Supernus Pharmaceuticals, NASDAQ: SUPN Listed by hive Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
The Supernus Pharmaceuticals, NASDAQ: SUPN Listed by hive Ransomware Group (reported February 25, 2022) is an unverified claim; the data involved is undisclosed belonging to roughly unknown people. If you have an account with them, your information may now be circulating on the open web and with data brokers. Here’s exactly what happened, how to check if you were affected, and what to do next.
What happened
Supernus Pharmaceuticals, listed on NASDAQ under the ticker SUPN, was posted on the Hive ransomware group's leak site on February 25, 2022. The entry indicates that files were removed from the company's systems during a ransomware operation. No further details on the method of access, the volume of data, or confirmation of encryption have been made public.
The group claims to have stolen internal data. Public records do not show an official statement from Supernus confirming or denying the claims at the time of the listing.
Who is hive?
Hive operates as a ransomware-as-a-service group that supplies encryption tools and infrastructure to affiliates. The group commonly employs a double-extortion approach, encrypting systems and also removing copies of data before demanding payment. Hive has appeared in multiple public listings involving organizations across sectors since at least 2021, with its leak sites used to publish samples or directories of claimed stolen material when negotiations fail.
About Supernus Pharmaceuticals, NASDAQ: SUPN
Supernus Pharmaceuticals develops and commercializes medications, primarily in neurology and psychiatry. Companies of this type maintain records that can include research data, regulatory submissions, manufacturing details, and information on clinical trial participants or prescribing physicians. A listing on a ransomware leak site draws attention because such records often contain material that is both commercially sensitive and subject to regulatory protections.
What was likely exposed
The listing refers to internal files exfiltrated in a ransomware attack. No inventory of specific file types or data categories has been released. Organizations in the pharmaceutical sector routinely hold research documentation, employee records, and information related to clinical studies; however, the exact contents of the material claimed by the group remain unconfirmed.
Why it matters
Exposure of internal files can create operational and regulatory consequences for the affected company, including potential review by oversight bodies that govern drug development and data handling. For individuals whose information may appear in such files, the primary concerns are the long-term availability of the data on criminal marketplaces and the difficulty of determining downstream misuse when the precise records are not publicly detailed.
If your data was in this claimed breach
Monitor accounts associated with any email addresses or identifiers that could have been stored by the company and enable multi-factor authentication where available. Review statements from financial or medical providers for unusual activity. Individuals can also run a free exposure scan of their email address against known breach data sets to check for appearances in previously published collections.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Centro Médico Virgen De La Caridad Listed by hive Ransomware GroupInstituto De Gesto Estratégica De Sade Do Distrito Federal Listed by hive Ransomware GroupCentre D'Odontologia Integrada Miret-Puig Listed by hive Ransomware GroupMHMR Authority Of Brazos Valley Listed by hive Ransomware GroupLatest breaches
Publicly posted by hive — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.