FulcrumSec Claims 1.3TB Novo Nordisk Data Theft: Ransomware Claim — What’s Alleged & What To Do

On June 11, 2026, the group FulcrumSec claimed to have stolen 1.3 terabytes of data from Novo Nordisk, comprising more than 700,000 files. The group states that it demanded a $25 million ransom, which was not paid, and that it is now threatening to release or sell the material. Novo Nordisk has disclosed a breach in the preceding week but has not confirmed the group’s account of the incident or the contents involved. This event occurs amid repeated targeting of research-intensive sectors by actors who seek to monetize stolen intellectual property through extortion or secondary sales.

Breaking down the breach

The incident centers on an unverified claim by FulcrumSec that it exfiltrated 1.3TB of material from Novo Nordisk. The group lists more than 700,000 files and specifies proprietary drug compounds and AI models among the contents. No independent confirmation of the volume, file count, or data categories has been made public. Timing of the alleged access, the method of intrusion, and any evidence of data exfiltration remain undisclosed. Novo Nordisk’s own statement acknowledged a security event without detailing scope or attribution.

Inside fulcrumsec

FulcrumSec operates as a hack-and-leak group that publicly lists claimed victims on leak sites and issues ransom demands. In this instance the group claims responsibility for the Novo Nordisk intrusion and states that the ransom went unpaid. No further details about the group’s infrastructure, prior confirmed operations, or specific tactics used against this target have been released by investigators or the organization.

About Novo Nordisk

Novo Nordisk is a major pharmaceutical company engaged in the research, development, and production of medicines, including treatments for diabetes and other chronic conditions. Organizations of this type routinely maintain extensive repositories of research data, compound libraries, clinical trial records, and increasingly, machine-learning models used to accelerate discovery. A successful intrusion into such systems can expose years of non-public work whose value lies in competitive advantage rather than immediate personal identifiers.

The information in question

The group claims the stolen material includes proprietary data, drug development data, and AI models. The precise categories and volume of any personal or employee information have not been disclosed. Organizations in this sector commonly hold the following types of records, though whether any of these were involved here is unconfirmed:

• Research compound structures and synthesis pathways
• Pre-clinical and clinical study datasets
• Proprietary algorithms and trained AI models
• Internal project documentation and regulatory filings

Why it matters

Pharmaceutical research data carries both commercial and, in some cases, public-health implications when its confidentiality is lost. Unauthorized disclosure can accelerate competitive replication of compounds or undermine ongoing development programs. For the organization, the incident adds costs related to investigation, potential regulatory scrutiny, and remediation. For individuals whose information might be present in supporting systems, risks remain speculative until the actual data types are clarified.

Were you affected?

Because the number of individuals whose personal information may be involved is unknown, the first practical step is to monitor official statements from Novo Nordisk for any future notifications. Readers can also run a free exposure scan of their email address against known breach datasets to check for prior appearances of their information in other incidents. If contacted by the company, follow its instructions for any offered monitoring or support services.

AICompiled with AI assistance from public sources and published under our editorial standards.