Novo Nordisk Hack: 1TB of Drug IP Stolen, $25M Extortion Demand

For pharma and biotech companies, the theft of Novo Nordisk’s intellectual property is a nightmare scenario—source code, drug formulations, and clinical trial data could be weaponized by competitors or hostile nations. The $25 million extortion demand, while rejected, highlights the astronomical value placed on pharmaceutical R&D in the criminal underground. As the group considers selling select drug data, the industry must brace for a potential erosion of competitive moats and increased espionage threats.

On June 16, 2026, cyber extortion group FulcrumSec publicly claimed to have breached Danish pharmaceutical giant Novo Nordisk, exfiltrating over a terabyte of highly sensitive data and demanding a $25 million payment. Novo Nordisk had already disclosed a cybersecurity incident on June 11, acknowledging unauthorized access to some internal IT systems and personal data, but the full scope alleged by the attackers—including source code, proprietary drug information, clinical trial data, employee and patient records, manufacturing details, and internal AI model data—would represent one of the most severe intellectual property and data thefts in the industry's history. The group, which first surfaced in October 2025, says it spent more than two months inside Novo Nordisk’s networks before initiating contact with executives on June 1. After the company refused to pay, FulcrumSec announced it is now exploring private sales of select drug-related data while withholding employee and patient data, citing a preference to open-source material as a deterrent against future non-payment.

“

On June 16, 2026, cyber extortion group FulcrumSec publicly claimed to have breached Danish pharmaceutical giant Novo Nordisk, exfiltrating over a terabyte of highly sensitive data and demanding a $25 million payment.

The incident highlights a troubling shift in cyber extortion tactics. Unlike traditional ransomware attacks that encrypt data and demand payment for decryption keys, FulcrumSec focused entirely on data theft and the threat of public release or sale. This removes the technical overhead of encryption and puts the onus squarely on the victim to prevent exfiltration. The $25 million demand is far above typical ransomware amounts, reflecting the perceived market value of pharmaceutical intellectual property, which can exceed a billion dollars in R&D investment for a single blockbuster drug. Novo Nordisk’s portfolio includes leading diabetes and obesity treatments, making its stolen data a potential goldmine for competitors, generic manufacturers, or even nation-states seeking to accelerate their own drug development programs.

From a regulatory perspective, the breach carries massive compliance implications. The alleged theft of patient and doctor data likely triggers notification requirements under GDPR in Europe and potentially HIPAA in the U.S., with fines that can reach 4% of global annual turnover. Clinical trial data, if exposed, could compromise the integrity of ongoing studies and erode trust in the company’s regulatory submissions. The company’s admission of unauthorized access to personal data suggests that at least some of FulcrumSec’s claims may be grounded in reality, though Reuters was unable to independently verify the sample data posted by the group.