FulcrumSec claims it breached Novo Nordisk networks and demanded $25 million ransom

FulcrumSec Claims Two-Month Breach of Pharmaceutical Giant

A cyber extortion group calling itself FulcrumSec announced on Monday that it had infiltrated Novo Nordisk's networks and extracted roughly 1.3 terabytes of data over a period exceeding two months1

1

. The hacking group claims to have stolen proprietary drug information, source code, clinical trial data, employee records, patient information, and details related to internal AI models2

2

. Novo Nordisk, the Danish maker of weight-loss drugs Wegovy and Ozempic, confirmed it detected unauthorized access to certain internal IT systems but declined to verify the specific volume or categories of stolen data1

1

.

The $25 Million Ransom Demand and Refusal

FulcrumSec demanded $25 million ransom to keep the stolen data private, but Novo Nordisk refused to pay1

1

. According to the group, company representatives contacted them on June 3, roughly 48 hours after the initial outreach to unnamed executives, using a random Proton Mail address to verify the breach by requesting specific files only the company would recognize2

2

. Following the refusal, FulcrumSec said it was exploring private sale of some data related to certain drugs and other internal material2

2

. The company's decision aligns with what most security professionals advise, though it guarantees the next phase: the material is likely to leak or sell on criminal markets1

1

.

What Makes This Data Breach Significant

The breadth of the alleged theft matters more than the ransom note itself. What FulcrumSec says it took reads like an index of everything a pharmaceutical company would least like to lose: information on both released and unreleased drugs, details of manufacturing facilities, and material tied to the company's internal AI models1

1

. This was not a single database left exposed but a long walk through the building, according to the group's own account1

1

. Thomas Willkan, head of research at cybersecurity firm Lab-1 who has closely tracked FulcrumSec, said the hacking group is "usually quite legit in terms of both their capabilities and also their claims"2

2

.

The Double-Extortion Playbook and Harm-Reduction Claims

FulcrumSec, which surfaced in October 2025, has followed the standard double-extortion playbook: infiltrate systems, exfiltrate quietly, then threaten publication rather than encrypting files1

1

. The model works because stolen healthcare and research data has durable value on criminal markets, useful for fraud, identity theft and targeted phishing long after the initial theft1

1

. However, the group claims to be withholding certain sensitive information as part of a harm-reduction strategy, including data on thousands of employees and physicians, roughly 11,500 clinical trial patients filed under pseudonyms, and operational technology used to interact with sensors and machinery at production facilities2

2

. A FulcrumSec representative also stated the group would prefer not to sell data, "as open sourcing it is a more effective deterrent for future companies to avoid paying"2

2

.

What This Means for Healthcare Security

The two-month dwell time should worry boards more than the ransom itself. Two months is not a smash-and-grab operation1

1

. Novo Nordisk disclosed the cybersecurity incident on June 11, confirming it involved unauthorized access to a limited number of internal IT systems that included access to certain personal data2

2

. The company is now in the uncomfortable position of having made the defensible choice to refuse payment while still facing the consequence of potential data exposure1

1

. Whether to ban ransom payments outright remains a question that has split the cybersecurity industry for years, and cases like this demonstrate exactly why the debate continues.