Novo Nordisk Reports Data Theft as FulcrumSec Claims Hack
Summary
Novo Nordisk said hackers accessed internal IT systems and exfiltrated pseudonymized clinical-trial data. FulcrumSec claims it used a GitHub token to steal 1.3 TB, demanded $25 million, and threatens to leak it.
Key points
- Novo Nordisk disclosed that hackers accessed internal IT systems and exfiltrated data associated with clinical trials.
- The company said the stolen information was pseudonymized and could not be directly linked to patients by name or identifiers.
- FulcrumSec claims it accessed the company in March using a GitHub access token, then cloned repositories and found additional credentials.
- The group claims it stole about 1.3 TB of data and supplied a list of more than 700,000 files as proof.
- Data the group says it stole allegedly includes undisclosed drug programs, compound structures, the Dicerna RNAi pipeline, and private AI models.
- FulcrumSec demanded $25 million and is threatening to leak data; Novo Nordisk had not appeared on the group's Tor-based leak site at publication.
Article Details
- Victim Organization
- Novo Nordisk
- Incident Type
- Unauthorized access to internal IT systems and data exfiltration; FulcrumSec claimed responsibility.
- Data Types Exposed
- Pseudonymized data associated with clinical trials, reported by Novo Nordisk
- Intellectual property, including undisclosed drug programs, proprietary compound structures, the Dicerna RNAi pipeline, and private AI models, allegedly stolen according to FulcrumSec
- Affected Records
- FulcrumSec provided a list of over 700,000 files as proof; the number of affected records was not disclosed.
- Affected Data Size
- FulcrumSec claimed it stole roughly 1.3 terabytes of data.
- Operational Impact
- Hackers accessed Novo Nordisk's internal IT systems. No further operational impact was reported.
- Ransom Or Extortion
- FulcrumSec demanded a $25 million ransom. The extortion attempt reportedly failed, and the group threatened to leak the allegedly stolen data. Novo Nordisk had not been listed on the group's Tor-based leak site at publication.
- Claim Status
- confirmed