Novo Nordisk
bd_bf4242a791e90407 · schema v1 · pii pii-v1
Full breach record for Novo Nordisk →2 incidents on filePress / market disclosure — not a breach-notification filing
A media or market posting that confirms an incident but carries no breach-notification fields, so compliance clocks aren't assessable. The summary below is extracted from the coverage — verify against the source.
databreaches.net. Novo Nordisk: Pharmaceutical giant Novo Nordisk was the victim of a major cyberattack claimed by the FulcrumSec group. The intrusion lasted approximately two and a half months, beginning with the exploitation of an exposed GitHub access token. "Pseudo-anonymized" data (without direct names) from 11,500 clinical trial participants was stolen, along with personal contact information of healthcare professionals and intellectual property: FulcrumSec claims to have exfiltrated 1.3 TB of data, including drug secrets (such as Amycretin), 41,000 molecular structures, and 32 private AI models. Novo Nordisk refused to pay the $25 million ransom demanded. Linked ransomware group: fulcrumsec.
J jump to incidentP pin to compareR raw source
Incident timeline — mostly unverified
? — ?
Breach window unknown
Jun 7, 2026
Press report
—
Corroborated · see linked filings
Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.
Attack → press
—
Compliance clock
Not assessable
Linked disclosures
Why this link?Ransomware claims (1)
- Leak Sitefulcrumsecbd_ec70dd8f54a22f372026-06-16 · +9dCandidate
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.
Source ceiling
- incident type + narrative only (may be machine-translated)
- discovery date
- materiality
- affected count
- data types
- compliance clock
The ✕ fields stay blank until a regulatory filing or victim disclosure lands.
fulcrumsec
According to ransomware.live, FulcrumSec is a data extortion group active since approximately September 2025, specializing in high-speed exfiltration of cloud-hosted databases by exploiting unrotated API keys and misconfigured cloud permissions rather than deploying encryption, with known victims including Australian fintech youX and LexisNexis.