FulcrumSec's 2-Month Intrusion at Novo Nordisk Yields 1TB Data, $25M Ransom

Cybersecurity professionals tracking emerging threat actors will dissect FulcrumSec's latest operation at Novo Nordisk as a textbook example of modern data extortion. The group's ability to dwell undetected for over 60 days, harvest 1TB of critical IP and PII, and then negotiate anonymously via Proton Mail, demonstrates a high level of operational security. As FulcrumSec now threatens selective data sales or open-source release, the incident provides valuable threat intelligence on the group's motivations, capabilities, and potential links to other criminal ecosystems.

On June 16, 2026, cyber extortion group FulcrumSec publicly claimed to have breached Danish pharmaceutical giant Novo Nordisk, exfiltrating over a terabyte of highly sensitive data and demanding a $25 million payment. Novo Nordisk had already disclosed a cybersecurity incident on June 11, acknowledging unauthorized access to some internal IT systems and personal data, but the full scope alleged by the attackers—including source code, proprietary drug information, clinical trial data, employee and patient records, manufacturing details, and internal AI model data—would represent one of the most severe intellectual property and data thefts in the industry's history. The group, which first surfaced in October 2025, says it spent more than two months inside Novo Nordisk’s networks before initiating contact with executives on June 1. After the company refused to pay, FulcrumSec announced it is now exploring private sales of select drug-related data while withholding employee and patient data, citing a preference to open-source material as a deterrent against future non-payment.

“

On June 16, 2026, cyber extortion group FulcrumSec publicly claimed to have breached Danish pharmaceutical giant Novo Nordisk, exfiltrating over a terabyte of highly sensitive data and demanding a $25 million payment.

The incident highlights a troubling shift in cyber extortion tactics. Unlike traditional ransomware attacks that encrypt data and demand payment for decryption keys, FulcrumSec focused entirely on data theft and the threat of public release or sale. This removes the technical overhead of encryption and puts the onus squarely on the victim to prevent exfiltration. The $25 million demand is far above typical ransomware amounts, reflecting the perceived market value of pharmaceutical intellectual property, which can exceed a billion dollars in R&D investment for a single blockbuster drug. Novo Nordisk’s portfolio includes leading diabetes and obesity treatments, making its stolen data a potential goldmine for competitors, generic manufacturers, or even nation-states seeking to accelerate their own drug development programs.

From a regulatory perspective, the breach carries massive compliance implications. The alleged theft of patient and doctor data likely triggers notification requirements under GDPR in Europe and potentially HIPAA in the U.S., with fines that can reach 4% of global annual turnover. Clinical trial data, if exposed, could compromise the integrity of ongoing studies and erode trust in the company’s regulatory submissions. The company’s admission of unauthorized access to personal data suggests that at least some of FulcrumSec’s claims may be grounded in reality, though Reuters was unable to independently verify the sample data posted by the group.