.S., with fines that can reach 4% of global annual turnover. Clinical trial data, if exposed, could compromise the integrity of ongoing studies and erode trust in the company’s regulatory submissions. The company’s admission of unauthorized access to personal data suggests that at least some of FulcrumSec’s claims may be grounded in reality, though Reuters was unable to independently verify the sample data posted by the group.