Novo Nordisk reveals cyber attack: Ozempic and Wegovy maker say data breach in clinical trials

Novo Nordisk cyber attack exposed pseudonymized patient data from clinical trials (IDs, biomarkers, lifestyle factors)
The company insists that no direct PII was leaked, reducing the immediate risk of phishing or identity theft
Systems shut down for containment; Third-party experts investigating, core operations remain unaffected

Novo Nordisk, one of the largest pharmaceutical companies in the world, has confirmed that it recently suffered a cyber attack in which it lost sensitive data belonging to clinical trial patients.

The company claims that the data is pseudonymised and as such cannot be used in phishing scams or other follow-up attacks.

It then said the incident affected a “limited amount” of information related to patients participating in some of its clinical trials. Since personally identifiable information, such as names or addresses, was not disclosed, Novo Nordisk said it does not believe participants can be identified in any way.

Closing the network

In a public announcement published on its website on June 11, Novo Nordisk said it had recently observed unauthorized access to a “limited number” of internal IT systems: “The incident involved unauthorized access to certain personal data stored on the internal IT systems,” it said.

Instead, the crooks stole patient IDs (random alphanumeric strings) and information about trial participation, gender, year of birth, biomarkers, health and immunogenicity data, and lifestyle factors (smoking, alcohol use, etc.).

“Based on the nature of the exposed data as pseudonymized, knowledge of the patient’s identity would require access to additional information that was not part of the incident. We therefore do not consider the incident to pose any immediate risk to our patients,” the company confirmed. It still urged its patients to remain vigilant and report any unusual things they might encounter in the coming weeks.

Novo Nordisk did not say who the threat actors were or how many records were exposed in total, but it stressed that it had called in third-party cybersecurity experts to assess the damage. It also shut down certain IT systems to prevent further intrusions and was now working to bring them safely back online.

The company’s core businesses were not affected by this incident, it was confirmed, and all are currently up and running.

Via Bleeping Computer