Danish pharmaceutical giant Novo Nordisk A/S disclosed that it recently identified an IT security incident involving unauthorized access to a limited number of internal IT systems, resulting in exposure of certain personal data and external copying of non-public information. The company launched an investigation with assistance from external cybersecurity experts and is working with relevant authorities as it assesses the scope of the breach.
As part of its response, Novo Nordisk temporarily took certain internal systems offline and is gradually restoring them in a controlled manner. The company stated that its core business operations remain unaffected, though the incident affected a limited amount of data related to participants in some of Novo Nordisk’s clinical trials.
“Following the incident, we launched an investigation with the assistance of cybersecurity experts and have taken steps to address the situation,” the company said in a statement. “As part of our response, multiple security measures have been taken, including temporarily taking certain internal IT systems offline to protect our environment. We are working to bring the affected systems back online in a controlled and safe manner; however, we acknowledge this process takes time.”
It added that “Our core business operations are not impacted and remain up and running. Protecting the security and integrity of our systems, including personal data of our employees, customers, patients and stakeholders, remain our highest priorities.”
Novo Nordisk identified that exposed information consisted of pseudonymized data, including patient identification numbers, trial participation details, sex, year of birth, biomarkers, health and immunogenicity data, and lifestyle information such as smoking, alcohol use, and body mass index.
It added that the compromised data was not linked to names or other direct identifiers and that additional information required to identify individual participants was not exposed. As a result, the company said it does not believe the incident presents an immediate risk to affected patients. However, it has advised them to remain vigilant and report any suspicious activity.
“Based on the nature of the exposed data, the potential consequences of the incident include targeted phishing attempt through e-mails, phone and WhatsApp or fraudulent communications impersonating colleagues,” Novo Nordisk warned in a letter to HCPs. “We recommend that you remain vigilant against unexpected messages or calls and report any suspicious activity to us.”
Following the incident, the letter mentioned “we launched an investigation with the assistance of cybersecurity experts and have taken steps to address the situation. As part of our response, multiple security measures have been taken including temporarily taking certain internal IT systems offline to protect our environment. We are working to bring the affected systems back online in a controlled and safe manner; however, we acknowledge this process takes time. Our core business operations are not impacted and remain up and running. Protecting the security and integrity of our systems, including personal data of our employees, customers, patients and stakeholders remain our highest priority.”
Commenting on the attack, Jacob Krell, senior director for secure AI solutions and cybersecurity at Suzu Labs, wrote in an emailed statement that “Novo split this into a patient data story and a healthcare professional data story. Attackers will read it as one. Trial records are pseudonymized. The HCP exposure hands attackers names, phone numbers, WhatsApp details, and office locations of the physicians who ran those trials.”
He added that those physicians handle the records that connect coded patient IDs to real people. They were high-value targets before this breach named them.
“Social engineering a doctor whose WhatsApp number and office address you already have is faster than any statistical de-anonymization attack. Novo says re-identification ‘would require access to underlying information,’ Krell noted. “The exposed HCP contacts are a direct line to the people who hold that underlying information. Novo warned those physicians about targeted phishing via email, phone, and WhatsApp. That warning signals the exposed data has immediate operational value.”
He further identified that the HCP list outlasts this single incident. “Attackers now hold verified contacts for physicians running clinical trials at the world’s largest insulin manufacturer.”
In May, West Pharmaceutical Services disclosed that a ransomware attack disrupted manufacturing, shipping, and receiving operations across multiple global facilities after attackers breached its network on May 4. In a filing with the U.S. Securities and Exchange Commission, the company said hackers stole data and encrypted systems, prompting it to proactively shut down portions of its infrastructure to contain the incident.
The Novo Nordisk incident comes amid growing concerns over cyber threats targeting organizations that underpin critical supply chains and public well-being. Recent attacks have demonstrated how cyber incidents can disrupt real-world operations, with a cyberattack on Australian sugar producer Mackay Sugar forcing the shutdown of two mills, halting harvesting activities, and disrupting production operations. The attack highlighted how increasingly interconnected IT and OT environments can create pathways for cyber events to affect physical processes and business continuity.
As organizations continue to digitize operations and connect business systems with industrial environments, cyber incidents are no longer confined to data loss or IT outages. Instead, they can have cascading effects across production, logistics, and supply chains, underscoring the need for stronger cyber resilience across industries ranging from healthcare and pharmaceuticals to food production and agriculture.
