Pharma giant Novo Nordisk hit by massive 1TB data hack

A cyber extortion group named FulcrumSec has claimed responsibility for a significant data breach at Novo Nordisk, a prominent pharmaceutical company. The group asserts that it exfiltrated over 1 terabyte of sensitive data from Novo Nordisk's networks.

FulcrumSec reportedly initiated contact with Novo Nordisk on June 1, demanding $25 million. However, the company allegedly refused to meet the ransom demands. Following this refusal, the hacking group announced it is considering private sales for portions of the compromised data, which is said to encompass proprietary information on released and unreleased drugs, and internal AI models.

Novo Nordisk had previously disclosed a cybersecurity incident on June 11, acknowledging unauthorized access to limited internal IT systems. This incident involved the potential exposure of certain personal data. FulcrumSec stated that its infiltration of Novo Nordisk's systems began in March and lasted over two months, prior to the company's public disclosure.

Experts who track FulcrumSec describe the group as generally credible regarding their capabilities and claims. Despite the breach, FulcrumSec indicated it would withhold certain data, including employee and physician information, as well as clinical trial patient data. They also pledged to withhold operational technology and software data as part of a "harm-reduction strategy."