Danish pharmaceutical giant Novo Nordisk confirmed on 11 June 2026 that attackers gained unauthorized access to what the company described as "a limited number of internal IT systems," and later acknowledged that "some non-public data, including personal data" had been copied externally (as reported by DeafNews and CyberClan). The extortion group FulcrumSec claims responsibility, says it held access for more than two months, and demanded a $25 million ransom that Novo Nordisk refused. The group has since published its haul in stages, with the total claimed volume reported consistently at roughly 1.3 terabytes across sources. Novo Nordisk has not publicly disputed the group's technical claims, and Ingeniøren reports that CEO Mike Doustdar has at no point commented publicly on the attack.
A caveat that shapes everything below: no primary-tier document sits in this source set. Novo Nordisk's own statements reach us only through secondhand reporting, and nearly every claim about scope, volume, and intrusion method originates with the threat actor. Treat the attacker's numbers as claims, not findings.
What Happened
The publicly reported timeline runs roughly as follows. Initial access is placed in March 2026 by both BitRss and CyberClan. FulcrumSec claims it then moved laterally and collected data undetected through April and May. On 11 June 2026, Novo Nordisk disclosed the incident, stating that core operations were not disrupted (Noah Intelligence). FulcrumSec claimed responsibility shortly after and issued a $25 million demand; CyberClan and BitRss both report the company declined to pay.
The leak itself came in tranches, and the reporting on those tranches does not fully line up. Ingeniøren reports that FulcrumSec published a sample of the stolen material on 17 July, promising the remainder if no serious offers arrived, and then leaked 1.2 terabytes on the group's leak site on 12 August. BankInfoSecurity and DeafNews both date the "Stage 2" dump to 13 August and size it at 1.05 terabytes. Whether these describe the same event with differing figures or two adjacent publication steps is not resolvable from the available reporting; the accounts differ, and we flag that rather than picking one. All sources agree the cumulative claimed total is approximately 1.3 TB.
Independent corroboration exists but is limited. Ingeniøren says it has reviewed samples from the first leak and that several experts confirmed the data originated from Novo Nordisk. That is the strongest authenticity signal in the source set.
FulcrumSec's messaging has also shifted. BitRss, reporting in June, said the group intended to pursue targeted private sales of portions of the data. By August, per BankInfoSecurity, the group claimed it had received "a good deal of interest" from buyers in China but decided that "open sourcing the data was preferable to letting some lab in Suzhou skip a decade of R&D for a few million dollars." Whether that reflects a genuine ideological turn or a failed sales process is unknowable from outside.
What Was Taken
The claimed inventory spans intellectual property, research infrastructure, and personal data.
Stage 1, per FulcrumSec's own summary quoted by BankInfoSecurity, delivered "Novo's compounds, their manufacturing recipes, and their source code." BitRss's earlier reporting described source code, confidential pharmaceutical research, clinical study documentation, and proprietary AI system files.
Stage 2 is the more unusual component. BankInfoSecurity and DeafNews both report the group's claim of 30 Hugging Face AI models, 70 datasets, and half a terabyte of proprietary cell painting microscopy images, which the group frames as "the complete enterprise Hugging Face artificial intelligence and machine learning ecosystem." Ingeniøren characterises the same tranche as internal AI models for drug development, confidential safety assessments of new pharmaceutical products, and a large archive of microscope images and internal research questions.
On personal data, the picture is partial. DeafNews reports FulcrumSec claims to hold PII for 46,843 Danish healthcare professionals, 506,007 clinical investigators, and 2,852 clinical trial staff, and says it withheld that material. BitRss similarly reported the group pledged to withhold patient information, employee records, and production facility data. Ingeniøren reports that Novo Nordisk has confirmed the stolen data includes patient information, and that the hackers state they have chosen not to publish sensitive personal data. Novo Nordisk's position, per BioIntel, is that the accessed clinical trial information should not permit third parties to directly identify participants under typical circumstances.
That last claim is contested on principle rather than on fact. Noah Intelligence's analysis argues the incident sharpens a live debate over when pseudonymised clinical-trial data becomes effectively identifiable, particularly when an attacker also holds rich adjacent datasets and AI tooling capable of linkage. A withheld dataset is also a retained dataset; the restraint is unilateral and revocable.
Why It Matters
Three things distinguish this incident from a routine large-volume exfiltration.
First, the target class. DeafNews argues this is the first time an extortion actor has claimed the complete exfiltration of an industrial AI ecosystem, including the training artifacts that determine a model's predictive capability. Stolen documents describe past work; stolen models, weights, and curated training datasets are productive capital. FulcrumSec framed it explicitly: "Stage 2 gives the world the machines and datasets used to create new ones." Defenders who have treated ML infrastructure as a research annex rather than a crown-jewel asset should revisit that classification.
Second, refusal did not end the exposure, it staged it. Non-payment moved the incident into a months-long drip campaign with sustained press and market attention. BitRss notes NVO stock sat near $66 at the time of the June disclosure and was already under pressure, with the breach adding a further complication for investors. That is a real cost, but it is the predictable cost of the correct decision; paying would have bought a promise from the same party now publishing the data anyway.
Third, the legal tail is already forming. MedWatch reports several US class-action suits alleging Novo Nordisk failed to adequately protect personal and health data, while noting the company has not set aside any major provisions. For clinical trial sponsors, the liability surface extends well beyond employees to investigators, site staff, and participants across jurisdictions.
A note of caution on characterisation: CyberClan describes the incident against a generic double-extortion template that includes an encryption stage. No source in this set reports that Novo Nordisk systems were encrypted, and the reporting throughout is consistent with theft-and-leak extortion only.
The Attack Technique
Here the sources genuinely conflict, and both accounts trace back to the threat actor rather than to the victim or an incident responder.
BitRss reports FulcrumSec's claim that entry came via a GitHub authentication token discovered in March, which granted access to internal software repositories and was used to maintain persistent access for more than two months. DeafNews reports a different attacker statement: that initial access occurred via secrets exposed in client-side JavaScript on two separate Novo Nordisk subdomains. CyberClan splits the difference with a general description of "exposed credentials and tokens" in March.
These are not necessarily incompatible. Secrets leaked in client-side JavaScript is a plausible mechanism for how a GitHub token became available in the first place, and the two accounts may describe different links in one chain. But no source reconciles them, and Novo Nordisk has published no technical detail of its own. What all versions share is the core failure mode: a long-lived credential exposed somewhere it should never have been, granting repository-level access, followed by a dwell time measured in months before detection. There is no exploit in this story. There is a secret in the wrong place.
What Organizations Should Do
- Hunt for secrets in client-side assets, not just in repositories. Scan deployed JavaScript bundles, sourcemaps, and public subdomains for tokens and keys. Most secret-scanning programs cover the git history and stop there, which is exactly the gap described in the DeafNews account.
- Kill long-lived VCS credentials. Move to short-lived, workload-scoped tokens with mandatory expiry for GitHub, GitLab, and CI systems. Inventory every personal access token and fine-grained token in the org, and set a hard maximum lifetime. A token that cannot survive two months cannot support two months of access.
- Classify ML infrastructure as crown-jewel data. Model registries, Hugging Face enterprise workspaces, training datasets, and experiment tracking systems need the same access control, egress monitoring, and logging as your clinical and manufacturing systems. Enumerate who and what can pull a model artifact today.
- Alert on bulk egress volume, not just on anomalous logins. Terabyte-scale exfiltration over weeks should be detectable at the network and cloud-storage layer. Set volumetric baselines per repository, per bucket, and per service account, and treat sustained deviation as an incident.
- Rehearse a refusal, not just a payment decision. If your board declines to pay, the incident becomes a months-long staged disclosure with press, regulator, investor, and litigation workstreams running concurrently. Novo Nordisk's public silence, noted by Ingeniøren, is itself now part of the story. Pre-build the communications plan for tranche two and tranche three.
- Map the personal-data blast radius beyond employees and patients. Investigators, site staff, and healthcare professionals appear in the claimed PII counts. Data-subject notification obligations and class-action exposure follow those populations too, and the pseudonymisation defence, as Noah Intelligence notes, is weaker when an attacker also holds the linking datasets.
Sources: Novo Nordisk (NVO) Stock Under Pressure as Hackers Leak Stolen Data... | Extortion Gang Leaks Novo Nordisk's 'AI and ML Ecosystem' | Novo Nordisk hit by another massive data leak, but the company rema... | Fulcrumsec Publishes Second Novo Nordisk Leak Tranche: 1.05 TB… De... | Novo Nordisk Cyberattack: What Happened and Why it ... | Novo Nordisk cyber incident blurs lines between pseudonymised data... | Cyberattack leads to US lawsuits against Novo Nordisk | Novo Hit with Cybersecurity Breach: Trial Participants Urged to be...