On 1 June 2026, FulcrumSec contacted Novo Nordisk with an extortion demand and a claim that should alarm any security team: the group said it had been sitting inside the pharmaceutical giant's network for more than two months, moving data out slowly enough to stay under the radar. The entry point was not a firewall failure or a phishing email. It was a client-side JavaScript bundle on a Novo Nordisk subdomain that contained an Azure container registry credential and a GitHub personal access token with reach into hundreds of internal repositories, left exposed in code the public could read.
With those credentials, FulcrumSec authenticated as a trusted system rather than breaking in as an outsider. Over roughly two months it moved through source code repositories, drug compound data, and AI infrastructure, exfiltrating in small increments designed to avoid triggering volume based alerts. A second, unrelated group calling itself TheUSERS007 claimed its own separate intrusion between 5 and 7 June, telling DataBreaches.net it had used what it described as a self-learning, adaptive AI engine for the surgical extraction of intellectual property. Two extortion crews were operating independently inside the same company's systems within days of each other.
Novo Nordisk confirmed the breach publicly on 11 June, taking a number of internal IT systems offline and bringing in external cybersecurity investigators. FulcrumSec published its claimed haul on 16 June: roughly 1.3 terabytes of data spanning source code, proprietary compound data tied to the GLP-1 pipeline behind Ozempic and Wegovy, 30 trained AI models, and pseudonymised records for 11,500 clinical trial participants, including patient IDs, trial participation details, biomarker and immunogenicity data, and lifestyle information.
FulcrumSec demanded $25 million. TheUSERS007 demanded $50 million, a combined $75 million in ransom demands from two groups exploiting the same underlying failure. Novo Nordisk paid neither, and the attackers are now reportedly exploring a private sale of the stolen data, which means the exposure has no fixed endpoint. Every clinical trial participant, every piece of proprietary drug science, and every dollar of research investment behind the exfiltrated compounds now sits with parties Novo Nordisk cannot identify or control.
The defences that failed here were not weak by conventional standards. Novo Nordisk is a company with mature security operations, external monitoring, and the resources to run a full incident response programme the moment the breach surfaced. None of that mattered at the point that counted. A valid credential, however it was obtained, authenticated the attacker as a legitimate system identity, and every subsequent action, repository access, data pull, model export, looked like ordinary traffic from a trusted source. Two months of exfiltration produced no single event large enough to force a human to look at it and ask whether it should be allowed to happen.
A bulk export of clinical trial records, proprietary compound data, or trained AI models is an execution event, not a background process. Before a service account or API credential can pull data at that scale out of Novo Nordisk's systems, GoFirm sends a real-time confirmation request to the named authority responsible for that system, on their registered device, requiring biometric confirmation before the export executes. No confirmation, no export. It does not matter whether the credential is valid, whether the request originates inside the network, or whether the traffic pattern looks routine.
A stolen credential, however valid it appears on screen, cannot produce that confirmation on the named authority's own registered device through a separate channel. The execution boundary holds regardless of how the attacker gained access.
GoFirm is The Authority Platform. Stop unauthorised action. Every time.
In association with Osinto.ai, the collective intelligence platform for Security, Resilience & Defence. Osinto's AI-enabled open-source network and governed collaborative operational environment help mitigate the growing security, resilience and governance obligation in seconds, not days.
References
1. BleepingComputer, "Pharma giant Novo Nordisk discloses breach of clinical trials data," 11 June 2026, https://www.bleepingcomputer.com/news/security/pharmaceutical-giant-novo-nordisk-discloses-security-breach/
2. DataBreaches.net, "One threat actor demanded $50 million from Novo Nordisk. Another one demanded $25 million. Neither got paid.," 16 June 2026, https://databreaches.net/2026/06/16/one-threat-actor-demanded-50-million-from-novo-nordisk-another-one-demanded-25-million-neither-got-paid/
3. Cybersecurity Insiders, "FulcrumSec Spent Two Months in Novo Nordisk Networks Before 1.3TB Theft," June 2026, https://www.cybersecurity-insiders.com/pharmaceutical-data-breach-novo-nordisk-fulcrumsec/
4. Cybernews, "Novo Nordisk hackers threaten sale of 1.3TB data after $25M ransom rejection," June 2026, https://cybernews.com/news/novo-nordisk-hackers-ozempic-data-sale/
5. HIPAA Journal, "Hackers Claim Responsibility for Novo Nordisk Cyberattack," June 2026, https://www.hipaajournal.com/novo-nordisk-cyberattack/
6. SecurityWeek, "Ozempic Maker Novo Nordisk Says Hackers Breached IT Systems," June 2026, https://www.securityweek.com/ozempic-maker-novo-nordisk-says-hackers-breached-it-systems/