Novo Nordisk Reports Unauthorized Access to Systems Containing Personal Data
Summary
Novo Nordisk disclosed unauthorized access to a limited number of internal IT systems. Limited clinical-trial participant information was affected, and healthcare-provider details may have been compromised; the company says patient records lacked direct identifiers.
Key points
- Novo Nordisk said it discovered unauthorized access to a limited number of internal IT systems, including systems storing personal data.
- Information affected for some clinical-trial participants included randomly assigned patient IDs, trial participation, sex, birth year, biomarkers, health or immunogenicity data, and lifestyle factors.
- The company said the participant information was not directly linked to names or other direct identifiers and that identifying information was not exposed.
- Healthcare-provider names, registration numbers, email addresses, phone numbers, WhatsApp details, and office locations may have been compromised.
- No known cybercrime group had claimed responsibility for the attack.
Article Details
- Victim Organization
- Novo Nordisk
- Incident Type
- Unauthorized access to internal IT systems resulting in a personal data breach
- Data Types Exposed
- Randomly assigned patient IDs
- Clinical-trial participation information
- Sex
- Birth year
- Biomarkers
- Health or immunogenicity data
- Lifestyle factors
- Healthcare providers’ names, registration numbers, email addresses, phone numbers, WhatsApp details, and office locations
- Affected Records
- A limited amount of information related to patients participating in some clinical trials and healthcare providers; no record count was reported.
- Operational Impact
- Unauthorized access affected a limited number of internal IT systems. The article reports no operational disruption. Novo Nordisk said the exposed information did not include direct identifiers or information that would enable participants to be identified without access to underlying identifying information.
- Ransom Or Extortion
- No ransom or extortion activity was reported. No known cybercrime group appeared to have claimed responsibility.
- Claim Status
- confirmed