Loading story…
Novo Nordisk disclosed a cyberattack in which attackers accessed a limited number of internal IT systems and copied non-public data tied to some clinical trial participants and healthcare professionals. The stolen clinical trial information included pseudonymized patient identifiers rather than direct identifiers such as names, but it still covered sensitive fields including trial participation details, sex or gender, year of birth, biomarkers, health or immunogenicity data, and lifestyle factors such as smoking status, alcohol use, and BMI.
The company said healthcare professional contact and registration details were also exposed, raising the risk of targeted phishing and impersonation attempts over email, phone, and WhatsApp. Novo Nordisk took affected internal systems offline as a precaution, brought in external cybersecurity experts to investigate, and said core business operations were not impacted, while the total number of affected individuals and the full scope of the breach remain under investigation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Novo Nordisk said it notified Danish regulators after discovering the intrusion into its internal IT infrastructure. The company also said it engaged external cybersecurity experts to investigate the incident.
A report said threat actor FulcrumSec leaked Novo Nordisk data after an alleged $2.5 million demand went unpaid. This represented a post-disclosure escalation tied to the previously disclosed cybersecurity incident.
DataBreaches reportedly received Signal messages from another person claiming they had also hacked Novo Nordisk and demanded $50 million. This introduced a separate extortion claim beyond FulcrumSec's previously reported $25 million demand.
SecurityWeek reported that FulcrumSec claimed responsibility for the Novo Nordisk intrusion, alleging it first gained access in March via a GitHub access token and then used cloned repositories to locate additional credentials. The group claimed it stole about 1.3 TB of data, including intellectual property, and said it demanded a $25 million ransom before threatening to leak the data.
As part of its response to the breach, Novo Nordisk took some internal systems offline as a precaution and engaged external cybersecurity experts to investigate. The company stated that core business operations were not affected and that the full scope of the incident was still under investigation.
Novo Nordisk disclosed that attackers accessed a limited number of internal IT systems and copied non-public data related to some clinical trial participants and healthcare professionals. The company said the participant data was pseudonymized and did not include direct identifiers, but included sensitive health-related and trial information, while healthcare professional data created phishing and impersonation risks.
Sysdig reported that FulcrumSec has been active since at least September 2025 and has claimed roughly 25 victims across 11 countries. The report characterized the group as a cloud-focused extortion actor that steals data without deploying ransomware.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
28 references tracked. Mallory keeps watching after this page renders.
webflow.sysdig.com
Open sourcewebflow.sysdig.com
Open sourceteiss.co.uk
Open sourcecybelangel.com
Open sourcetheregister.com
Open sourcenovonordisk.com
Open sourcedatabreaches.net
Open sourcedatabreaches.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Medtronic disclosed that unauthorized actors accessed certain corporate IT systems between April 13 and April 19, exposing personal and health-related information tied to **3,834,294 individuals**. The company said the incident was detected after unusual activity on April 15 and attributed in public reporting to the **ShinyHunters** extortion group, which claimed to have stolen about **9 million records** and briefly listed Medtronic on its Tor-based leak site before the post disappeared. Exposed data may include names, contact details, dates of birth, Social Security numbers, and other health-related information. Medtronic said it found **no impact** on medical devices, patient safety, hospital customer networks, manufacturing and distribution operations, financial systems, or care delivery, and added that it has no evidence the stolen data was publicly released online. The company has engaged external cybersecurity experts, notified law enforcement and regulators, and is warning affected people to watch for phishing, social engineering, and unauthorized account activity while offering **24 months** of credit monitoring, dark web monitoring, and identity theft recovery services.
Jul 8, 2026
FulcrumSec released another tranche of data allegedly stolen from **Novo Nordisk**, escalating a breach the company had previously disclosed. The newly exposed material reportedly includes the company's enterprise **Hugging Face** AI/ML environment, with about **30 models**, **70 datasets**, and roughly **0.5 TB** of proprietary **Cell Painting** microscopy images. The latest dump was described as separate from FulcrumSec's original leak, indicating continued publication of data after the initial incident. Reporting on the release said the disclosure expands the scope of the breach beyond earlier claims and raises concerns over the exposure of sensitive research and machine learning assets tied to Novo Nordisk's internal operations.
Aug 13, 2026
A threat actor has claimed to have breached enterprise intelligence software provider **InfoDesk** and is offering the allegedly stolen data for sale on a dark web forum. Reporting indicates the sample data included five records from each of 18 organizations, along with InfoDesk records, and the actor claimed to hold as many as 1,000 records in total. The exposed information reportedly consists primarily of employee full names and corporate email addresses tied to major organizations, including firms in the pharmaceutical, healthcare, financial, consulting, and nonprofit sectors; Cybernews specifically said the data involved employees at companies such as **Moderna**, **Johnson & Johnson**, and **Bayer**. Researchers said the immediate danger is not large-scale identity theft but highly targeted phishing and social-engineering attacks. Because the records appear linked to a known enterprise vendor, attackers could use the contact details to craft convincing lures for credential theft, malware delivery, or follow-on business email compromise. The alleged incident adds to broader concerns over third-party supplier exposure, where compromises at service providers can create downstream risk for multiple corporate customers at once.
Jun 29, 2026