Novo Nordisk breach steals clinical-trial information and healthcare professionals’ contact details
Novo Nordisk confirmed theft of coded clinical-trial records and healthcare professionals’ contact details. It says patients’ direct identifiers were not exposed. Watch for impersonation messages; privacy questions can go to [email protected].
Novo Nordisk says trial participants need take no specific action because the information needed to identify them was not exposed. Affected healthcare professionals should watch for unexpected emails, calls or WhatsApp messages, including messages pretending to be colleagues. Report suspicious activity or ask privacy questions at [email protected].
What’s happening
Novo Nordisk disclosed on 11 June that intruders had copied personal and other non-public information from internal systems. Some clinical-trial records contained coded patient IDs, health measurements and lifestyle information. Novo Nordisk says names and other direct identifiers, and the separate information needed to identify participants, were not exposed. Healthcare professionals’ names, registration numbers and contact details were also involved, creating a risk of targeted phishing. The company took some systems offline and brought in external investigators while core operations continued. On 16 June, Reuters reported FulcrumSec’s claims of a much larger theft and an unpaid US$25 million demand; Reuters could not verify the published data. Novo Nordisk subsequently confirmed related proposed US class actions in its 4 August financial report. As checked through 3 November, its public incident notice still describes an ongoing investigation and gives no final affected-person count or confirmation that all affected systems have been restored. Recovery of the stolen data and subsequent phishing using it remain unconfirmed.
- What
- Breach
- Affects
- Novo Nordisk clinical-trial and healthcare-professional records
- Fixed in
- Nothing to patch
- Since
- 11 June 2026
- Closed
- 4 Aug 2026
Timeline
- Update
Novo Nordisk’s half-year financial report confirmed multiple proposed US class actions concerning the incident. The complaints allege negligence and exposure of personal and protected health information; these are allegations, not findings.
- Update
Reuters reported that FulcrumSec claimed to have stolen more than a terabyte and unsuccessfully demanded US$25 million. Novo Nordisk acknowledged claims of online publication, but Reuters could not verify the posted data; the attackers’ claimed count of roughly 11,500 trial participants was not company-confirmed.
- Made publicNothing to patch
Novo Nordisk disclosed unauthorised access to a limited number of internal systems and confirmed that personal and other non-public data had been copied. It took some systems offline, involved external cybersecurity experts and contacted authorities; core business operations continued.
- Update
A separate notice said healthcare professionals’ names, registration numbers, email addresses, phone and WhatsApp details, and office locations were involved, though not every category applied to everyone. It warned about targeted phishing and messages impersonating colleagues.
- Update
A patient notice listed trial IDs, trial participation, sex, birth year, biomarkers, health and immune-response information, and lifestyle factors among the exposed categories. Novo Nordisk said the separate information needed to identify participants had not been exposed.
Sources
- Novo Nordisk A/S: IT Security incident at Novo NordiskNovo Nordisk · 11 June 2026
- Information letter for patients regarding Novo Nordisk IT incidentNovo Nordisk · 11 June 2026
- Information letter for HCPs regarding Novo Nordisk IT incidentNovo Nordisk · 11 June 2026
- IT security incident at Novo Nordisk — incident updateNovo Nordisk · 18 June 2026
- Pharma giant Novo Nordisk discloses breach of clinical trials dataBleepingComputer · 12 June 2026
- Hacking group claims major hack of Novo Nordisk and attempted $25 million extortionReuters · 16 June 2026
- Financial report for the period 1 January 2026 to 30 June 2026Novo Nordisk · 4 Aug 2026