FulcrumSec, a hacking group that appeared only last October, claims it spent more than two months quietly inside Novo Nordisk's networks and walked out with over a terabyte of data. When the Danish drugmaker behind Wegovy and Ozempic refused to pay $25 million to keep it quiet, the group announced it is now exploring selling parts of what it took.

Novo Nordisk disclosed a cybersecurity incident on June 11, acknowledging unauthorized access to a limited number of internal systems and confirming that some personal data was involved. The company has not publicly responded to FulcrumSec's specific claims, and Reuters could not independently verify the data the group has posted.

What FulcrumSec says it has

According to the group's own account, the haul is wide. It says it took company source code, information on both released and unreleased drugs, clinical trial data, internal AI model data, and records tied to Novo Nordisk's production facilities, including software used to interact with sensors and factory machinery.

It also says it has personal data on thousands of employees and physicians, and records for roughly 11,500 clinical trial patients (stored in pseudonymized form, meaning identities are masked but not perfectly protected).

FulcrumSec says it will withhold those categories. It framed this as a "harm-reduction strategy." Whether that framing holds if a private sale proceeds is a different question.

DataBreaches.net reported that FulcrumSec told the publication it gained access in March, and shared what it says is correspondence with Novo Nordisk starting June 1, including a file list of more than 700,000 items totaling roughly 1.3 terabytes.

Thomas Willkan, head of research at cybersecurity firm Lab-1, told Reuters that FulcrumSec is "usually quite legit in terms of both their capabilities and also their claims." That is not a reassuring sentence for Novo Nordisk.

Why the stakes are unusually high here

Most corporate breaches are damaging but contained. This one, if the claims hold up, sits at the intersection of several things that compound the harm.

Novo Nordisk is one of the most commercially significant pharmaceutical companies in the world right now. Its obesity and diabetes drugs are reshaping medicine and driving enormous revenue. Data on unreleased drugs, formulations, or trial results would have obvious value to competitors or to anyone trying to undercut a patent. That is a different category of risk than stolen employee emails.

The factory-level software is a second concern. Information on operational technology at pharmaceutical production facilities, the software that talks to the machinery that makes drugs, is sensitive in ways that go beyond competitive intelligence. FulcrumSec says it is withholding that data. The fact that it has it is the problem.

And the clinical trial data touches patients directly, even in pseudonymized form. Health records are among the most durable sensitive data there is because a person's medical history does not expire.

There is also a separate, unrelated breach being reported. VX-Underground, a malware research site, reported Monday on an unnamed hacker who had separately compromised Novo Nordisk. FulcrumSec says its attack is distinct. The coincidence is worth watching.

Pharmaceutical companies have been targets for years, but the combination of blockbuster drugs, factory systems, and patient records in a single claimed breach makes this one worth following closely as Novo Nordisk and investigators work to verify what actually left the building.