Novo Nordisk Hit by $25M Extortion — Hackers Stole AI Models and Clinical Trial Data

The Attack

Novo Nordisk, the Danish pharmaceutical giant behind Ozempic and Wegovy, confirmed a cybersecurity incident after the **FulcrumSec** extortion group claimed to have stolen **1.3 terabytes** of data including clinical trial information and internal AI models.

What Was Stolen

Clinical Trial Data

AI and Machine Learning Assets (Claimed)

The Ransom Demand

FulcrumSec demanded **$25 million** from Novo Nordisk. When the company refused to pay, the group began leaking data on June 15, 2026.

AI vs AI: The Disturbing Innovation

What makes this case unprecedented:

1. **Attackers stole Novo Nordisk's AI models**

2. **They ran their own AI agents** to analyze what they had

3. **A second set of models** was used to adversarially critique the first analysis

4. **The result**: A comprehensive report on the value of the stolen research

FulcrumSec claimed this AI-generated analysis could save "other researchers or competitors 3-5 years of program development."

The Entry Point: Stealer Logs

Security researchers found that Novo Nordisk was heavily exposed in the infostealer economy:

This suggests the initial access may have come through credential theft via commodity infostealer malware.

Impact on Healthcare

For Pharmaceutical Companies

For Healthcare Organizations

How to Protect Your Organization

1. **Monitor stealer logs** for leaked credentials (tools like Flare, SpyCloud)

2. **Implement hardware security keys** for critical systems

3. **Segment AI/ML infrastructure** from general network

4. **Encrypt training data and models** at rest and in transit

5. **Regular security assessments** of research environments

Check Your Domain

Scan your domain for vulnerabilities and exposed services.

[Free security scan](https://vaarta.space)