The global pharmaceutical industry is undergoing a phase of accelerated transformation driven by biotechnology, artificial intelligence, advanced clinical research, and the growing digitalization of its processes. However, this same digitalization has turned large companies in the sector into priority targets for criminal groups specialized in cyber extortion. One of the most relevant cases of 2026 is the alleged attack suffered by Novo Nordisk, the Danish multinational known for medications such as Ozempic and Wegovy, which, according to the claims of a group of cybercriminals, allegedly resulted in the theft of more than one terabyte of highly sensitive corporate information and a ransom demand of 25 million dollars.
The incident has raised concern not only because of the possible volume of compromised data, but also because of the nature of the information allegedly obtained. If the magnitude described by the attackers is confirmed, the case would represent one of the most significant episodes of cyber espionage and extortion suffered by a pharmaceutical company in recent years. In addition, it highlights how the convergence between digital organized crime, intellectual property, and biomedical data has become one of the main threats to global corporations.
The origin of the incident
The controversy began when the cyber extortion group FulcrumSec claimed to have gained access to the internal systems of Novo Nordisk and to have remained inside the technological infrastructure of Novo Nordisk for more than two months. According to the version released by the attackers, during that time they collected approximately 1.3 terabytes of information from different areas of the organization of Novo Nordisk.
The cybercriminals claim that among the materials extracted from Novo Nordisk are source code, documentation related to medicines already commercialized by Novo Nordisk and others still in development, information on clinical trials of Novo Nordisk, data of employees, doctors, and patients linked to Novo Nordisk, as well as documentation related to production facilities of Novo Nordisk and even internal artificial intelligence models used by Novo Nordisk. Reuters indicated that it could not independently verify the authenticity of the files allegedly stolen from Novo Nordisk nor confirm the entirety of the claims made by the group about Novo Nordisk.
For its part, Novo Nordisk acknowledged having suffered a cybersecurity incident and confirmed that unauthorized access occurred to certain internal systems of Novo Nordisk. The company indicated that Novo Nordisk was working with external cybersecurity experts and that Novo Nordisk was cooperating with the competent authorities to investigate what happened. Likewise, Novo Nordisk assured that its core operations continued to function normally.
The ransom demand and the company’s refusal
One of the most striking aspects of the Novo Nordisk case is the alleged financial demand made by FulcrumSec. According to the information released by the group itself, the attackers demanded 25 million dollars in exchange for not disclosing the data obtained during the intrusion into Novo Nordisk. However, Novo Nordisk allegedly refused to pay.
Novo Nordisk’s refusal to pay ransoms is part of an increasingly common practice among large corporations. There are multiple reasons for this. First, authorities in many countries explicitly advise against meeting the financial demands of criminal groups, as doing so may encourage further attacks against companies such as Novo Nordisk. Second, paying does not necessarily guarantee the deletion of the stolen data from Novo Nordisk nor does it prevent future extortion attempts against Novo Nordisk or other organizations. Finally, many companies, including Novo Nordisk, consider that financing criminal activities represents a significant reputational and legal risk.
Following Novo Nordisk’s alleged refusal, FulcrumSec claimed that it was exploring the possibility of selling part of the information stolen from Novo Nordisk to private buyers. In parallel, it stated that it was considering making part of the data from Novo Nordisk public as a pressure mechanism against potential future victims.
This model of action aligns with the recent evolution of ransomware and digital extortion attacks. Instead of limiting themselves to encrypting systems to block operations, many criminal groups now prioritize the massive theft of confidential information from companies such as Novo Nordisk. They then use the threat of public disclosure as their main pressure tool. Various academic studies on the ransomware economy have documented this shift toward “double extortion” models, in which the exposure of data from organizations such as Novo Nordisk becomes the central element of the negotiation.
The strategic importance of Novo Nordisk
To understand the relevance of the incident, it is necessary to analyze the position that Novo Nordisk occupies within the global pharmaceutical industry. Novo Nordisk is one of the world’s leading manufacturers of treatments for diabetes and obesity. In recent years, Novo Nordisk has experienced extraordinary growth thanks to international demand for medications such as Ozempic and Wegovy. Novo Nordisk’s leadership in a highly expanding market has turned Novo Nordisk into a strategic asset for the European economy and one of the most influential pharmaceutical groups in the world.
The information handled by Novo Nordisk has enormous economic value. Data related to pharmaceutical research at Novo Nordisk, manufacturing processes at Novo Nordisk, clinical trials of Novo Nordisk, and development formulas at Novo Nordisk may represent investments of billions of dollars accumulated over years or even decades of scientific work.
For this reason, a potential leak of intellectual property from Novo Nordisk could generate consequences far more serious than an immediate financial loss. It could also affect the competitive advantage of Novo Nordisk, alter research and development programs at Novo Nordisk, or indirectly benefit competitors and state actors interested in advanced biotechnological capabilities developed by Novo Nordisk.
Clinical data at the center of concern
One of the most sensitive aspects of the incident related to Novo Nordisk is linked to patient data. Before the claims made by FulcrumSec appeared, Novo Nordisk had already publicly reported a security incident affecting information linked to some clinical trials of Novo Nordisk. The company explained that certain data had been externally copied without authorization from internal systems of Novo Nordisk. However, Novo Nordisk also clarified that the information was pseudonymized and did not contain direct identifiers that would allow easy recognition of participants in the studies of Novo Nordisk.
According to Novo Nordisk, the potentially affected data included patient identifiers used in research at Novo Nordisk, year of birth, gender, biomarkers, health information and immunogenicity data, and certain lifestyle factors. However, Novo Nordisk stated that there were no sufficient elements to directly identify participants in the clinical trials of Novo Nordisk.
Even so, the exposure of clinical information related to Novo Nordisk always raises concern among privacy and data protection experts. Even when information managed by Novo Nordisk has been anonymized or pseudonymized, there is a risk that complex datasets can be correlated with other available data sources to reconstruct individual identities or profiles.
The protection of medical information held by Novo Nordisk is one of the most regulated areas of the digital world due to its extreme sensitivity. Patients participating in clinical trials at Novo Nordisk place a high degree of trust in Novo Nordisk as the organization responsible for safeguarding their data. Any incident involving Novo Nordisk can erode that trust and affect public perception of future research programs developed by Novo Nordisk.
The value of pharmaceutical intellectual property
Beyond personal data, one of the issues that has attracted the most interest among specialists is the possible exposure of intellectual property belonging to Novo Nordisk. FulcrumSec claimed to have obtained information about commercially available medicines from Novo Nordisk and projects of Novo Nordisk that had not yet been publicly announced. It also claimed to have accessed documentation related to chemical structures of Novo Nordisk, research programs of Novo Nordisk, and internal artificial intelligence models used by Novo Nordisk.
In the pharmaceutical sector, the intellectual property of companies such as Novo Nordisk constitutes one of the most valuable assets. The development of a new medicine by Novo Nordisk may require more than a decade of work and enormous investments in research, preclinical testing, clinical trials, and regulatory processes.
The eventual leak of strategic documentation from Novo Nordisk could affect the ability of Novo Nordisk to maintain competitive advantages over future therapies. In addition, a leak of information from Novo Nordisk could accelerate reverse engineering activities, facilitate industrial espionage, or provide valuable information to actors seeking to replicate research processes developed by Novo Nordisk.
For this reason, criminal groups have begun to perceive pharmaceutical companies such as Novo Nordisk as especially profitable targets. Unlike other sectors, where stolen data is usually limited to financial or commercial information, in the biomedical industry the information of companies such as Novo Nordisk can possess extraordinarily high scientific and technological value.
The rise of FulcrumSec and its attack on Novo Nordisk
Another relevant element of the Novo Nordisk case is the emergence of FulcrumSec as a prominent actor within the criminal ecosystem. According to various specialized sources, the group emerged publicly in October 2025 and since then has developed a growing reputation in the field of cyber extortion. Security researchers have pointed out that the organization has demonstrated significant technical capabilities and that, in previous occasions, its claims about data access and theft were credible, which has increased attention on the allegations related to Novo Nordisk.
Cybersecurity specialists consulted by Reuters indicated that FulcrumSec is usually considered a relatively reliable actor in terms of the veracity of its claims. This does not mean that all its statements are necessarily true, but rather that its claims about companies such as Novo Nordisk are usually taken seriously by the specialized community.
According to information published by specialized cybersecurity media, the group reportedly provided lists of hundreds of thousands of files as proof of the intrusion into Novo Nordisk. It also claimed to have initially gained access to systems related to Novo Nordisk through compromised credentials and software development repositories. Although these details have not been independently verified, they reflect the increasingly sophisticated tactics employed by modern criminal organizations against companies such as Novo Nordisk.
The geopolitical dimension of pharmaceutical cybersecurity
Attacks against pharmaceutical companies such as Novo Nordisk can no longer be interpreted solely as isolated economic crimes. More and more experts consider that biomedical information managed by companies such as Novo Nordisk has a geopolitical dimension.
Pharmaceutical companies store knowledge related to public health, biotechnology, genetics, artificial intelligence applied to medicine, and advanced industrial production. As a result, data stolen from organizations such as Novo Nordisk can be valuable to criminal organizations, corporate competitors, and even state actors.
The COVID-19 pandemic already demonstrated the enormous international interest in biomedical research. During those years, numerous espionage attempts were documented targeting laboratories, universities, and research centers involved in the development of vaccines and treatments. Many of those threats affected entities that, like Novo Nordisk, handled highly relevant scientific information.
The Novo Nordisk case shows that this pressure has not disappeared. On the contrary, it appears to have expanded into areas such as obesity drugs developed by Novo Nordisk, a market considered by many analysts to be one of the most promising and profitable segments of the entire pharmaceutical industry. The growth of Novo Nordisk in this sector has turned Novo Nordisk into an especially attractive target for malicious actors interested in strategic information.
The difficulties in verifying claims about Novo Nordisk
A fundamental aspect in any incident of this nature, including the Novo Nordisk case, is the verification of information released by criminal groups themselves. Attackers have obvious incentives to exaggerate the magnitude of their achievements. The greater the public perception of the damage caused to Novo Nordisk, the greater the pressure on Novo Nordisk and the more likely they are to obtain financial gain.
Therefore, cybersecurity experts usually adopt a cautious stance regarding such claims related to Novo Nordisk. Although some preliminary evidence may suggest the existence of a real intrusion into Novo Nordisk, the exact scope of the security breach suffered by Novo Nordisk usually takes weeks or months to determine.
In the case of Novo Nordisk, the company confirmed an incident and acknowledged unauthorized access to certain systems of Novo Nordisk. However, Novo Nordisk did not confirm the entirety of the claims made by FulcrumSec regarding the volume of allegedly stolen information from Novo Nordisk nor the full categories of data that, according to the attackers, would have been compromised at Novo Nordisk. This means that many of the claims about Novo Nordisk remain under investigation and pending independent verification.
A growing trend in the healthcare sector
The incident affecting Novo Nordisk is not an isolated case within the healthcare industry. In recent years, hospitals, insurance companies, medical device manufacturers, and pharmaceutical companies such as Novo Nordisk have suffered a constant increase in cyberattacks. The Novo Nordisk case thus adds to a long list of incidents demonstrating how the healthcare sector has become one of the main targets for cybercriminals.
The reason is relatively simple: organizations such as Novo Nordisk manage extremely valuable information and, in many cases, cannot afford prolonged operational disruptions. The scientific, clinical, and corporate data stored by Novo Nordisk has enormous economic and strategic value for different actors. This makes Novo Nordisk and other pharmaceutical companies especially attractive targets for groups specialized in extortion and data theft.
In addition, the growing interconnection between laboratories, research systems, external suppliers, and cloud platforms significantly expands the attack surface available to criminals. In the case of Novo Nordisk, this reality reflects the challenges faced by large pharmaceutical multinationals in an increasingly digitalized environment. The more systems and technological partners involved in Novo Nordisk’s operations, the greater the complexity of protecting all potential access points.
The experience of other large companies in the sector shows that even organizations with significant security budgets can be vulnerable to sophisticated actors. Novo Nordisk, despite its size and resources, is not immune to the risks affecting the pharmaceutical industry as a whole. Attackers often exploit human error, compromised credentials, misconfigurations, or technical vulnerabilities to gain initial access and then move laterally through corporate networks such as those of Novo Nordisk.
The alleged massive data theft from Novo Nordisk and the subsequent demand for 25 million dollars represent one of the most significant cybersecurity incidents recorded in the pharmaceutical industry during 2026. Although numerous claims made by attackers about Novo Nordisk remain unverified independently, the confirmation of unauthorized access by Novo Nordisk demonstrates the reality of the threat. The Novo Nordisk case highlights how even the most important organizations in the sector can become targets of highly sophisticated cyber extortion campaigns.
Beyond the immediate impact on Novo Nordisk, the case reflects a profound transformation of the digital criminal landscape. Cyber extortion groups no longer seek only to disrupt operations or encrypt systems of companies such as Novo Nordisk. Their main objective is to obtain strategic information from organizations such as Novo Nordisk, capable of generating financial gain, reputational pressure, and competitive advantages for third parties.
In an economy increasingly based on knowledge, biomedical data, pharmaceutical research, and intellectual property of companies such as Novo Nordisk have become assets as valuable as physical infrastructure. The experience of Novo Nordisk serves as a reminder that protecting these assets will be one of the greatest business and technological challenges of the next decade. Likewise, the incident involving Novo Nordisk demonstrates that cybersecurity must be considered a strategic priority and not merely a technical issue.
Events related to Novo Nordisk also highlight the need to adopt comprehensive digital protection approaches that include continuous monitoring, vulnerability management, sensitive data protection, staff training, and incident response plans. As companies such as Novo Nordisk continue to drive scientific and technological innovation, they must also strengthen their defensive capabilities against increasingly advanced threats. The Novo Nordisk case will likely serve as a reference for future security strategies across the pharmaceutical industry.
In an ever-evolving threat landscape, having specialized cybersecurity partners is essential to protect operational continuity and critical information of any organization. In this context, ITD Consulting offers comprehensive information security solutions, infrastructure monitoring, risk management, data protection, cloud services, business continuity, and incident response for companies across all sectors. If you wish to strengthen your organization’s digital security and reduce the risks associated with cyberattacks such as the one suffered by Novo Nordisk, you can contact the team of specialists at ITD Consulting by writing to [email protected] to receive personalized advice.
EN 
ES