Novo Nordisk data breach (June 2026): what Novo confirmed
In June 2026 Novo Nordisk disclosed unauthorized access to some internal IT systems; an extortion group then claimed more than a terabyte of data.
Short answer
Was Novo Nordisk hacked?
Yes. Novo Nordisk confirmed unauthorized access to a limited number of internal IT systems and exposure of pseudonymised clinical-trial data, which it says is not linked to patient names or directly identifiable personal information.
FulcrumSec claimed more than 1 TB of data and a $25 million ransom demand that Novo refused, and began leaking files. Novo has not confirmed the volume.
Timeline at a glance
11 Jun 2026Novo discloses unauthorized access; pseudonymised trial data exposed. (Fierce Pharma)Confirmed
15 Jun 2026FulcrumSec claims 1 TB+ and leaks files after a $25M demand. (The Next Web)Unverified claim
Last updated October 31, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.
Novo Nordisk’s security posture at the time
What Novo Nordisk publicly said about its security certifications and controls, how big it is, and how its shares moved, each tied to a source. A certificate covers a stated scope at a point in time; it is not a guarantee about every system. Reviewed 31 October 2026. Compare all 2026 breaches.
Security certifications publicly held
No public certification found.
No public certification found on the company’s own security, trust or compliance pages, in filings, or in the certificate registries searched (BSI, CSA STAR). That is a data point, not proof that none exists.
Reported price moves around the disclosure conflict between outlets; no reliable figure is shown.
Novo Nordisk incident timeline, in detail
Confirmed = acknowledged by Novo Nordisk, a regulator filing or a court. Reported = credible reporting Novo Nordisk has not fully confirmed. Unverified claim = an attacker or leak-site claim.
11 Jun 2026ConfirmedIntrusion / extortion
Internal systems accessed; extortion group leaks files
What happened. Novo Nordisk confirmed unauthorized access to a limited number of internal IT systems and exposure of pseudonymised clinical-trial data, which it says is not linked to patient names. FulcrumSec claimed more than 1 TB of data and a $25 million ransom demand, which Novo has not confirmed.
Impact. Pseudonymised clinical-trial data exposed, per Novo. People or records affected: Not disclosed; Novo says the data does not directly identify trial participants.
We found no SOC 2 or ISO 27001 certification published by Novo Nordisk. That does not prove it had none; it means none was public.
A direct intrusion
The company describes unauthorized access to its own systems. The useful questions are how long the access lasted, how it was detected, and whether the affected system was inside the scope any certification covered.
What it means for Novo Nordisk trial sites, research partners and investors — and what to do
What Novo Nordisk’s customers, partners and security teams can do now, based only on what has been disclosed.
1.Ask what was in scope
Ask which systems were reached, what data of yours they held and the dates of access.
Yes. Novo Nordisk confirmed unauthorized access to a limited number of internal IT systems and exposure of pseudonymised clinical-trial data, which it says is not linked to patient names or directly identifiable personal information.
Did Novo Nordisk have SOC 2 or ISO 27001 certification?+
We found no SOC 2 or ISO 27001 certification published by Novo Nordisk. That does not prove it had none; it means none was public.
More in the Breach Index
Same sourced, verification-tagged timeline, company by company — compare how peers have fared.
Independent analysis for security-leadership education; not affiliated with or endorsed by Novo Nordisk. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.
🎉 New here? Use code WELCOME10 for 10% off any plan at checkout