Novo Nordisk Confirms Breach Involving Clinical-Trial Data
Summary
Novo Nordisk says an unauthorized party accessed internal IT systems around June 11–12, 2026, and pseudonymized clinical-trial data was stolen. Attackers claim they also took Dragonfly AI models and research assets and are demanding ransom.
Key points
- Novo Nordisk says an unauthorized party accessed portions of its internal IT infrastructure around June 11–12, 2026.
- The company confirmed that pseudonymized clinical-trial data was stolen, including patient identifiers, birth year, gender, and health and immunogenicity data.
- Attackers claim they exfiltrated the Dragonfly multimodal AI model, proprietary datasets, training code, logs from 113 runs, internal infrastructure details, and container images.
- The attackers reportedly published material they say supports the authenticity of the stolen data; their claims about the AI and research assets are not presented as independently confirmed.
- The attackers are attempting to extort Novo Nordisk; whether the company will pay is unclear.
- Novo Nordisk notified Danish regulators and engaged outside cybersecurity experts to investigate.
Article Details
- Victim Organization
- Novo Nordisk
- Incident Type
- Unauthorized access to internal IT infrastructure, data theft, and attempted extortion
- Incident Date
- 2026-06-11
- Data Types Exposed
- Pseudonymized clinical-trial patient data, including identifiers, birth year, gender, health data, and immunogenicity data; Novo Nordisk confirmed that patient data was stolen.
- AI models, proprietary datasets, training code, training-run logs, container images, and internal infrastructure details; the attackers said these materials were exfiltrated.
- Affected Records
- Not disclosed
- Affected Data Size
- No total disclosed. The attackers reported 16.7 GB for the Dragonfly project, roughly 407 MB of datasets, around 50 MB of source code, and about 53 GB of container images; these figures are attacker-reported.
- Operational Impact
- No operational disruption is reported. The article says the stolen AI assets could erode Novo Nordisk's competitive advantage, but describes this as a potential impact.
- Ransom Or Extortion
- The attackers are reported to be attempting to extort Novo Nordisk and demanding a ransom. The amount is not disclosed, and whether Novo Nordisk will pay is unclear.
- Claim Status
- confirmed